Handover, suspension, revalidation and closing permits

A permit is safest at the moment it is issued, when the issuer and receiver have just walked the job together. Every hour after that, conditions can change, people go home and new people arrive. HSE-221 covered handover, suspension, revalidation and close-out in general, including structured handover tools and the story of a forgotten blind. This lesson looks at how these steps work on oil and gas sites, where crews work long rotations at remote sites, emergencies can suspend every permit on a pad in seconds, wells and equipment change hands between contractors and operations, and returning equipment to hydrocarbon service is itself a hazardous operation.

Shifts, rotations and unstaffed nights

Oil and gas crews often work 12-hour shifts on rotations such as two weeks on and one week off, living in camps or driving long distances. Drilling and completions run day and night, while many production sites are staffed only by day and monitored remotely at night. This creates three kinds of handover that permit systems must handle:

• shift-to-shift handover within a 24-hour operation, such as night tour to day tour on a rig or between plant shift supervisors;
• rotation handover, when a whole crew, including issuers and supervisors, leaves for a week and is replaced by people who were not there when the job started;
• overnight suspension at a day-staffed site, when work stops at the end of the day, the site is left unstaffed with isolations in place, and work resumes next morning.

Rotation handovers are especially risky because the incoming crew may not know the history of a long job: why a temporary isolation was set the way it was, which valve was found passing, or which contractor still has a lock on the box. Good practice is a written handover for every open permit and isolation, a face-to-face handover where possible and a walk-around of the jobs, not just a conversation in the office.

What a handover must cover

Whatever the type of handover, the incoming issuer or supervisor needs the same core information for each open permit: the scope and status of the work, the isolations in place and any that are temporary or deviate from the standard, active overrides and their compensating measures, the last gas test and when the next is due, any SIMOPS restrictions, anything abnormal about the plant, and what the crew plans to do next. The program below checks a set of handover records against a list of required items and reports gaps.

# Check permit handover records for missing items (invented records).
REQUIRED = ["status", "isolations", "overrides", "last gas test", "next gas test due",
            "simops limits", "abnormal conditions", "next step"]
handovers = {
    "PTW-3317 scrubber line opening": {
        "status": "blinds in, internals inspection 60 percent done",
        "isolations": "IC-118, group box 4, seven points",
        "overrides": "LSHH-210 inhibited, operator watching local gauge",
        "last gas test": "17:40 clear",
        "next gas test due": "before restart 07:00",
        "simops limits": "no lifts over scrubber",
        "abnormal conditions": "V3 passes slightly; bleed left open",
        "next step": "finish inspection, then box up",
    },
    "PTW-3322 cooler support weld": {
        "status": "welding complete, fire watch finished 18:30",
        "isolations": "none",
        "last gas test": "16:10 clear",
        "next step": "paint tomorrow under cold work",
    },
    "PTW-3325 fuel gas filter change": {
        "status": "filter out, new element not yet fitted",
        "isolations": "IC-121, two valves locked",
        "overrides": "none",
        "next step": "fit element, leak test",
    },
}
for permit, rec in handovers.items():
    missing = [item for item in REQUIRED if item not in rec]
    flag = "complete" if not missing else "missing: " + ", ".join(missing)
    print(f"{permit:<36} {flag}")

PTW-3317 scrubber line opening       complete
PTW-3322 cooler support weld         missing: overrides, next gas test due, simops limits, abnormal conditions
PTW-3325 fuel gas filter change      missing: last gas test, next gas test due, simops limits, abnormal conditions

The scrubber permit is fully handed over, and it records something the incoming shift must know: valve V3 is passing slightly and its bleed has been left open. The weld permit is missing items about overrides, the next gas test, SIMOPS limits and abnormal conditions; some may genuinely be none, but the handover should say so rather than leave a blank. The filter change permit is the most worrying: equipment is open with the filter element out, and the handover says nothing about gas tests, SIMOPS limits or plant conditions. An incoming issuer reading these records would know which jobs to visit first.

Suspension

A permit is suspended when work stops but the job is not finished: at the end of a shift, during a break, when conditions change, or in an emergency. Suspension means the crew leaves the worksite, the equipment is left in a safe state, and nobody restarts the work until the permit is revalidated. On oil and gas sites, common reasons to suspend include:

• any gas alarm, H2S alarm, fire alarm or emergency shutdown in the area or on the site;
• a process upset, start-up or shutdown that could affect the work;
• weather: lightning within a set distance, high winds for lifts and work at height, extreme cold;
• a well control event, frac stop or other emergency on the pad;
• a change in the work scope or the discovery of something unexpected, such as a valve that will not hold;
• loss of the safety watch, fire watch or communication.

When an emergency alarm sounds, every permit in the affected area is suspended at once. Crews make their work safe if they can do so in seconds, such as shutting off a torch or closing a valve they opened, and go to the muster point. After the emergency, no permit is simply resumed. Each one is revalidated: the issuer checks that the equipment and isolations are as they were left, a new gas test is taken, and the crew is briefed again. Emergencies often change conditions, for example a release can leave gas in low areas or an emergency shutdown can move valves that were part of the plant around the job.

Revalidation

Revalidation renews a suspended permit or extends it into a new shift. It is not a signature in the office. The issuer, or the incoming issuer after a handover, visits the job, checks the isolations against the certificate, witnesses or reviews a fresh gas test, confirms that SIMOPS conditions have not changed, and briefs the crew, who may be different people from the day before. Many companies limit how many times a permit can be revalidated before it must be canceled and reissued from scratch, and require a full reissue after any emergency or significant change.

Tracking permit states

Electronic permit systems and many paper registers track each permit through a set of states and only allow certain moves between them. The program below models a simple version of that logic: a permit can be issued, suspended, revalidated and closed, and the program refuses moves that break the rules, such as revalidating without a gas test or closing while isolations or overrides remain.

# A simple permit register that enforces allowed state changes (teaching model).
ALLOWED = {
    "requested": {"issued"},
    "issued": {"suspended", "closed"},
    "suspended": {"issued", "cancelled"},      # back to issued only by revalidation
}

class Permit:
    def __init__(self, number):
        self.number, self.state, self.revalidations = number, "requested", 0
        self.isolations_on, self.overrides_on = True, True

    def move(self, new, gas_test_ok=False):
        if new not in ALLOWED.get(self.state, set()):
            return f"refused: {self.state} -> {new} not allowed"
        if new == "issued" and not gas_test_ok:
            return "refused: no valid gas test"
        if new == "issued" and self.state == "suspended":
            if self.revalidations >= 3:
                return "refused: revalidation limit reached, cancel and reissue"
            self.revalidations += 1
        if new == "closed" and (self.isolations_on or self.overrides_on):
            return "refused: isolations or overrides still in place"
        self.state = new
        return f"ok: now {new}"

p = Permit("PTW-3317")
steps = [("issued", True), ("suspended", False), ("issued", False), ("issued", True),
         ("closed", False)]
for new, gas in steps:
    print(f"{p.number} {p.state:>10} -> {new:<9} {p.move(new, gas)}")
p.isolations_on = p.overrides_on = False           # handed back, isolations removed
print(f"{p.number} {p.state:>10} -> closed    {p.move('closed')}")

PTW-3317  requested -> issued    ok: now issued
PTW-3317     issued -> suspended ok: now suspended
PTW-3317  suspended -> issued    refused: no valid gas test
PTW-3317  suspended -> issued    ok: now issued
PTW-3317     issued -> closed    refused: isolations or overrides still in place
PTW-3317     issued -> closed    ok: now closed

The register refuses to revalidate the suspended permit until a valid gas test is recorded, and refuses to close it while isolations and the level switch override are still in place. Once the job is handed back and the isolations and override are removed, the permit can close. A paper system can enforce the same rules only through the discipline of the people using it, which is why audits check exactly these transitions.

Handover between contractors and operations

On wells and new facilities, a major handover happens when a drilling or completions contractor finishes and the well or equipment passes to production operations. The well handover should include the well's status, the barriers in place and their test records, wellhead and valve positions and pressures, any open issues, and the documents the production operator needs. New facilities pass from construction to commissioning to operations with similar handover packages. Many companies use a formal handover certificate signed by both parties, and until it is signed the receiving party does not treat the equipment as its own. Ambiguity about who controls a well or a piece of equipment during these transitions has contributed to serious incidents, so the bridging document and the SIMOPS plan should say exactly when control changes.

Handing back and de-isolation

When the work is finished, the receiver hands the job back to the issuer, confirming that the crew has left, tools and materials have been removed, guards and covers are refitted, and the equipment is ready for de-isolation. De-isolation is the reverse of isolation but needs as much care, because it reintroduces energy and hydrocarbons into equipment that has just been worked on. A typical sequence on an oil and gas site is:

• confirm every permit and personal lock linked to the isolation certificate is closed or removed;
• remove blinds in the planned order, checking each against the blind list, and fit the correct gaskets;
• close vents and drains that were opened for the job, and return small-bore valves to their normal positions;
• purge air out of the equipment with nitrogen until the oxygen content is low enough that hydrocarbons can be introduced without forming a flammable mixture inside;
• leak test the joints that were broken, first with nitrogen at a moderate pressure using leak detection fluid or a gas detector, then at operating pressure as hydrocarbons are introduced;
• remove overrides, test the safety devices back into service, and clear the control room inhibits;
• return the equipment to service under the operating procedure, with a pre-startup safety review for new or modified equipment, as HSE-311 describes.

Closing the permit

A permit is closed only when the work is complete, the equipment has been handed back and de-isolated or left in a recorded safe state, every linked certificate is closed, and the control room has been told. If the equipment will stay isolated, for example waiting for parts, the isolation is transferred to a long-term isolation record before the work permit closes, so that the isolation does not become an orphan with no permit behind it. Closed permits, isolation certificates, gas test records and override certificates should be kept for the period the company standard sets, both as legal records and as material for audits and learning, as Lesson 12 describes.