Why permit systems exist and what they are

Most work in a plant, mine, hospital, data center or construction site is routine. People follow standard procedures, the hazards are well known and the controls are built into the job. A small part of the work is different. It is done only now and then, often by people who do not normally work in the area, and it brings energy, flammable materials, toxic atmospheres or heights together with people in ways that the normal controls were never designed for. Breaking into a pipe that carried a hydrocarbon, entering a tank, welding near a fuel line, digging beside a buried power cable or working on a live electrical panel are examples. A permit-to-work system is the formal method that organizations use to control this kind of work.

This course is about the permit system as a whole: how it is designed, who does what, how permits are prepared, issued, suspended and closed, how they connect to isolations and gas tests, how several jobs in the same area are coordinated, and how the system is monitored. Earlier courses dealt with individual high-risk activities in depth. Lockout and hazardous energy control were covered in HSE-210, confined space entry in HSE-211, work at heights in HSE-212, electrical work in HSE-214 and hot work in HSE-216. Here we pull those threads together. This is an awareness course. It explains how permit systems work so that you can take part in one safely and recognize when it is failing; it does not authorize anyone to issue, accept or sign permits. That authority comes only from your employer, after site-specific training and assessment.

What a permit to work is

A permit to work is a written or electronic document that authorizes specific people to carry out specific work, at a specific place, during a specific time, after the hazards have been identified and the precautions needed to control them have been put in place and checked. It is signed by the person who controls the area or plant (who confirms the plant is safe to work on) and by the person who will do or lead the work (who confirms they understand the hazards and precautions). It stays at the work site while the job is under way and is formally closed when the work is finished and the plant is handed back.

The UK Health and Safety Executive's guidance on permit-to-work systems, known by its publication number HSG250 and first issued in 2005, is still the most widely quoted international reference. It describes a permit system as a formal recorded process used to control work that is identified as potentially hazardous, and as a means of communication between site management, plant supervisors and operators, and those who carry out the hazardous work. That last point matters. A permit is not mainly a piece of paper. It is a structured conversation, with a written record, between the people who know the plant and the people who are about to work on it.

A permit system serves several purposes at once:

• It makes sure that the hazards of a particular job have been thought about in advance, by people with the right knowledge, rather than discovered when the work starts.
• It records exactly what precautions are needed, such as isolations, gas tests, ventilation, barriers or a fire watch, and who has put them in place.
• It controls who may do the work and when, so that work does not start before the plant is ready or continue after conditions change.
• It coordinates work so that one job does not create a hazard for another, for example hot work near a line that another crew is about to open.
• It provides a formal handover of the plant from operations to maintenance and back again, so that equipment is not restarted while people are still working on it.
• It creates a record that supervisors and auditors can check later to see whether the system is working.

What a permit system is not

Because permits involve signatures and forms, it is easy to mistake the paperwork for the protection. Several misunderstandings come up again and again in incident investigations.

• A permit does not make a job safe by itself. The precautions written on the permit make the job safe, and only if they are actually carried out, checked and kept in place. A permit with all the boxes ticked over a valve that was never closed gives no protection at all.
• A permit is not a substitute for a risk assessment. The permit should be based on a job hazard analysis or other assessment of the specific task. Where the risk assessment is missing or generic, the permit often lists precautions by habit rather than by need.
• A permit is not a substitute for competence. The people who prepare, issue and accept permits must understand the plant and the hazards. A signature from someone who does not know what they are signing is worse than useless, because it creates false confidence.
• A permit is not a general license to work. It covers one defined job. If the scope changes, the location moves or new hazards appear, the work must stop and the permit must be reviewed or a new one issued.
• A permit system is not only for maintenance staff or contractors. Operators, supervisors, engineers and managers all have roles in it, and the system fails when any of them treats it as someone else's paperwork.

Why permit systems became necessary

Formal permit systems grew out of hard experience in the process, petroleum, chemical, shipbuilding and mining industries. Investigations of fires, explosions, poisonings and crushing incidents repeatedly found that maintenance work had been carried out on equipment that was still connected to hazardous energy or materials, that one crew did not know what another was doing, or that plant was restarted while people were still inside it. The common thread was a breakdown in communication about the state of the plant and the work being done on it.

Lesson 2 examines several major accidents in detail. The best known is the Piper Alpha disaster in the North Sea in 1988, in which 167 people died. A key part of the chain of events was that a pump whose pressure safety valve had been removed for maintenance was restarted by a night shift that did not know the valve was missing, because the permit for that work had not been effectively communicated at shift change. The public inquiry led by Lord Cullen made far-reaching recommendations about permit systems and handover, and it shaped permit practice around the world.

Where permit systems are used

Permit systems are most associated with oil and gas, refining, petrochemicals and chemicals, but they are used wherever non-routine work brings serious hazards together. Typical users include:

• Upstream oil and gas facilities, pipelines and gas plants, where hydrocarbons and sour gas are present.
• Refineries, chemical plants, pulp and paper mills, fertilizer plants and other process industries.
• Mining and mineral processing, including underground mines.
• Power generation, electrical utilities and large electrical installations.
• Data centers, hospitals and other critical facilities, where work on power, cooling and fire protection systems must be controlled so that it does not take the facility down or endanger people.
• Large construction and shutdown projects, especially in operating plants where construction crews work beside live process equipment.
• Water and wastewater treatment, where confined spaces and toxic gases are common.
• Ports, ships and offshore installations.

The details vary by industry and site, but the principles are the same. A permit system is built around the plant and the work it does, not copied from another workplace.

The basic flow of a permit

Lesson 7 walks through the permit life cycle step by step. In outline, a typical permit passes through these stages:

• A request: someone identifies work that needs doing and asks for a permit, describing the job, the equipment and the time needed.
• Assessment and planning: the hazards are identified, usually through a job hazard analysis, and the precautions are decided.
• Preparation: operations prepare the plant by isolating, draining, purging, cleaning and testing as required. Isolation certificates and gas test results are recorded and linked to the permit.
• Issue: the issuer checks the site with the person who will lead the work, confirms the precautions are in place and explains the hazards. Both sign. The permit is displayed at the work site and in the control room or permit office.
• Work: the crew carries out the job within the limits of the permit. Gas tests are repeated as required. If conditions change or the job cannot be finished in time, the permit is suspended or extended through a formal process.
• Handback and close-out: the crew leaves the area clean and safe, the permit holder signs that the work is complete, the issuer inspects the site, isolations are removed in a controlled way, and the permit is closed.

The cost of getting it wrong, and of overdoing it

When permit systems fail, the consequences can be catastrophic, as the cases in Lesson 2 show. But permit systems can also fail by becoming too heavy. When every small task needs a long form, people learn to fill in forms without thinking, and the important permits get the same automatic treatment as the trivial ones. Experienced safety professionals often say that a permit system should be used for the work that really needs it and should be taken seriously every single time. Lesson 4 explains how to choose which work needs a permit and which can be handled by procedures and training.