The permit team on oil and gas sites

A permit system is only as good as the people who run it. HSE-221 described the standard roles in any permit system: the person who asks for the work, the person who issues the permit, the person who receives it and does the work, the people who isolate and test, and the people who watch. This lesson looks at how those roles are filled on oil and gas sites, where the issuer may be a lease operator responsible for twenty wells, the receiver may work for a contractor that arrived this morning, the control room may be a hundred kilometers away, and a drilling rig and a producing battery may share the same pad.

The roles on an oil and gas site

Names vary from company to company, but most oil and gas permit systems use the roles in the table below. One person can hold more than one role on a small job, but some combinations should never be allowed, such as the person who will do the work also verifying their own isolation on a high-hazard job.

Remote and unstaffed sites

The biggest difference between oil and gas permits and plant permits is distance. A battery or well pad may be unstaffed most of the day, with a lease operator visiting on a route that covers many sites. The permit issuer is therefore often not present while work is done. Companies use several approaches, and the choice should depend on the hazard of the work.

• Issue in person, stay for the critical step. The issuer meets the crew, walks the isolations, witnesses the gas test and stays for the first break or the start of hot work, then leaves with agreed check-in times.
• Issue in person, check back. For lower-hazard work, the issuer issues on site and returns at agreed times or at shift end to inspect and close.
• Remote authorization. For low-hazard routine work only, the issuer authorizes by phone or radio after the receiver reports conditions, sometimes backed by photographs or readings sent from the site. This saves driving but removes the joint site visit, so many companies forbid it for line opening, hot work in classified areas, confined space entry and sour service.
• Dedicated permit coordinator. On large jobs such as a battery rebuild or a pad turnaround, the operator assigns a permit coordinator who stays on site and issues all permits for the job.

Whatever approach is used, the permit must say who can be contacted, how the crew will report that conditions have changed, and what the crew does if contact is lost. Many companies link permit work at unstaffed sites to their working-alone and journey-management systems, covered in HSE-330, so that a missed check-in triggers a call.

Can one issuer cover the work?

Issuer workload is a real safety issue on routes. A lease operator who must issue permits at four sites in a morning, while also doing production checks and responding to alarms, may be tempted to shorten the site visit, skip a gas test witness or authorize by phone. The program below checks whether a lease operator's planned day leaves enough time for the permit tasks at each site, using invented drive and task times.

# Can one lease operator issue and verify today's permits on the route? (invented times)
route = [  # site, drive minutes from previous stop, permit tasks (name, minutes)
    ("Pinecrest battery", 35, [("issue line-break permit, walk isolations", 40),
                               ("witness first break", 25)]),
    ("Well 4-17", 20, [("issue cold work permit", 15)]),
    ("Water disposal", 25, [("issue hot work permit, witness gas test", 35)]),
    ("Kettle Creek", 30, [("issue entry permit, witness entry test", 45)]),
]
routine_min = 150        # production checks and paperwork that must still be done
shift_min = 12 * 60
t = 0
for site, drive, tasks in route:
    t += drive
    for name, m in tasks:
        t += m
        print(f"{t // 60:>2}h{t % 60:02d}  {site:<17} {name}")
total = t + routine_min + sum(d for _, d, _ in route[:1])   # include drive home
print(f"Permit work and driving: {t} min; with routine work and drive home: {total} min")
print("Fits in a 12-hour shift" if total <= shift_min else "Does not fit; split the work or add an issuer")
spare = shift_min - total
print(f"Spare time for alarms and delays: {spare} min")

 1h15  Pinecrest battery issue line-break permit, walk isolations
 1h40  Pinecrest battery witness first break
 2h15  Well 4-17         issue cold work permit
 3h15  Water disposal    issue hot work permit, witness gas test
 4h30  Kettle Creek      issue entry permit, witness entry test
Permit work and driving: 270 min; with routine work and drive home: 455 min
Fits in a 12-hour shift
Spare time for alarms and delays: 265 min

On paper the day fits with about four and a half hours to spare, but that spare time is what absorbs alarms, flat tires, late contractors and permits that need revalidation. If a well goes down or the hot work crew finds a problem, the operator may suddenly be needed in two places at once. Planning issuer workload before the work starts, and adding a second issuer or a permit coordinator when several high-hazard jobs coincide, is part of the permit system, not an afterthought.

Competence and authorization

Every role in the permit system should be filled by someone who has been trained, assessed and authorized by name for that role at that kind of site. Authorization is usually recorded in a register that lists each person's roles, the sites or units where they may act, the permit types they may issue and the date of their last assessment. On oil and gas sites, typical requirements include:

• Issuers: experience operating the specific facility, permit system training, isolation training, gas testing competence and a formal assessment by a senior operator or permit system owner.
• Isolating authorities: training on the site's isolation standard and drawings, and for electrical isolation, the appropriate electrical qualification; on pipelines, operator qualification for covered tasks under PHMSA rules.
• Gas testers: training on the detectors used, bump testing and calibration, sampling technique and interpretation of results, usually with H2S training to ANSI/ASSP Z390.1 or an equivalent program for sour sites.
• Receivers: knowledge of the permit system and the hazards of the work, usually confirmed through the operator's orientation, SafeLandUSA or equivalent, and the contractor's own training records.
• Safety watches: confined space, hot work or H2S training as relevant, rescue and alarm procedures, and the authority to stop the work.

Contractors often bring their own permit systems. The operator must decide whose system governs each activity and record the decision in a bridging document, as HSE-331 described for drilling and completions. A common arrangement is that the operator's permit system governs all work on producing equipment, while the drilling or service contractor's system governs work on its own rig equipment, with the operator's wellsite supervisor coordinating the two.

Signatures mean accountability

A signature on a permit is a statement that the signer has personally checked something. The issuer's signature says the hazards have been assessed, the isolations are in place and verified, the gas test is acceptable and the worksite has been visited. The receiver's signature says the crew understands the hazards and controls and will stay within the scope. The isolating authority's signature says each listed point is in the stated position and locked. When signatures become a formality, such as signing in the truck without looking, the permit system quietly stops working. Good practice is to ask each signer what they checked, and auditors do exactly that.

The control room's part

Many oil and gas facilities are monitored and partly operated from a control room that may be on site or in a regional center far away. Control room operators can start pumps, open shutdown valves, change setpoints and reset trips remotely. If they do not know that a vessel is open or a crew is working beside a compressor, a routine remote action can put workers in danger. Permit systems therefore notify the control room of every permit that affects equipment it can operate, and the control room marks that equipment on its screens, often with a software inhibit, so that it cannot be operated by mistake. Removing those marks is part of closing the permit.

Independence and challenge

The permit system relies on people checking each other. An issuer under pressure from a contractor who is paid by the day, or a receiver who does not want to look slow in front of the operator, may let a doubtful condition pass. Companies build in challenge by giving every role clear authority to stop work, by rotating issuers on long jobs, by having a second person verify isolations on high-hazard work, and by rewarding people who stop jobs for good reasons. HSE-221 discusses this in general; on oil and gas sites, the mix of employers makes it even more important that a contractor's worker can challenge the operator's issuer, and the other way round, without fear.