History and major accident lessons

Permit-to-work systems are written in the language of lessons learned. Almost every box on a modern permit form, every rule about shift handover and every requirement to display permits in the control room can be traced back to an incident in which people died because one of those things was missing. This lesson looks at how permit systems developed and at several major accidents in which failures of permits, isolations or handover played a central part. The aim is not to memorize dates but to recognize patterns, because the same failures keep returning in new places and new industries.

From local practice to formal systems

Early industrial sites controlled dangerous maintenance work informally. A foreman told a fitter which valve was safe, a chargehand chalked a warning on a vessel, or a padlock was hung on a switch. These arrangements worked tolerably well in small plants where everyone knew each other and the plant changed slowly. As plants grew larger, more complex and more continuous, informal methods broke down. Shifts changed several times a day, contractors arrived for shutdowns, and the people who isolated equipment were no longer the people who worked on it.

By the middle of the twentieth century, written permit systems were common in chemical plants, refineries, shipyards and mines, often developed by large companies and shared through industry associations. Different companies used different forms, names and colors, which caused confusion when contractors moved between sites. From the 1970s onward, regulators and industry bodies began to publish general guidance on what a good permit system should contain. In the United Kingdom, the Health and Safety Executive's 1997 publication on permit-to-work systems, revised in 2005 as HSG250, became the most widely cited reference. In North America, permit requirements appeared mainly inside specific regulations for confined spaces, hot work and process safety, as Lesson 3 explains.

Piper Alpha, 1988

Piper Alpha was an oil and gas production platform in the UK sector of the North Sea. On the night of 6 July 1988, a series of explosions and fires destroyed it and killed 167 people, 165 on the platform and two crew members of a rescue vessel. It remains the deadliest offshore oil and gas disaster.

Earlier that day, a pressure safety valve had been removed from one of two condensate injection pumps for routine maintenance. The open pipework was sealed with a blind flange that was only hand tight and not designed to hold full pressure. The work was not finished by the end of the day shift. The permit for the valve work was returned to the control room but was filed separately from the permit for the pump itself, and the night shift was not clearly told that the valve was missing. When the other condensate pump tripped late in the evening, the night crew, under pressure to restore production, checked the paperwork they could find, did not realize the relief valve was off, and started the pump. Condensate leaked from the blind flange and ignited.

The initial explosion was followed by fires fed by oil and, later, by the rupture of high-pressure gas risers connected to other platforms that kept supplying fuel. Firewalls were designed for fire, not blast, and the deluge system was in manual mode because divers had been working nearby. Many workers waited in the accommodation block for instructions that never came.

The public inquiry, led by Lord Cullen and reported in 1990, found serious weaknesses in the permit system. Among its findings were that operators and maintenance staff did not fully understand the system, that permits for related work were not cross-referenced, that the condition of plant was not clearly communicated at shift handover, and that monitoring and auditing of the permit system were inadequate. The inquiry's recommendations led to a goal-setting safety case regime offshore in the United Kingdom, and they reshaped permit practice internationally. Cross-referencing of related permits, formal shift handover of permits and regular audits of the system all trace back, at least in part, to Piper Alpha.

Texas City, 2005

On 23 March 2005, an explosion and fire at the BP Texas City refinery in Texas killed 15 people and injured about 180. During the startup of an isomerization unit, a distillation tower was overfilled for hours, and hydrocarbon liquid flowed to a blowdown drum and stack that vented directly to the atmosphere. A geyser of flammable liquid and vapor was released and ignited, probably by an idling vehicle nearby.

The US Chemical Safety and Hazard Investigation Board (CSB) investigated. Most of the people killed were contractors working in temporary trailers placed near the unit. The trailers had been sited there without proper assessment of the risk from the operating unit, and the people inside were not told about the startup. The CSB found failures in procedures, instrumentation, staffing, fatigue, communication at shift change and the company's safety culture, and it also highlighted the danger of putting occupied buildings and non-essential people near hazardous operations. For permit systems, Texas City is a lesson about simultaneous operations and about the people who are not doing the work but are close enough to be harmed by it. Lesson 9 returns to that theme.

Deepwater Horizon, 2010

On 20 April 2010, a blowout on the Deepwater Horizon drilling rig in the Gulf of Mexico caused explosions and a fire that killed 11 workers and led to the largest marine oil spill in US history. The causes were complex and centered on well design, cement and pressure testing decisions and the failure of the blowout preventer. Investigators, including a presidential commission and the CSB, described poor communication between companies on board, unclear lines of authority and weaknesses in how changes and risks were managed. Although it was not mainly a permit failure, it shows how complex operations with several organizations, each with its own procedures, can lose a shared picture of risk. Permit systems are one of the tools that keep that picture shared.

Westray, 1992, and Canadian law

On 9 May 1992, a methane and coal dust explosion at the Westray coal mine in Plymouth, Nova Scotia, killed 26 miners. A public inquiry led by Justice Peter Richard found that the mine had been operated with a disregard for basic safety practices and that regulators had failed to enforce the law. Westray was not mainly a permit failure, but its legacy shapes how Canadian law treats the people who direct work. In 2004, Parliament amended the Criminal Code, adding section 217.1, which places a legal duty on everyone who directs, or has authority to direct, how another person does work to take reasonable steps to prevent bodily harm arising from that work. Organizations can also be held criminally liable for the conduct of their senior officers. For anyone who issues permits or supervises permitted work, this is a reminder that the role carries legal weight.

Smaller incidents with the same lessons

Major disasters attract attention, but the same failures cause many smaller incidents every year. Investigations by regulators such as WorkSafeBC, provincial ministries, OSHA and the CSB, and reports shared through industry bodies, repeatedly describe events like these:

• A fitter opens a flange on a line that was isolated on paper but not drained, and is sprayed with hot or corrosive liquid.
• A welder starts work on a tank that was gas tested the previous day, but vapors have since built up from residue or a leaking valve.
• A worker enters a vessel while another crew, working under a different permit, opens a nitrogen purge line to the same vessel.
• A crane lift is made over a pipe rack where another crew is working, because the two jobs were permitted separately by different people.
• Equipment is restarted at shift change because the incoming operator does not know a permit is still open on it.

Learning without the disaster

The value of studying incidents is that it lets an organization learn without paying the price itself. Good permit systems include a habit of reading and discussing incident reports, both from inside the company and from published investigations, and asking whether the same thing could happen here. Lesson 12 discusses how near misses and audit findings feed into improvements.