Isolations and the permit

Most permitted work depends on isolation: separating the equipment from every source of hazardous energy and material, securing that separation so it cannot be undone by accident, and proving it is effective before anyone starts work. HSE-210 covered lockout and hazardous energy control in depth, including the types of energy, lockout devices, verification and group lockout. This lesson looks at isolation from the point of view of the permit system: how isolations are planned, recorded and cross-referenced to permits, how isolation standards are chosen, and how sites manage the many locks and points involved in complex jobs.

Why isolation is central to the permit

Investigations of permit failures show the same story again and again: work was done on equipment that was not properly isolated, or isolations were removed while someone was still working. The permit may have been perfectly filled in, but the isolation behind it was wrong, incomplete or not verified. For this reason, most permit systems treat the isolation certificate as the backbone of the permit for any work that breaks containment or exposes people to energy. If the isolation is not right, nothing else on the permit matters.

Isolation standards

Not all isolations give the same protection. Process industries rank isolation methods by how reliably they prevent the release of hazardous material. The UK HSE's guidance on isolation, HSG253 'The safe isolation of plant and equipment' (2006), is widely used internationally, alongside company standards. A typical hierarchy for process isolation is:

• Positive isolation: complete physical separation, such as removing a spool piece, fitting a spade or blind, or disconnecting a line. This is the most secure method and is usually required for confined space entry and for highly hazardous fluids.
• Double block and bleed: two closed and locked valves with a vented, drained section between them, so that any leakage past the first valve is released safely and can be detected.
• Double block: two closed and locked valves without a bleed. Less secure, because leakage past the first valve builds up between them.
• Single valve isolation: one closed and locked valve. Acceptable only for low-hazard systems, short-duration work, or as a temporary step while a more secure isolation is installed.

For electrical isolation, the hierarchy runs from withdrawing or racking out a breaker and locking it in the disconnected position, through opening and locking a disconnect switch with a visible break, to removing fuses. Electrical isolations must always be proved dead with a tested voltage detector, following the live-dead-live check described in HSE-214.

The site's isolation standard should state which method is required for which combination of hazard and task. For example, a site might require positive isolation for any vessel entry and for hydrogen sulfide service, double block and bleed for work on hydrocarbon lines above a certain pressure, and allow single valve isolation only for water and air systems under a set pressure.

Planning isolations

Isolations are planned as part of permit preparation, usually by operations with input from maintenance and engineering. Good planning uses up-to-date piping and instrument diagrams (P&IDs) and electrical single-line diagrams, marked up to show every isolation point, drain, vent and test point. The planner considers:

• Every source of energy and material that could reach the work: process lines, utilities, steam tracing, nitrogen, instrument air, electrical supplies including control power, stored energy in springs or accumulators, and gravity.
• The required isolation method for each point, based on the isolation standard.
• How each isolation will be verified, for example by opening a bleed valve, checking a pressure gauge, testing for voltage or attempting a start.
• The order in which isolations are applied and later removed.
• Whether any isolation affects other equipment or other permits, for example a header valve that also feeds a running unit.

The plan becomes the isolation certificate, which lists each point with its tag number, required position, method, lock number, who applied it, who verified it and when.

Linking isolations and permits

The isolation certificate must be linked to every permit that depends on it. Sometimes several permits depend on one isolation, for example when a mechanical crew, an instrument technician and an insulation contractor all work on the same isolated pump. In that case the isolation must not be removed until every dependent permit has been handed back and closed. Sites manage this in several ways:

• A cross-reference list on the isolation certificate showing every dependent permit, with a column that is signed off as each permit closes.
• Group lockout boxes, where the isolation keys are locked in a box and each permit holder applies a personal lock to the box. The isolations cannot be removed until every holder has removed their lock. HSE-210 describes group lockout in detail.
• Electronic permit systems that will not allow an isolation to be marked as removed while any linked permit is still live.

Verification

An isolation that has not been verified is only a hope. Verification methods depend on the energy involved: opening bleeds and drains to confirm no flow, reading pressure gauges, testing for gas, attempting to start motors from local and remote controls, testing circuits for voltage, and checking that stored energy has been released. Verification should be recorded on the isolation certificate, and the issuer and holder should see the evidence during the joint site visit. Many sites require the permit holder or a member of the work party to witness or repeat the verification, so that the people at risk see for themselves that the plant is safe.

Long-term and deferred isolations

Sometimes equipment stays isolated for weeks or months, for example while waiting for spare parts or a design change. Long-term isolations are especially risky because the people who applied them move on, the paperwork is forgotten and someone may assume the equipment is available. Sites manage them with a separate long-term isolation register, regular inspection of the locks and tags, and a requirement to review the isolation at set intervals. The permit for the original work is usually closed, with the equipment left under a long-term isolation certificate, and a new permit is issued when work resumes.

Removing isolations

Removal is as dangerous as application. Before any isolation is removed, the isolating authority confirms that every dependent permit has been closed, that all people have left the equipment, that all personal locks have been removed from the group box, that temporary blinds and spades are accounted for, and that the system is ready for reinstatement. Isolations are removed in the planned sequence, often reversing the order of application, with vents and drains closed before blocks are opened. Leak testing may be needed before the equipment returns to full service.

In the US, the isolation requirements behind the permit come from OSHA 1910.147 and, for electrical work, 1910.333, with ANSI/ASSP Z244.1 guiding alternative methods; 1910.147 does not require a permit as such, but most sites link their energy control procedures to their permit system.

Isolation errors and how to prevent them

The most common isolation errors are surprisingly simple: the wrong valve or breaker is isolated because tags are missing, duplicated or hard to read; an isolation point is missed because the drawing is out of date; a valve is closed but leaks through; or stored energy is not released. Prevention starts with good plant labeling, current drawings and a walk-down of the isolation plan at the equipment before isolation begins. Many sites require a second competent person to check the isolation independently, especially for complex or high-hazard work, and they record that check on the certificate. When an isolation does fail, for example when a bleed shows continuing flow, work must not start; the issuer and isolating authority must find out why and fix it before the permit is issued.

Isolations that cross boundaries

Some isolations depend on equipment controlled by someone else. A process line may need isolating at a tie-in owned by a neighboring unit, an electrical supply may come from a utility or another department's substation, or a cooling water system may be shared across the site. In these cases the isolation plan must identify the owner of each point, and the owner must apply or agree to the isolation and record it. The permit system should not allow one area to isolate equipment in another area without that area's authority, because the other area may be relying on the equipment staying in service. Cross-boundary isolations are a frequent subject of coordination meetings for exactly this reason.

Temporary blinds, spades and spectacle plates need their own control. Each should be numbered, recorded on a blind register with its location and the permit it relates to, and physically tagged in place. At close-out, every blind on the register must be removed or deliberately left in place under a new record. A forgotten blind can stop flow to a safety system or cause overpressure when equipment restarts, so blind registers are checked at every handback and before every startup.