Capstone: human factors, electronic permits, audits and a turnaround permit plan

This final lesson brings the course together. It looks at the human side of permits and isolation on oil and gas sites, at how electronic permit systems work in the field, and at how audits show whether the system is really working. Then it works through a complete permit and isolation plan for a turnaround task at the Spruce Ridge sour gas plant, using the tools from every earlier lesson. HSE-221 covers human factors, electronic permits and auditing for permit systems in general; this lesson focuses on what is different in oil and gas.

Human factors that undermine permits in oil and gas

Permit and isolation failures are almost never caused by people who do not care. They come from ordinary people working under conditions that make shortcuts feel reasonable. Several conditions are common on oil and gas sites:

• Production pressure. Every hour a well, compressor or plant train is down costs money, and everyone knows it. Crews and issuers may feel pushed to start before the plant is ready or to skip the hold test.
• Fatigue. Twelve-hour shifts, long rotations, night work and long drives build fatigue that slows thinking and dulls attention to detail, especially at the end of a hitch or during a turnaround.
• Workload peaks. A turnaround can raise the number of permits from a handful a day to hundreds, with surge contractors who do not know the site, and issuers who become bottlenecks.
• Normalization of deviance. When a shortcut works many times, such as cracking a flange with the bleed still hissing slightly, it becomes the normal way of working until the day it fails.
• Distance and isolation. At remote sites, crews may make decisions alone that would be challenged at a staffed plant.
• Contracting arrangements. Contractors paid by the job or the day may feel pressure to finish quickly or reluctant to stop work that the operator has authorized.

Good permit systems are designed around these realities: issuer numbers planned for peak workload, fatigue rules for permit roles, stop-work authority that is used and rewarded, and leaders who visibly accept delays when the plant is not ready. A permit system that only works when people are rested, unhurried and fully staffed will fail on exactly the days it is most needed.

Electronic permits in the field

Many oil and gas operators now use electronic permit-to-work systems. HSE-221 described their general benefits and risks. In the oil and gas field, a few features matter especially:

• Linked isolation management, where isolation points are drawn from the plant model and the system can refuse to close an isolation while dependent permits are open.
• Mobile devices at the worksite, which in classified areas must be rated for the hazardous location or used only after a gas test under a hot work or device permit.
• Offline working at remote sites with poor connectivity, with permits and gas tests synchronized when the device reconnects, and a clear rule for what happens if the system is unavailable.
• Maps showing all active permits, overrides and SIMOPS restrictions across a pad or plant, used at the daily coordination meeting and in the control room.
• Records of gas tests, revalidations and handovers that make audits and investigations much easier.

The main risk is that the screen replaces the site visit. A system that lets an issuer approve a permit from a pickup truck without walking the job can make the paperwork faster while removing the most important check. Companies guard against this by requiring the site visit to be confirmed at the worksite, for example by scanning a tag on the equipment, and by auditing how long issuers spend at each job.

Auditing permits across sites and contractors

Audits show whether permits are being used as the standard says. HSE-221 showed how to estimate a single compliance rate with a confidence interval. On oil and gas operations, auditors often want to compare rates between sites or contractors, because a problem may be concentrated in one place. The program below summarizes field audits of permits held by three contractors at Larchwood sites over a quarter and calculates a 95 percent Wilson confidence interval for each contractor's compliance rate, so that differences can be judged against the uncertainty that comes with small samples.

# Compare permit audit results by contractor with 95 percent Wilson intervals (invented data).
import math

def wilson(passed, n, z=1.96):
    p = passed / n
    mid = (p + z * z / (2 * n)) / (1 + z * z / n)
    half = z * math.sqrt(p * (1 - p) / n + z * z / (4 * n * n)) / (1 + z * z / n)
    return mid - half, mid + half

audits = {  # contractor: (permits audited, fully compliant)
    "Contractor A (mechanical)": (48, 44),
    "Contractor B (electrical)": (22, 21),
    "Contractor C (insulation)": (30, 19),
}
failures = {"no hold test recorded": 7, "gas test overdue": 6, "crew not briefed at site": 4,
            "override without time limit": 3, "isolation tag mismatch": 2}

total_n = sum(n for n, _ in audits.values())
total_ok = sum(ok for _, ok in audits.values())
for name, (n, ok) in audits.items():
    lo, hi = wilson(ok, n)
    print(f"{name:<27} {ok:>2}/{n:<2} = {ok / n:5.1%}  (95% CI {lo:5.1%} to {hi:5.1%})")
lo, hi = wilson(total_ok, total_n)
print(f"{'All contractors':<27} {total_ok:>2}/{total_n:<2} = {total_ok / total_n:5.1%}  (95% CI {lo:5.1%} to {hi:5.1%})")
print("Most common findings:")
for finding, count in sorted(failures.items(), key=lambda kv: -kv[1]):
    print(f"   {count:>2}  {finding}")

Contractor A (mechanical)   44/48 = 91.7%  (95% CI 80.4% to 96.7%)
Contractor B (electrical)   21/22 = 95.5%  (95% CI 78.2% to 99.2%)
Contractor C (insulation)   19/30 = 63.3%  (95% CI 45.5% to 78.1%)
All contractors             84/100 = 84.0%  (95% CI 75.6% to 89.9%)
Most common findings:
    7  no hold test recorded
    6  gas test overdue
    4  crew not briefed at site
    3  override without time limit
    2  isolation tag mismatch

Contractor C's compliance rate of about 63 percent is well below the others, and its confidence interval does not overlap with Contractor A's, so the difference is unlikely to be chance. Contractor B looks best, but with only 22 permits audited its interval is wide. The most common findings, missing hold tests and overdue gas tests, point to specific steps that need coaching. An audit program like this should lead to action: a meeting with Contractor C's supervisors, extra field coaching on hold tests and gas test timing, and a follow-up audit to see whether the rate improves.

Leading indicators

Waiting for incidents to measure permit performance means learning too late. Useful leading indicators for oil and gas permit systems include the audit compliance rate and its trend, the number of overrides active for more than their time limit, the number of long-term isolations past their review date, the time issuers spend at each worksite, the number of permits revalidated without a fresh gas test, and the number of stop-work interventions related to permits. These should be reviewed by site leadership regularly, not just collected.

Capstone: a turnaround task at Spruce Ridge

Spruce Ridge is shutting down one of its two inlet trains for a planned turnaround while the other train keeps processing sour gas. One task is to open and internally inspect the train 1 inlet separator, which has been in sour service, and to replace its liquid level control valve. A crane will lift the old valve out over the pipe rack. A scaffold contractor, a mechanical contractor, an inspection company and the crane company will all work on the task, alongside many other turnaround jobs. The plan below draws on every lesson in the course.

The plan, step by step

• Legal and standards map (Lesson 2): the task falls under the hazardous energy, confined space and lifting rules, plus the company's line-break and isolation standards; the duty map is attached to the work pack.
• Roles (Lesson 3): a dedicated turnaround permit coordinator issues all permits for the task; operations provide the isolating authority; each contractor names a receiver; the inspection company's entrants have a trained attendant and an on-site rescue team.
• Permits (Lesson 4): a line opening permit, a confined space entry permit, a critical lift permit and a cold work permit for scaffolding, cross-referenced to one isolation certificate and an override certificate for the separator's level and pressure trips.
• Gas testing (Lesson 5): oxygen, LEL, H2S and benzene before the first break and before entry, at top, middle and bottom of the vessel, with continuous personal and area monitoring and a retest after every break.
• Line opening and entry (Lesson 6): sour-service first-break controls with supplied air; positive isolation for entry; water washing, wet scale, a NORM survey and supplied air for entrants.
• Preparation (Lesson 7): depressure to flare, drain to the closed drain system, pressure-cycle purge with nitrogen and confirm by gas test, with a field walk-down of the isolation sketch.
• Isolation selection (Lesson 8): positive isolation on every connection for entry, installed under double block and bleed; the relief connection blinded with the flare header confirmed safe; no control or shutdown valves counted as isolations.
• Certificate and verification (Lesson 9): every path traced, including the nitrogen connection and instrument taps; actuated valves with supplies isolated and locked; a 30-minute hold test; a group lockout box for the four contractors.
• SIMOPS (Lesson 10): a barrier between train 1 and running train 2; no crane load over train 2; hot work elsewhere in the area checked against the matrix; one alarm and muster plan for the turnaround.
• Handover and close-out (Lesson 11): written handover of every open permit at each shift change; suspension on any alarm; de-isolation by blind list, nitrogen purge of air, leak test, overrides cleared and a pre-startup review before train 1 returns to sour service.

Checking the plan before it goes to the field

Turnaround plans are long, and something is always missing. The program below runs a few simple checks on a summary of the capstone plan, the kind of cross-checks a permit coordinator or an electronic system would run before the work pack is released.

# Cross-check a summary of the capstone plan before release (teaching checks).
plan = {
    "activities": ["line opening", "confined space entry", "critical lift", "scaffolding"],
    "permits": ["line opening", "confined space entry", "critical lift", "cold work"],
    "isolation_points": {  # point: (method, required by standard)
        "inlet": ("positive isolation", "positive isolation"),
        "gas outlet": ("positive isolation", "positive isolation"),
        "liquid outlet": ("positive isolation", "positive isolation"),
        "drain": ("positive isolation", "positive isolation"),
        "relief connection": ("positive isolation", "positive isolation"),
        "nitrogen connection": ("disconnected and capped", "positive isolation"),
        "level bridle taps": ("double block and bleed", "positive isolation"),
    },
    "hold_test_min": 30,
    "rescue_team_on_site": True,
    "overrides": {"LSLL-101": 72, "PSHH-102": None},   # hours allowed; None = no time limit
    "crane_over_live_train": False,
}
ACCEPTABLE_AS_POSITIVE = {"positive isolation", "disconnected and capped"}
issues = []
needed = {"line opening": "line opening", "confined space entry": "confined space entry",
          "critical lift": "critical lift", "scaffolding": "cold work"}
for act in plan["activities"]:
    if needed[act] not in plan["permits"]:
        issues.append(f"no permit for {act}")
for point, (method, required) in plan["isolation_points"].items():
    if required == "positive isolation" and method not in ACCEPTABLE_AS_POSITIVE:
        issues.append(f"{point}: {method} is below the standard ({required})")
if plan["hold_test_min"] < 15:
    issues.append("hold test too short")
if "confined space entry" in plan["activities"] and not plan["rescue_team_on_site"]:
    issues.append("no rescue team on site for entry")
for tag, hours in plan["overrides"].items():
    if hours is None:
        issues.append(f"override {tag} has no time limit")
if plan["crane_over_live_train"]:
    issues.append("crane load path over the live train")
print("Plan ready for release" if not issues else "Fix before release:")
for i in issues:
    print("   -", i)

Fix before release:
   - level bridle taps: double block and bleed is below the standard (positive isolation)
   - override PSHH-102 has no time limit

The check finds two problems that a busy planner could easily miss. The level bridle taps are isolated only by double block and bleed, but the standard requires positive isolation because people will enter the vessel, so blinds must be added at the bridle flanges or the bridle removed. And the high-high pressure trip override has no time limit, so it needs one, with a compensating measure, before the override certificate can be approved. Everything else in the summary meets the checks. In a real turnaround, the same discipline applies to hundreds of tasks, which is why permit coordinators and electronic systems run such checks routinely.

Closing thoughts

The incidents in Lesson 1 spanned four decades, but they failed in the same few ways: isolations that did not match the hazard, hot work without a permit or a gas test, equipment isolated from its relief, gauges trusted without question and isolation points missed or left unlocked. Every one of those failures is preventable with tools covered in this course. The tools only work when people use them as intended: a site visit that is really a visit, a hold test that is really watched, a signature that means something was checked, and a stop that is welcomed rather than resented. That is the real permit to work.