How a permit to work system keeps hazardous jobs under control

The UK Health and Safety Executive describes a permit-to-work system as a formal recorded process used to control work identified as potentially hazardous, and as a means of communication between site management, plant supervisors and operators, and the people who carry out the work. The permit itself is the paper or electronic form. The system is everything around it: who may authorize jobs, the training, the checks, the display, the handover and the audit.

HSE is just as clear about what a permit is not. It is not simply permission to do a dangerous job, and the issue of a permit does not by itself make a job safe. That only happens when the people preparing, supervising and doing the work think through the hazards and put the precautions in place. A permit that is signed at a desk, for a site nobody has visited, is a record of a decision that was never really made.

In practice, a good permit answers five questions for everyone who reads it: what exactly is being worked on, what could hurt someone, what has been done about it, who is responsible right now, and how long the permission lasts.

Permits are meant for non-routine work where the normal operating controls are not enough. HSE lists maintenance, repair, inspection, testing, cleaning and modification work, non-routine operations, jobs where two or more groups must coordinate, and jobs where responsibility passes from one group to another. It also warns against the opposite mistake: applying permits to every activity weakens them. Routine tasks in non-hazardous areas are better covered by a written procedure.

Typical jobs that call for a permit or a supporting certificate include:

• Work that uses or generates heat or sparks, such as welding, flame cutting and grinding.
• Breaking containment of a flammable, toxic or pressurized system.
• Work on high voltage equipment, or any electrical work that could give rise to danger.
• Entry into tanks, vessels, pits and other confined spaces.
• Work at height, excavation, pressure testing, and work that affects escape or rescue systems.
• Any job that needs extra precautions or special personal protective equipment.

For confined spaces, OSHA's rule in 29 CFR 1910.146 sets the order: test first for oxygen, then for combustible gases and vapors, then for toxic gases and vapors. Keep to that order, and treat a low oxygen reading as a reason to stop on its own, whatever the other readings say.

The same rule requires the entry permit to record the results of initial and periodic tests, with the names or initials of the testers and when the tests were done. That is a good standard for any permit that depends on gas readings, not only confined space entry.

• Test where the hazard will be, not only at the manway. Heavier and lighter gases settle at different levels.
• Test again after a break, after a change in the work, and at intervals the permit sets. HSE notes that fumes can come off residues and oxygen can be used up after a space was first declared clear.
• Record the instrument used and confirm it has been checked and calibrated according to your procedure.
• Write the actual reading against the acceptance limit. A tick in a box tells an investigator nothing.

A permit says what precautions are needed. Isolation is how many of them are delivered. HSE's companion guidance, HSG253 on the safe isolation of plant and equipment, covers how to isolate and how to reduce the risk of releasing hazardous substances during maintenance. In most plants the practical form of isolation is a lockout tagout procedure.

The two records must point at each other. The permit should list or reference every isolation the job depends on, and the isolation certificate should name every permit relying on it. When one isolation protects two jobs, it must not be removed when the first job hands back. HSE records that at the time of the Piper Alpha disaster there was no cross-referencing when work under one permit affected work under another, and reliance was placed on memory.

OSHA's lockout tagout rule adds two points that apply directly to permit work. When a group works under one isolation, each authorized person attaches their own personal lock to the group lockout device or lockbox. And there must be specific procedures at shift or personnel changes so that lockout protection continues without a gap.

HSG250 includes case studies from real incidents. The same failure patterns come up again and again, and almost none of them are about the form itself.

• No permit for the actual job. At one site, permits were issued for removing a lid and for blanking an inlet, but not for raking out residue from the vessel, which was the job that killed five people.
• Wrong or missing isolations. A permit listed mechanical and electrical isolations but not the process isolation, because the issuer did not know it was needed. Flammable material was released.
• Permits not displayed. Operators could not see which equipment was under maintenance because permits were kept in pockets or filed in another office.
• Broken handover. At Piper Alpha, a shift handover failed to pass on that a pressure safety valve had been removed for overhaul.
• No sign-off per person. One fitter handed back a permit while a second was still working on an open steam line. The second fitter was scalded.
• A system that fell into disuse. A vessel entered twice a week had a permit system on paper that nobody was using any more.
• Too many permits per issuer. During shutdowns one person can end up controlling more permits than they can physically check. HSE advises limiting live permits or adding supervision.
• Copy and paste. With electronic permits, issuers may reuse sections from old permits instead of assessing the job in front of them.

HSG250 was written mainly around paper permits but covers electronic ones too. It does not prefer either. It sets conditions an electronic system should meet before you rely on it, and they make a useful checklist when you evaluate permit to work software:

• Electronic signatures that prevent unauthorized issue or acceptance.
• No remote issue without a site visit.
• Changes to an issued permit cannot be made without everyone concerned being told.
• Paper copies can be produced for display at the job.
• Training so that issuers assess each job and do not copy sections from other permits.
• A backup arrangement for a software failure or power outage.

HSE recommends three levels of checking. Issuers check their own permits at the work site. Site managers and supervisors run regular monitoring checks against the permit's conditions. And the system as a whole is audited by competent people, preferably from outside the site, with a review at least every three years that considers audit findings and lessons from incidents elsewhere.

Simple questions reveal a lot during monitoring: Is the permit displayed? Do the isolations on the ground match the certificate? Are gas readings recent and written as numbers? Does the crew know who the performing authority is? How many suspended permits are open, and for how long? Any non-conformance should be recorded and tracked until it is closed.

MaintenanceIQ includes a work permits register in its licensed EHS module, which is switched on per site. Permits carry gas tests, a named crew and a gated handback. The LOTO register records isolations with personal locks under a 'no lock, no release' rule. Evidence such as photos and certificates can be attached to any record, and every change is written to an audit log.

It does not replace your permit procedure, your competent issuers or the site visit. It keeps the record in one place where your EHS head and your maintenance planner can both see it. More on the module: EHS software.