Permit-to-work systems

Some work in a plant is too dangerous to start on the word of one person. Entering a tank, cutting into a pipe that once held chemicals, welding near a dust collector, digging near buried cables or working on a high-voltage panel all need careful planning, checks by more than one person and clear agreement about who controls the equipment. A permit-to-work system provides that structure. It is a formal written process that authorizes specific work, in a specific place, for a specific time, under specific precautions.

What a permit is, and what it is not

A permit is not just a form. It is the visible part of a process that brings together the people who know the plant (operations), the people doing the work (maintenance or contractors) and the people who know the hazards (safety, engineering, specialists). The permit records what has been agreed: the hazards, the isolations, the tests, the PPE, the emergency arrangements and the limits of the work. When the permit is signed off by everyone involved, work can start. When conditions change or the work ends, the permit is closed or suspended.

A permit is not a substitute for competence, supervision or judgment. Investigations of major accidents, including the 1988 Piper Alpha disaster in the North Sea, in which a pump was started while its relief valve was off for maintenance under a separate permit, show that permit systems fail when they become paperwork exercises: forms filled in without looking at the job, handovers between shifts that lose information, and several permits for the same equipment that nobody cross-checks. Piper Alpha killed 167 people and led directly to modern permit-to-work practice in many industries.

Types of permits

Plants usually have a general permit for higher-risk maintenance plus special permits or certificates for particular hazards. Some combine them on one form with sections that are completed as needed. The table shows common types; your plant's names may differ.

The permit life cycle

Most permit systems follow the same sequence. The details vary, but each step exists to catch a particular kind of failure.

Roles in a permit system

Clear roles are the backbone of a permit system. The permit issuer, often a trained operations supervisor, owns the plant equipment and is responsible for preparing it safely and authorizing the work. The permit performer or receiver, often a maintenance supervisor or contractor lead, accepts the permit, briefs the crew and makes sure the work stays within its limits. Specialists, such as gas testers or electrical authorities, sign for their part. An area authority may approve all permits in a unit so that someone sees the whole picture. Only people trained and authorized by the plant can issue permits, and many plants keep a register of authorized issuers.

Simultaneous operations

In a busy plant, several jobs often happen near each other at the same time. One crew may be welding on a platform while another opens a line below, a third is in a tank nearby and production continues in the next bay. Each job may be safe on its own, but together they can create new hazards: sparks falling onto an opened line, vapors from the line drifting to the welding, or an isolation for one job being removed by another crew. Managing simultaneous operations (SIMOPS) means checking permits against each other, not just one at a time. Many plants use a permit board or a digital system that shows all active permits on a plant map, and an area authority who reviews conflicts before issuing new permits.

# SIMOPS conflict check: flag active permits that should not run together (illustrative rules).
permits = [
    {"id": "HW-112", "type": "hot work",       "area": "Bay 3", "level": "platform"},
    {"id": "LB-047", "type": "line break",     "area": "Bay 3", "level": "floor"},
    {"id": "CS-020", "type": "confined space", "area": "Bay 4", "level": "floor"},
    {"id": "HW-113", "type": "hot work",       "area": "Bay 4", "level": "floor"},
    {"id": "EL-008", "type": "electrical",     "area": "Bay 1", "level": "floor"},
]
conflicts = {frozenset(["hot work", "line break"]): "sparks could ignite released gas",
             frozenset(["hot work", "confined space"]): "fumes or sparks may enter the space"}
for i, a in enumerate(permits):
    for b in permits[i + 1:]:
        reason = conflicts.get(frozenset([a["type"], b["type"]]))
        if reason and a["area"] == b["area"]:
            print(f"CONFLICT {a['id']} + {b['id']} in {a['area']}: {reason}")
print("Review each conflict with the area authority before issuing or continuing work.")

CONFLICT HW-112 + LB-047 in Bay 3: sparks could ignite released gas
CONFLICT CS-020 + HW-113 in Bay 4: fumes or sparks may enter the space
Review each conflict with the area authority before issuing or continuing work.

Shift handover and suspension

Many permits last longer than one shift, and handover is one of the most dangerous points in the system. The outgoing issuer must explain to the incoming issuer exactly what work is in progress, what is isolated, what has changed and what is still open. A permit should never be handed over by leaving it on a desk. When work stops for a break, a shift change or an emergency, the permit is suspended: the area is left safe, the crew leaves, and before work restarts the issuer checks that conditions are still as the permit describes. Gas tests usually must be repeated after any suspension.

Closing out

Closing a permit is as important as opening it. The performer confirms that the work is finished, tools and materials are removed, guards are replaced, blinds are removed or recorded, and the crew is clear. The issuer inspects the area, removes isolations in the correct order, and only then returns the equipment to operations. Many incidents happen when equipment is restarted with a temporary blind still in place, a valve left in the wrong position or a person still inside. A walk-down by both parties before sign-off catches most of these.

Auditing permit systems

Because permit systems fail quietly, plants audit them regularly: checking a sample of open and closed permits against what is happening in the field. Auditors look for permits where the hazards section is copied from a template, gas tests are missing or out of date, isolations do not match the equipment, signatures are missing, or work has gone beyond the permit's scope. A good audit visits the job site, not just the permit office. HSE-407 covers audit techniques in depth.

# Permit audit summary: share of sampled permits with each type of defect (illustrative).
sample = 40
defects = {"hazards copied from template": 9, "gas test missing or expired": 4,
           "isolation list incomplete": 6, "missing signature": 3,
           "work beyond permit scope": 2, "no handover record": 5}
for d, n in sorted(defects.items(), key=lambda kv: -kv[1]):
    print(f"{d:<30} {n:>2}/{sample}  {n / sample:5.1%}")
clean = sample - 14     # permits with no defect found (from the field check)
print(f"Permits with no defects: {clean}/{sample} = {clean / sample:.0%}")

hazards copied from template    9/40  22.5%
isolation list incomplete       6/40  15.0%
no handover record              5/40  12.5%
gas test missing or expired     4/40  10.0%
missing signature               3/40   7.5%
work beyond permit scope        2/40   5.0%
Permits with no defects: 26/40 = 65%

OSHA does not have a single permit-to-work standard, but several standards require permits or equivalent written authorization: permit-required confined spaces (1910.146), hot work under the welding standards (1910.252) and NFPA 51B, and process safety management (1910.119), which requires hot work permits and safe work practices for opening process equipment. HSE-333 covers permits in oil and gas.

Digital permit systems

Many plants have moved from paper permits to electronic permit-to-work systems. These can show every active permit on a plant map, flag conflicts automatically, link permits to isolation records, record gas tests with time stamps, and make audits easier. They also bring risks: people can approve permits from an office without visiting the job, and a system outage can leave work in limbo. A good digital system still requires the issuer to walk the job, and keeps a simple paper fallback for outages.