Permit to work — how a plant decides a job is safe to start

A process plant is designed to run sealed. Almost everything on this site — the line classes, the relief devices, the area classification — exists to keep the contents inside and the ignition sources outside while it does.

Then somebody has to open it.

Maintenance, inspection and modification all mean deliberately breaking into a system that was built not to be broken into. The permit to work is how a plant decides that a specific job, at a specific place, at a specific time, is safe to start — and records who decided it.

What a permit is, and what it is not

A permit is not a form, an approval, or a way of sharing the blame. It is the record of a conversation that has to happen anyway, covering:

• What the job is, precisely, and where exactly
• What could go wrong — the hazards of the equipment and of the work itself
• What controls are in place, and who applied them
• Who authorised it, and who accepted it
• How long it is valid for
• How it is given back

The permits you will meet

Filter The permits you will meet, and what each one exists to prevent

9 rows

Permit	What it controls	The failure it exists to prevent
Hot work	Any ignition source — welding, grinding, cutting, naked flame, some tools	An ignition source meeting a flammable atmosphere nobody tested for
Cold work	General maintenance with no ignition source and no entry	Work starting on the wrong equipment, or on equipment still live
Breaking containment	Opening any line or vessel that has held process fluid	Opening a line that was never isolated, drained or depressured
Confined space entry	Entry into any space with restricted access and a possible hazardous atmosphere	Entering an atmosphere that cannot support life — and the rescue attempt that follows
Electrical isolation	Work on or near electrical equipment, with lock-out and tag-out	Working on something believed dead that is back-fed, stored or never isolated
Excavation	Breaking ground anywhere on site	Striking a buried service, or a trench wall collapsing onto somebody
Working at height	Work where a fall is credible, including scaffold handover	A fall, or a dropped object onto people working below
Radiography	Industrial radiography and the exclusion zone around it	Exposing people who had no idea it was happening nearby
Lifting operations	Crane work and heavy lifts, with the lift plan	A load travelling over live plant, or over people

Names vary between operators and some sites combine or split these. What does not vary is the principle — a separate authorisation for each distinct way the work can kill somebody, so that no single permit has to carry every hazard at once.

The pattern is one authorisation per distinct way the work can kill somebody, rather than one permit carrying every hazard at once. A job frequently needs several at the same time — breaking containment on a vessel, then entry, then hot work inside it.

Isolation, and the step that gets skipped

Isolation is where most of the engineering in a permit sits. The methods — single block and bleed, double block and bleed, spades and spectacle blinds, physical disconnection — are covered in valve types, and the electrical equivalent in distribution.

What belongs here is what happens after the isolation is applied.

Two things follow from that:

Lock and tag. The isolation is physically locked in position and tagged with who applied it and why. A lock that only one person holds the key to cannot be removed by somebody who does not know what it protects.

Long duration isolations drift. An isolation left in place for weeks gets operated, worked around or quietly removed for another job. Which is why suspended work returns to the proving step rather than resuming where it stopped.

Confined space entry

This deserves separating out, because it fails in a way the others do not.

A confined space is any space with restricted access where the atmosphere may not support life — a vessel, a tank, a pit, a sewer, sometimes a trench. The atmosphere may be oxygen deficient because something has consumed it or displaced it, enriched, flammable, or toxic. None of those is visible.

Hot work

Hot work introduces an ignition source into a plant whose entire design assumes there is not one. The controls follow directly from that:

• Gas test before starting, and repeat — conditions change, and a test taken an hour ago describes an hour ago.
• Remove or cover combustibles, including drains and openings sparks can fall into.
• A fire watch during the work and for a defined period afterwards, because a smouldering ignition can take time to develop.
• Consider what is nearby and below. Sparks fall, and grating is not a barrier.

How permit systems actually fail

Filter How permit systems fail, and why each failure is reasonable at the time

9 rows

Failure	What it looks like	Why it happens
Issued from the office	The permit is written without anyone going to look at the equipment	The job is understood from a drawing, and the drawing is out of date
Isolation assumed	The valve is shut and nobody opened the bleed to find out whether it holds	Proving takes time, and a closed valve looks exactly like an isolated one
Wrong equipment	Work starts on the adjacent identical item	Two pumps look the same and the tag is faded or on the wrong side
Scope creep	The job that gets done is broader than the job that was assessed	A related task becomes obvious once the equipment is open
Expired or extended	Work continues past the permit's validity, or it is extended without reassessment	The job overruns and stopping now feels like the wasteful option
Poor shift handover	The incoming shift does not know what is open, isolated or part-dismantled	Handover was verbal and the outgoing crew have already left
Simultaneous operations	Two permits are valid at once and interact in a way neither considered	Each job is safe on its own, and nobody was looking at both together
Rushed handback	Tools left inside, a blind not removed, a guard not refitted	It is the end of the shift and operations want the equipment back
Permit as paperwork	Signatures are collected and the controls are not actually applied	The system has quietly become a document exercise rather than a conversation

Not one of these is carelessness. Every row is somebody being efficient, trusting a colleague, or trying not to stop a job near the end of a shift. That is what makes them recur — a system that only works when nobody is under pressure is not a system.

Read the last column. None of these is carelessness. Every one is somebody being efficient, trusting a colleague, or trying not to stop a job twenty minutes before the end of a shift.

That is what makes them recur, and it is why a permit system that only works when nobody is under pressure is not a system at all.

Where this connects

Permits are the operational half of things this site has covered as design:

• The isolation methods in valve types are what a permit relies on.
• Excavation controls are enforced through a permit to dig.
• The Ex certification that hot work can breach.
• The bypassed trip that is time-limited, logged and signed back in — which is a permit by another name.

What to take away

• A plant is built sealed. The permit system governs the moment it is deliberately opened.
• The permit records a decision. The controls make the job safe, not the signature.
• Making an isolation is not proving one, and proving is the step under pressure.
• Lock and tag, so that nobody who does not understand the isolation can remove it.
• Confined spaces kill rescuers. The standby person raises the alarm and does not enter.
• Hot work needs gas testing before and during, and a fire watch after it stops.
• Suspended work goes back to proving, never straight back to work.
• Handback is rushed, and its consequences land on somebody else at start-up.