Permits to work and high-hazard tasks

Harrowgate Foods Inc. had a hot work permit pad before last August. It sat in the maintenance office, and plant mechanics used it for their own welding jobs. Contractors were expected to ask for a permit, but nobody checked whether they did. Coastal's welder did not know the pad existed. The plant also had a lockout procedure, a confined space procedure and a roof access procedure, each written separately, each with its own form and none of them connected to the others. When Northline opened the ammonia valve, there was no document anywhere that showed both Northline's isolation and the plant's isolation on the same line.

A permit-to-work system is the host's main tool for controlling high-hazard, non-routine work. It makes sure that before such work starts, the hazards have been identified, the controls are in place, the people involved know about them and someone with authority over the area has agreed that the work can go ahead. HSE-221 covers permit-to-work systems in general. This lesson covers how they apply to contractors, and how Harrowgate Foods Inc. rebuilt its permits so that contractor work and plant operations are controlled together.

Why permits matter most for contractors

Permits matter for any high-hazard work, but they matter most for contractors, for the same reasons contractor work is riskier: contractors do not know the site, the site does not know them, and two sets of hazards meet. A permit is the point where the host's knowledge and the contractor's knowledge are brought together for a specific task, in a specific place, at a specific time. The area owner knows what is in the area, what is running, what has been isolated and who else is working nearby. The contractor's supervisor knows the work method, the tools and the crew. The permit makes them talk to each other, at the job, before the work starts.

The permits used at the plant

Elena Novak and Luis Ortega replaced the separate procedures with a single permit system, with one general permit form and a set of attached certificates for specific hazards. The general permit describes the work, the location, the time, the crew and the hazards, and lists which certificates are attached. The certificates are:

• Hot work certificate for welding, cutting, grinding, brazing, soldering and any other work producing sparks, flame or heat outside a designated hot work area.
• Isolation certificate for any work requiring isolation of energy or process fluids, listing every isolation point, who applied it and how zero energy was verified.
• Confined space entry certificate for any entry into a confined space, with atmospheric test results, ventilation, attendant and rescue arrangements.
• Line break certificate for opening any line or vessel containing ammonia, steam, chemicals or other hazardous fluids.
• Work at height certificate for roof access and work at height where fall protection is required.
• Fire protection impairment certificate for any work that disables sprinklers, alarms, detection or ammonia detection, with the compensating measures.

Not every job needs a permit. Routine maintenance done by trained workers under a written procedure, such as changing a filter under standard lockout, may not. The permit system is for high-hazard and non-routine work, and every high-risk contractor job from Lesson 4 needs at least a general permit.

Roles in the permit system

Permits work only when each person in the process knows what they are responsible for. Harrowgate Foods Inc.'s system has three roles:

• Permit issuer. A host employee authorized and trained to issue permits for an area, usually the area owner or a designated senior operator or maintenance person. The issuer confirms the area is ready: equipment isolated, lines drained, the area cleared of combustibles, other work coordinated. The issuer signs the permit and keeps a copy.
• Permit receiver. The contractor's supervisor or lead hand responsible for the crew doing the work. The receiver confirms the crew understands the permit's hazards and controls, that the controls the crew is responsible for are in place, and that the crew will stop and call the issuer if conditions change.
• Crew members. Each worker signs the permit to show they have been briefed, applies their own personal lock where the isolation certificate requires it, and follows the permit's controls.

A key rule is that the issuer must be from the host, not the contractor. The host controls the area and its hazards, and only the host can confirm that plant equipment is isolated and that other work nearby has been coordinated. A contractor's own internal permit, such as Northline's line break checklist, can be attached to the host's permit but cannot replace it.

Issuing permits at the job

Permits issued at a desk are among the most common causes of permit failure. An issuer who signs a permit in the maintenance office cannot see the flour dust on the ceiling panel, the sanitation crew below or the open drain next to the work. Harrowgate Foods Inc.'s rule is that the issuer and the receiver walk the job together before the permit is signed, every time. For the shutdown, this meant scheduling enough trained issuers for the morning peak, as Lesson 4 described. On the first day there were nine issuers, each with a defined set of areas, and permits were issued in a planned order so that the jobs with the longest set-up times went first.

Permits are valid for one shift. At the end of the shift, the receiver hands the permit back to the issuer, who checks the area and either closes the permit or records that the work will continue. A permit carried over to the next shift is reissued by the next issuer after a new walk-down, because conditions overnight may have changed. Permits are displayed at the job, in a clear holder, so that anyone, including an auditor or a worker from another crew, can see what work is authorized and what controls apply.

Hot work

Hot work is the clearest example of why permits matter at a food plant. Flour dust, cardboard, plastic packaging, insulation panels and cooking oils are all present, and many of them are hidden above ceilings or inside equipment. OSHA's welding and cutting standard, 29 CFR 1910.252, and NFPA 51B set out the precautions for fire prevention, and OSHA's standard requires a fire watch for at least half an hour after hot work is completed. The current edition of NFPA 51B goes further, calling for a fire watch of at least an hour after hot work ends, followed by further monitoring. HSE-216 covers hot work in detail. The hot work certificate at the plant requires, at a minimum:

• Combustible materials within 35 ft (11 m) of the work are removed, or protected with fire-resistant covers or shields, including materials above and below the work and on the far side of walls.
• Openings in floors and walls within that distance are covered so sparks cannot pass through.
• The area is checked for flammable gases or vapors with a calibrated gas detector before work starts and at intervals during the work.
• Sprinklers and fire detection remain in service unless a fire protection impairment certificate has been issued, with compensating measures.
• A trained fire watch with a suitable extinguisher is present during the work and for at least 60 minutes after it ends, and does no other task during that time.
• The area is checked again at intervals for a further three hours after the fire watch ends.
• The fire watch and the issuer both sign the certificate when the watch ends.

The fire watch rules address exactly what went wrong last August, when Coastal's apprentice left eleven minutes after the cutting stopped. The new certificate records the time the hot work ended, the time the fire watch ended and the times of the later checks, so that an auditor can see at a glance whether the rules were followed.

# Check fire watch timing on the day's hot work certificates
from datetime import datetime, timedelta
FMT = "%H:%M"
certs = [
    # id, hot work ended, fire watch ended, later checks
    ("HW-0412", "10:15", "11:20", ["12:20", "13:20", "14:20"]),
    ("HW-0413", "11:40", "12:10", ["13:10"]),
    ("HW-0414", "13:05", "14:05", ["15:05", "16:30"]),
]
for cid, hw_end, fw_end, checks in certs:
    end = datetime.strptime(hw_end, FMT)
    watch = (datetime.strptime(fw_end, FMT) - end).total_seconds() / 60
    last = max(datetime.strptime(c, FMT) for c in checks)
    span = (last - end).total_seconds() / 3600
    problems = []
    if watch < 60: problems.append(f"fire watch only {watch:.0f} min")
    if span < 4: problems.append(f"checks end {span:.1f} h after hot work")
    print(cid, "OK" if not problems else "; ".join(problems))

HW-0412 OK
HW-0413 fire watch only 30 min; checks end 1.5 h after hot work
HW-0414 checks end 3.4 h after hot work

Elena's team runs this check on every day's hot work certificates during the shutdown. Two of the three certificates in the example would have been caught on the same day, and the issuers and contractor supervisors involved spoken to before the next shift.

Isolation and contractor locks

Lockout is the other area where contractors and hosts most often fail to connect. Each employer usually has its own lockout procedure, its own locks and its own way of verifying zero energy. When both work on the same equipment, as in the engine room near miss, each can believe the equipment is safe while the other's work puts someone at risk. HSE-210 covers lockout in detail.

OSHA's lockout standard, 29 CFR 1910.147, requires the host and any outside employer to tell each other about their lockout procedures, and requires the host to make sure its own workers understand and follow the outside employer's program, which in practice means working from one isolation plan.

Harrowgate Foods Inc.'s isolation certificate solves the problem with a single isolation plan for each job, written by the plant and reviewed with the contractor. The plant applies the isolations on plant equipment and verifies them with the contractor's lead. All isolation keys go into a group lockbox. Every worker who will work on the equipment, plant or contractor, puts their own personal lock on the lockbox. Nobody can remove the isolations until every personal lock has been removed by its owner. The engine room now has a shared lockout board, Northline's suggestion from Lesson 1, where the lockbox and the current isolation certificate are displayed together.

Confined spaces

Confined space entry by contractors is one of the highest-risk activities on any site, and multiple deaths are common when an untrained person attempts a rescue. OSHA's permit-required confined spaces standard, 29 CFR 1910.146 requires the host to inform the contractor about the space and coordinate entry, as Lesson 2 described, and requires the entry employer to have a permit system, testing, an attendant and rescue services. HSE-211 covers confined spaces in detail.

For the duct cleaning job, the plant's confined space entry certificate is attached to the general permit, and the contractor's own entry permit, written to its own program, is attached to the certificate. The plant isolates the exhaust fans and confirms the isolation. The contractor tests the atmosphere, posts the attendant and keeps the rescue team on standby. The plant's issuer checks each morning that all of this is in place before signing.

Managing permit conflicts

When many permits are open in the same area at the same time, the permits can conflict. A hot work permit in the bakery hall and a line break permit on a nearby oil line, or a crane lift over a roof where roofers are working, may each be safe on their own and dangerous together. Harrowgate Foods Inc. keeps a permit board in the shutdown control room that shows every open permit on a plan of the plant. Before signing a new permit, the issuer checks the board for conflicts in the same area, above or below. Lesson 12 shows a simple tool for checking conflicts in the shutdown plan before the work begins.