The permit life cycle

A permit is not a single moment of signing. It has a life cycle that starts when someone first identifies the work and ends only when the plant has been returned to operations and the permit is filed. Each stage has its own purpose, its own checks and its own ways of going wrong. This lesson walks through the life cycle stage by stage, using the sequence most sites follow, and shows how the permit's period of validity is managed across shifts.

1. Request

The cycle begins when a planner, supervisor or contractor identifies work that needs a permit and submits a request. The request describes the job, the equipment by tag number, the location, the expected start and duration, the number of people and the contractor involved. Good requests arrive early, ideally a day or more before the work for routine maintenance and weeks ahead for shutdown work, so that the area authority can plan isolations and avoid conflicts. Requests that arrive at 7 a.m. for work starting at 7:15 put pressure on everyone to cut corners.

2. Assess and plan

Before a permit can be prepared, the hazards of the specific task must be assessed. Most sites use a job hazard analysis or job safety analysis that breaks the task into steps and identifies the hazards and controls at each step. HSE-223 covers risk assessment methods in detail. For permitted work, the assessment should address the plant state needed (isolated, drained, purged, cooled), the hazards the work itself creates (sparks, dropped objects, line release), the environment (weather, nearby operations, other permits) and emergency arrangements. The output is a list of precautions that will appear on the permit and its certificates.

3. Prepare the plant

Operations now prepares the equipment. This may involve shutting down, isolating, depressurizing, draining, flushing, purging, steaming out, ventilating, cooling and testing. Each isolation is applied by an isolating authority and recorded on an isolation certificate. Gas tests are carried out by an authorized gas tester and recorded. Barriers, signs and drip trays are put in place. This stage can take minutes for a simple job or days for a large vessel. The permit must not be issued until preparation is complete and verified.

4. Issue on site

The issuer and the permit holder meet at the work site for the joint site visit. Together they confirm that the right equipment has been identified, that the isolations on the certificate are in place and verified, that the gas test results are acceptable and current, that the area is safe and that the precautions are adequate. The issuer explains the hazards, the limits of the work and any special conditions. If both are satisfied, both sign the permit, and the issuer records the time of issue and the validity period. The permit, or a copy, is displayed at the work site, and the control room or permit office records it as live.

5. Brief the crew

Before work starts, the permit holder briefs every member of the work party at the job site. This toolbox talk covers the scope of work, the hazards, the precautions, the PPE, emergency arrangements, the limits of the permit and the conditions under which work must stop. Each crew member signs or otherwise acknowledges the permit. Anyone joining the crew later must receive the same briefing before starting.

6. Do the work

The crew carries out the job within the limits of the permit. During the work:

• The permit stays at the work site, visible to anyone who needs to check it.
• Gas tests are repeated at the intervals the permit requires, and after any break, change of conditions or alarm.
• The holder watches for changes in conditions, such as a new smell, a leak, weather or nearby activity, and stops work if conditions change.
• If the scope needs to change, work stops and the permit is reviewed or reissued; the crew never simply carries on.
• Supervisors and issuers make periodic checks to confirm the permit conditions are still being met.

Suspension and revalidation

Many jobs last longer than one shift. When the work stops at the end of a shift, for a break or because of an emergency or alarm, the permit is suspended. The holder makes the site safe, records the state of the work, and signs the suspension section; the issuer accepts the suspension. Before work resumes, the permit is revalidated: the issuer and holder (who may be new people on the next shift) check that the isolations are intact, retest the atmosphere, confirm that nothing has changed, and sign the revalidation. Lesson 10 deals with suspension, handover and long-duration work in detail.

7. Hand back

When the work is finished, the holder makes sure the crew has left the area, tools and materials have been removed, temporary equipment such as blinds or barriers is accounted for, and the equipment is in a fit state to return to service. The holder signs the handback section to declare that the work is complete and the equipment is ready to return to operations. If the work is not finished but the permit is no longer needed, for example because the job is being stopped, the holder records exactly what state the equipment has been left in.

8. Close out

The issuer inspects the site with the holder, confirms that the work is complete and the site is clean and safe, and accepts the handback. Isolations are then removed in a controlled sequence by the isolating authority, under the isolation certificate, making sure that every person and every lock has been cleared. The equipment is tested or commissioned as needed and returned to operations. The issuer closes the permit, records the time, and the control room or permit office updates its records. Closed permits are kept for a set period for audit and investigation.

Managing validity across shifts

Every permit has a validity period. Sites usually limit permits to one shift, a fixed number of hours, or a maximum number of days with revalidation at each shift change. The aim is to make sure someone who knows the current state of the plant looks at the work at regular intervals. Validity rules must be simple enough that everyone can tell at a glance whether a permit is current.

Permits are also commonly limited by the number of revalidations, for example a maximum of 14 shifts, after which the job must be reassessed and a new permit issued. This prevents permits from running on for weeks while conditions slowly drift away from those originally assessed.

What happens in an emergency

When an emergency alarm sounds, all permitted work stops. Permits are automatically suspended, and the work party leaves the area by the planned route. Before work resumes, every permit in the affected area must be revalidated, because the emergency may have changed conditions, for example by releasing gas, opening isolations or activating deluge. Some sites require new gas tests for all permits after any alarm in the area, even a false one.

In the US, emergency procedures for permitted work should align with the emergency action plan required by 29 CFR 1910.38 and, at PSM-covered facilities, the emergency planning element in 1910.119(n) (see HSE-105).

Keeping the record

Throughout the life cycle, the permit register keeps track of every permit's status. Whether it is a rack of permits in the control room, a logbook or an electronic system, the register should show at any moment which permits are planned, live, suspended and closed, where each job is, who holds each permit, and which isolations and certificates are linked. The register is used at coordination meetings, at shift handover and by operators before they make any change to the plant. A permit that is live in the field but missing from the register is a serious failure, because others will plan and operate as if the work does not exist.

When the life cycle is cut short

Not every permit runs its full course. A job may be canceled before issue because priorities change, or stopped partway because the scope turns out to be different from what was planned. A canceled permit should be marked as canceled in the register so that no one later assumes the work is still pending. A stopped job should be handed back with an exact record of the state of the equipment, and any isolations should either stay in place under a long-term isolation certificate or be removed through the normal close-out process. Leaving a job half-finished without a clear record is one of the classic ways that hazards are passed silently to the next person.

A simple way to check your understanding of the life cycle is to pick a real permit from your site and trace it through each stage: who requested it, what assessment it was based on, how the plant was prepared, who issued and accepted it, how the crew was briefed, how many times it was suspended and revalidated, and how it was closed. Gaps in that story are gaps in the system.