A Permit-To-Work (PTW) is a detailed document which describes specific work at a specific site at a particular time which is to be carried out by authorized personnel. It also sets out any precautions and control measures which are necessary to complete the work safely.
- Role and purpose of a permit-to-work system
- Case Study
- The key features of a permit-to-work system
- Appropriate use of Permit-To-Work (PTW) systems
- Case Study – Appropriate use of PTW systems
- Permit interaction
- Permit authorization and supervision
- Permit-to-work template
- Types of permit
- Types of permit – hot work permit
- Types of permit – cold work permit
- Types of permit – equipment disjointing certificate/breaking containment permit
- Types of permit – electrical work permit
- Types of permit – confined spaces entry certificate
- Types of permit – working at height permit
- Types of permit – machinery certificate
- Types of permit – isolation certificate
- Types of permit – radiation certificate (non-destructive testing of welds)
- Types of permit – diving certificate
- Case Study – Types of permit
- Interfaces with adjacent plant
- Case Study – Interfaces with adjacent plant
- Interfaces with contractors
- Case Study – Interfaces with contractors
- Lock out, tag out and isolation
- Basic procedure for implementing lock out and tag out actions
- Case Study – Lock out, tag out and isolation
- REVISION QUESTIONS FOR ELEMENT 2 CONTINUED
Role and purpose of a permit-to-work system
A PTW system is an integral part of a safe system of work and can help to properly manage a wide range of work-related activities. This is particularly true of maintenance work, where activities involve being in close proximity to normally restricted operations or energy sources.
Permit-to-work systems form an essential part of the controls that are forthcoming from a work task risk assessment process. When a work task is identified as being required, an assessment should be carried out to identify the nature of the task and its associated hazards.
From that assessment it should be possible to identify the risks associated with the task and determine the controls and precautions required that will mitigate the risks to an acceptable level. These controls may well include the need for a PTW system to be implemented.
A permit-to-work is not simply a means of giving permission to carry out a dangerous task; it is a means of defining how a task can be carried out safely and under what circumstances. Being a permit-to-work system, it also helps communicate the seriousness and importance of applying a prescribed method of working both to the person undertaking the task and to managers who control the permit-to-work system.
The issue of a permit-to-work does not, by itself, make a job safe – that can only be achieved by those preparing for the work, those supervising the work and those carrying out the work.
A PTW system on its own may not be enough to eliminate all risks associated with the task. Other precautions may be deemed necessary, such as process or electrical isolation or access barriers. These will need to be identified as part of the task risk assessments undertaken at the outset.
The PTW system allows for competent people to give consideration to the foreseeable risks of a particular task, so that such risks can be reduced to a level that can be regarded as being As Low As Reasonably Practicable (ALARP). Those carrying out the task also need to be competent and understand what they need to do in order to carry out their work safely.
An oil storage tank farm had a redundant storage tank which needed to be demolished. It was sited near an operational pump house so it was agreed that the best way to conduct the work was to cold cut parts of the tank and remove them to a safe place for hot cutting into smaller pieces.
Contractors were engaged to undertake the work. Discussions between the client and the contractor took place to establish the agreed method of working. However, the reasoning behind the decision to cold cut the tank was not conveyed, and when it became apparent that cold cutting was becoming an arduous task, the contractor decided to use hot cutting methods. This ignited some flammable vapours which emanated from the nearby pump house and quickly developed into a serious fire.
During the subsequent attempt to quell the fire by the emergency services, five firemen were taken to hospital suffering from the effects of the fumes.
The subsequent enquiry concluded that a permit-to- work system should have been implemented and the work monitored by the client.
The key features of a permit-to-work system
The essential features of permit-to-work systems are:
- The clear identification of who is responsible for specifying any necessary precautions.
- The identification of personnel who may authorize particular jobs (including any limitations to their authority).
- The clear identification of any work classified as hazardous.
- Clear identification of:
- risk assessment;
- duration of permitted tasks;
- additional or simultaneous activity;
- control measures;
- Training and instruction regarding the issue, use and closure of permits-to-work.
- Monitoring and auditing to ensure that the system is working as planned.
A permit-to-work document also provides written evidence, by means of a signature, that at various stages during the time the PTW was live, each stage was accepted by the person holding the PTW. This occurs when the PTW is issued from both the permit authorizer and the person accepting the permit; at handover points when work is transferred from one shift to another; at handback point when the work has been completed and ready for testing and re-commissioning; and at cancellation of the permit to certify the plant was satisfactorily re-commissioned and is safe to operate.
Let’s now look at case study which shows what can happen in a situation which clearly needed a permit-to-work system applying to ensure agreed safe work
procedures were carried out.
A permit-to-work can also be described as a “permit” or “work permit”, but all refer to a form or certificate which is used within a controlled system of work. It can be in a written or electronic form, whichever meets the needs of the company. It also provides evidence that consideration has been given to the risks of any job on site or any simultaneous and conflicting activities which may be affected by it.
The objectives and functions of a permit-to-work system are as follows:
- It ensures that proper authorization of designated work has been granted.
- It ensures those people who are conducting the work know the exact nature of the task including hazards, restrictions, time limitations, etc.
- It specifies the controls and precautions necessary to undertake the work safely, e. g. isolating machinery.
- It ensures those in charge of the location are aware the work is being carried out.
- It provides both a system of continuous control and a record that appropriate precautions have been considered and applied by competent persons.
- It affords the ability to display, to those who need to know, exactly what work is ongoing.
- It provides a procedural means of suspending work when this is necessary.
- It provides an ability to control work which might interact or conflict with ongoing operations or other permit-to-work activities.
- It provides a procedural means of handing over the work when that work covers more than one shift.
- It provides a procedural means of handing back the area or plant which has been involved in the work.
Appropriate use of Permit-To-Work (PTW) systems
Permits-to-work should be applied whenever work is to be carried out which may affect the health and safety of personnel, plant or the environment. This does not include work which is routine (e. g. routine maintenance which is carried out in non-hazardous areas) because this would tend to undermine the effectiveness of the permit system.
They should be considered, however, for:
- Special operations (i. e. work that is not routine).
- Work which is done other than normal production work (e. g. inspection, testing, dismantling, modification or adaptation of processes as well as repair work and non-routine maintenance).
- Work done by two or more individuals or teams where activities need to be co-ordinated to ensure the work is completed safely.
- Work which will take longer to complete than one shift and when the work and responsibility for it needs to be formally handed over.
Case Study – Appropriate use of PTW systems
In 1992, maintenance work was being carried out on a still at Hickson and Welch Ltd in Castleford, West Yorkshire, in the UK. The work involved softening the residue with steam and then raking out the residue from the bottom of the still with a metal rake. During the operation, the action of the metal rake caused a spark which ignited the flammable atmosphere inside the still, which in turn caused a jet flame to erupt from the access opening and engulf the control room situated next to the still. As a result five people were killed.
The resulting investigation found a number of failings including:
- Failure to analyse the chemical content of the sludge prior to starting the job.
- Failure to analyse the atmosphere in the vessel prior to starting the job.
- Failure to control the temperature of the steam used to soften the sludge. The consequence of this was that temperatures in excess of 90 °C were applied, which affected the flammable range of the volatile atmosphere.
- The use of a metal rake in a flammable atmosphere.
- Failure to properly isolate the vessel prior to starting the job.
The investigation also found that, although a permit-to- work system was in place on the site and two permits were issued relating to this particular job, they only covered limited procedures. These were the removal of the lid from the still in order to the access opening and the blanking of the still inlet base. No permit-to-work was issued for the work conducted inside the still.
Had a permit-to-work been issued for the raking out of the residue then the system may have offered the opportunity to identify the hazards. Once identified, controls could have been applied to counteract the hazards.
Copies of a PTW need to be clearly displayed:
- At the place where the work is to be carried out or in a recognized location close by. If the work is to be carried out in several locations, the permit should be kept by the performing authority.
- In the main control room or permit co-ordination room as well as in local control rooms.
As well as being displayed as described above, the issuing authority should keep a copy (unless that person is not located at the work site or in the control room, in which case the area authority should hold a copy).
Let’s look at case study relating to display of permit-to-work copies.
Sometimes work has to be suspended, for example:
- If there is a change to the planned type or extent of work.
- If there is a risk that the work to be carried out will present a hazard. For example, if the PTW is for hot work and at the same time there is a need to carry out sampling of process fluid or gas which itself poses the risk of the release of a dangerous substance.
- Whilst awaiting the delivery of spares.
- Where the work is in conflict with other work being carried out.
Although the permit-to-work is suspended, it will still remain live until it is actually cancelled. It is important, therefore, to remember that any isolations may still be active even though the work has been suspended.
Let’s look at case study relating to suspension of permits-to-work.
The permits which have been suspended should still be kept on the permit recording system. They should specify the condition of the plant where the work has been suspended and any consequences for other activities which may be affected by that condition.
If the suspension of work is likely to be extensive, it may be better to cancel the permit and re-issue a new permit when the work restarts.
When a permit-to-work is being considered for a job, it is important that the person issuing the permit is aware of any other activity (either planned or already under way) which may interact with the work to be done under the permit.
There are many types of permit-to-work, and these may be issued by different issuing authorities even though they all apply to the same site or facility. Because of this, close liaison is required by the various authorities to ensure that work done under one permit does not interact with another, creating hazards for either of them. By cross-referencing permits, detailed information about activities which may interact can be identified (e. g. isolations on one job may interact with work on another).
In the case of work done offshore, the control of conflicting activities by cross-referencing and prioritizing work tasks, to ensure that interaction between them does not create hazards, is usually the responsibility of a management team led by the Offshore Installation Manager (OIM). This team will prioritize work tasks during a permit-to-work meeting which will be held before any work is authorized.
A handover procedure is required in the event of any work being done under a permit-to-work which carries over into another shift. This allows the outgoing shift to communicate all relevant information about the work and the conditions of the permit to the new shift to ensure continuity and safety. The information will include:
- Any outstanding work under permit control.
- The status of that work (this should be left in a condition which can be reliably explained to and understood by the incoming shift).
- The status of any other work which may affect the permit-controlled job (e. g. isolations).
- The status of the plant or installation.
The information can be recorded in a permit log, permit file or on display boards. It is essential, however, that there is good communication between both the outgoing and incoming issuing and performing authorities. The signature of acceptance to allow the continuation of the permit by the incoming issuing authority is recommended.
Let’s look at case study involving handover as an issue.
The handback procedure should be a process of reinstating a plant or installation (or the part that has been worked on under a permit). This will ensure that the work has been completed and is in a safe condition. The issuing authority (the person who issued the permit) is responsible for signing off the permit and in doing so verifies that the plant or installation is in a safe condition, e. g. any isolations have been removed.
The person who is in control of operational activities will then make reference on the permit that the plant or equipment (or the part which has been subject to work under a permit) has been reinstated to the control of the production staff.
Permit authorization and supervision
A permit-to-work (PTW) must be co-ordinated or controlled by the issuing authority (or other responsible authority). This includes the monitoring and supervision of the work to ensure that it is being done according to the specific procedures detailed on the permit. Site visits by the issuing authority will depend on the work, the complexity and duration of that work and the hazards involved. The site visits should be carried out at least twice – at the start and completion of the work but more often if required. This will ensure that the conditions of the permit are being complied with.
In Table 1 we have reproduced a template of a permit- to-work document from the Health and Safety Executive (HSE) publication HSG250, which states what information is required, a description of that information where necessary and the authorization required where necessary.
Types of permit
Permit-to-work (PTW) covers many different types of operations and tasks, and the following are examples of types of job where permits should be considered:
- Work where heat is used or is generated, for example welding, grinding, etc.
- Work which involves breaking containment of a flammable or dangerous substance.
- Work which involves breaking containment of a pressure system.
- Work on electrical equipment.
- Work within tanks and other confined spaces.
- Working at height.
- Work involving hazardous substances.
- Well intervention.
- Diving operations.
- Work involving pressure testing.
Let’s have a look at some specific types of permit.
Types of permit – hot work permit
This is issued for work which involves the application of heat or sources of ignition to vessels or equipment which may contain or have contained flammable vapour. Also for areas in which there may be a flammable atmosphere.
Hot work permits are typically coloured red or are red-edged.
Types of permit – cold work permit
This is issued for work involving hazardous activities which are not covered by a hot work permit.
Types of permit – equipment disjointing certificate/breaking containment permit
This permit is required for any work which involves the disconnection of pipework or equipment which may contain (or has contained) any high pressure or hazardous fluids or other substances. It will usually be used for the insertion of spades into pipework (and for the subsequent removal of those spades). These certificates usually have a black border.
Types of permit – electrical work permit
As it suggests, this permit is used when working on a piece of equipment or a circuit that is safe. A permit should never be issued for work on live equipment.
Types of permit – confined spaces entry certificate
These certificates are used when entry to a confined space is essential for work to be done. They should specify all of the precautions necessary to ensure that exposure to hazardous fumes or an oxygen-depleted atmosphere is eliminated before entry to the confined space is permitted.
Although the certificate should confirm that the enclosed space is free from asphyxiating gases or hazardous fumes, it should also specify any precautions necessary to protect the worker(s) from exposure to the risk of harm from other sources, e. g.:
- The ingress of airborne contaminants from other sources.
- Hazardous fumes being released from residues within the confined space.
- Oxygen depletion caused by oxidation.
These precautions can include:
- Use of forced ventilation.
- Provision of personal protective equipment including breathing apparatus.
Types of permit – working at height permit
A working at height permit would be used to specify precautions required to fulfil the following requirements:
- Protection for the person who will be working at height (fall arrest equipment).
- Precautions for the safe rescue of a person should he/she fall.
- Supervision of the worker to ensure safe working procedures are being followed.
- Protection from falling objects.
- Safe access to and egress from the area.
Types of permit – machinery certificate
A machinery certificate would be issued for work to be done on large, complex pieces of equipment, and this would specify procedures to ensure the correct isolation of that equipment before the work commences.
Types of permit – isolation certificate
As with an electrical or machinery certificate, an isolation certificate is used to ensure that any equipment is mechanically and electrically isolated before work commences. A similar certificate may be used to confirm chemical isolation of plant and machinery. All of these certificates, if used, should be cross-referenced.
Types of permit – radiation certificate (non-destructive testing of welds)
Radiation certificates are issued to specify control measures to minimize the risk of exposure to sources of radiation. These control measures include:
- Site inspection.
- Controls on sources of exposure.
- Radiation monitoring.
- Access or containment barriers.
The certificate should include specific requirements for:
- Access/egress to/from the site.
- The minimum number of people needed on site during the radiography procedure.
- Special emergency procedures for radioactive source transportation.
Types of permit – diving certificate
A diving certificate is used to ensure the safety of the dive team. It ensures that no other work activities are taking place at the same time which would put the team at additional risk. This could include any over-side work or live firewater intake pumps.
Case Study – Types of permit
Work being carried out on the Piper Alpha rig at the time of the disaster was covered by a permit-to-work system. However, there was no cross-referencing of permits when work was conducted under one permit which affected the work conducted under another permit. Reliance was placed on the memory of the designated authority.
Interfaces with adjacent plant
As we have already mentioned, any permits for work being considered must be cross-referenced to any other work either being planned or in progress. This is to ensure there is no conflict or interaction which may result in the creation of additional hazards for any of the work.
For example: a maintenance crew is working on machinery on the main deck, a task which is scheduled to take one day. However, unforeseen problems arise and the work runs into day two.
On day two, as pre-arranged, a team of scaffold erectors join the rig to start erecting scaffold on a deck above the machine having maintenance carried out upon it. The scaffolding work, which if it went ahead would be conducted over the maintenance team, would clearly present a risk of injury to the members of that team.
A permit-to-work (PTW) system which cross-references other work would be expected to identify this conflict of work before it came about and the scaffolding work would be delayed until deemed safe to proceed (i. e. when the maintenance crew had finished their work).
Case Study – Interfaces with adjacent plant
Again, referring to the Piper Alpha disaster, the subsequent inquiry found that the performing authority’s copy of the permit was not always displayed at the job site, even though this was contrary to written procedures. More often than not it was kept in the performing authority’s pocket. The subsequent report made a specific recommendation on this point:
Copies of all issued permits should be displayed at a convenient location and in a systematic arrangement such that process operating staff can readily see and check which equipment is under maintenance and not available for operation.
Interfaces with contractors
Contractors, as we have covered earlier in Usage of Contractors in the Liquefied Petroleum Gas Industrythis article, are those people who have been engaged to undertake work for a client but who are not employees of the client. Consequently, they may not be as familiar with hazards, working practices and procedures, and permit-to-work (PTW) requirements, as are company employees. This unfamiliarity puts them at far more risk of harm.
There are a number of possible reasons why accidents which involve contractors are more prevalent, for example:
- Unfamiliarity with the layout of the site.
- Unfamiliarity with the permit-to-work (PTW) systems in place at the client’s site.
- Lack of adequate training for the contractor about the implementation of the permit-to-work procedures for a particular site.
- Lack of communication or knowledge within the workforce of the presence of the contractor.
- Increased hazards associated with the specific type of work which the contractor provides.
Consequently, a comprehensive induction procedure should be undertaken with regard to permit-to-work (PTW) systems with all contractors prior to any work being undertaken. This should include:
- Ensuring the contractor understands fully the principles of the PTW systems within the industry.
- Ensuring the contractor and his/her employees fully understand the PTW systems and the arrangements within them which apply to the site where they are to carry out the work.
- Ensuring that all personnel from the performing authority and other users are fully trained and aware of any specific arrangements in force to make the job safe at the location where they are to carry out the work.
The following issues should be considered in relation to the issuing of permits to contractors as far as interfaces are concerned:
- The client has to be certain that his/her employees are not exposed to any risk due to the actions of the contractor or his/her employees.
- The client must ensure that his/her employees do not expose the contractor or his/her employees to any risk due to their actions.
- The client must give the contractor full information regarding any hazards and risks associated with any of the parts of the work area where the contractor or his/her workforce will be undertaking their work. An example of this would be where contractors would be working close to hot steam pipes.
- A client must ensure that the contractor and his/ her workers work in accordance with agreed safe systems of work, and to do this he/she must monitor the work during the period of the contract.
Case Study – Interfaces with contractors
Again, the Piper Alpha disaster presents us with an appropriate example. In this case, the control room, where the suspended permits should have been kept, was regarded as not having enough room to accommodate all of them. Consequently, they were kept in the safety office.
It was possible for a lead production operator to be aware of a suspended permit-to-work if it came to him for suspension in the 45 minutes before he officially came on shift. However, if the suspension had happened days earlier, or even on the same day before he came on shift, they could be completely unknown to him.
What made things even more difficult was that suspended permits were filed according to the trade involved rather than the location of work activity. The result was that it was not clear which equipment had been isolated in any one location.
The enquiry also found that there were often cases of large numbers of suspended permits at any one time. This made it difficult to establish which equipment was undergoing maintenance.
Lock out, tag out and isolation
The term “lock out” or “tag out” (LOTO) refers to a procedure which is aimed at safeguarding someone who is working on or near plant or machinery, from that plant or machinery unexpectedly starting up or releasing energy of some kind.
This procedure involves an authorized person to disconnect the plant or machinery from its energy source. This person then locks or tags the isolator in order to prevent anyone from re-energizing the plant or machine.
A lock out device is a physical restraint which maintains the isolation device in a safe or “off” position. It can only be removed with a key, or some other unlocking mechanism, which can only be used with the authority of the person in charge of the permit-to-work (PTW) system.
For safety reasons, each lock must only have one key. No master keys are allowed on a lock out system. We have shown examples of lock out and tag out devices below.
Figure 5 shows an example of a lock out device fitted to an isolator which prevents the isolator from being switched on.
A tag out device is more of a warning system that an authorized worker applies to the isolator in order to indicate work is being carried out on the plant or machine. As such, the isolator should not be switched on whilst the work is underway.
Tag out devices are easy to remove. Consequently, they offer less protection than lock out devices. Figure 6 shows an example of a tag out device.
Basic procedure for implementing lock out and tag out actions
1 The person authorized to conduct the lock out or tag out action will identify the source(s) of energy to be controlled and the method of control to be used. A safe working procedure will then be established to implement the isolation followed by the lock out, tag out action.
2 All personnel who may be affected by the isolation caused by the lock out, tag out action should be informed. This information will include:
- what plant/machinery is going to be isolated;
- why it is going to be isolated;
- how long it will be isolated;
- who is the authorizing person;
- who is the contact person;
3 The process or system should be shut down as normal and confirmation made that all controls are in the off position and that all moving parts have stopped.
4 The process or system should be isolated from
its source of energy, following the safe working procedure set out by the authorized person at the identification of energy stage. Depending on the source of energy, the procedure will vary as follows:
- Electrical energy – the isolator to be switched to off position and the breaker connections to be visually verified to be in the off position. The isolator switch to be locked in the off position with a lock out or tag out device;
- Hydraulic or pneumatic energy – the isolator valve should be set in the closed position and locked in the closed position with a lock out or tag out device. Pressure should be bled off by opening the pressure relief valve;
- Mechanical energy – energy should either be carefully and slowly released from compressed spring, or the components should be blocked in the system or process which has the potential to be moved or activated by the spring’s energy. If the components are blocked from moving, the block should be locked in position with a lock out or tag out device;
- Gravitational energy – an isolation block or pin should be positioned to stop the system or process from moving. The block or pin should be locked in position with a lock out or tag out device;
- Chemical energy – the isolator valve on the supply lines should be set in the closed position. The isolator valve should then be locked in the closed position with a lock out or tag out device. Where possible, or appropriate, chemicals should be bled off by opening the bleed valve;
5 Verification that the isolation is effective needs to be made. This is normally done by making an attempt to try to restart the system or process. If it does not start, the isolation has been effective. Once isolation is verified the start-up controls must be returned to their off or neutral position.
6 Once the work is completed, the lock out, tag out device will need to be removed. This operation should include:
- Ensuring all tools and equipment have been removed;
- Ensuring all personnel are not near any hazardous areas;
- All controls are in the off or neutral position;
- Removal of the lock out, tag out devices and re-energizing the plant or process;
- Informing relevant personnel that the plant or process is back in service;
- The person who has been undertaking the maintenance work should remain whilst the plant or process is restarted.
Case Study – Lock out, tag out and isolation
The Piper Alpha inquiry found that during the handover on the night of the disaster, operators failed to communicate the fact that a service valve had been removed for servicing and had not been replaced. This missing service valve was the source of the leak of hydrocarbon which subsequently ignited and caused the disaster.
REVISION QUESTIONS FOR ELEMENT 2 CONTINUED
A permit-to-work is a detailed document which describes specific work at a specific site at a particular time which is to be carried out by authorized personnel. It also sets out any precautions and control measures which are necessary to complete the work safely.
A permit-to-work system allows for competent people to give consideration to the foreseeable risks of a particular task, so that such risks can be reduced to a level that can be regarded as being As Low As Reasonably Practicable (ALARP).
- To ensure that proper authorization of designated work is granted.
- To ensure those people who are conducting the work know the exact nature of the task including hazards, restrictions, time limitations, etc.
- To specify the controls and precautions necessary to undertake the work safely, e.g. isolating machinery.
- To ensure those in charge of the location are aware the work is being carried out.
- To provide both a system of continuous control and a record that appropriate precautions have been considered and applied by competent persons.
- To afford the ability to display, to those who need to know, exactly what work is ongoing.
- To provide a procedural means of suspending work when this is necessary.
- To provide an ability to control work which might interact, or conflict, with ongoing operations or other permit-to-work activities.
- To provide a procedural means of handing over the work when that work covers more than one shift.
- To provide a procedural means of handing back the area or plant which has been involved in the work.
Question 3: Describe the basic procedure for implementing a lock out/tag out action.
The person authorized to conduct the lock out or tag out action will identify the source(s) of energy to be controlled and the method of control to be used. A safe working procedure will then be established to implement the isolation followed by the lock out, tag out action.
- All personnel who may be affected by the isolation caused by the lock out, tag out action should be informed.
- The process or system should be shut down as normal and confirmation made that all controls are in the off position and that all moving parts have stopped.
- The process or system should be isolated from its source of energy following the safe working procedure set out by the authorized person at the identification of energy stage.
- Verification that the isolation is effective needs to be made. This is normally done by making an attempt to try to restart the system or process. If it does not start, the isolation has been effective. Once isolation is verified the start-up controls must be returned to their off or neutral position.
- Once the work is completed, the lock out, tag out device will need to be removed.
- Informing relevant personnel that the plant or process is back in service.
- The person who has been undertaking the maintenance work should remain whilst the plant or process is restarted.