Traci: Well, for today we're going to kind of revisit something we talked about a few years ago and we tackled the topic of permit to work. And it was one of our more popular episodes, so I think it's a good time to revisit it. So I want to start out, let's set the stage a little bit with a brief definition of permit to work and how a permit-to-work system transfers equipment ownership and accountability between operations and maintenance teams.
What Is Permit to Work?
Trish: Yes, so that's a really important question and that's fundamentally the whole reason why we have a permit to work. It's about managing that safe transfer of who is in control of that piece of equipment for the activities that are about to take place. So when we're in normal operation, our operations team are accountable and in control of their equipment. They operate it as per the procedures and as per the process, but when it comes time for some work to happen that interferes or interacts with the equipment in a different way, such as taking it out of service, breaking lines, so opening up flanges, those sorts of things, this is when we need to make sure we very clearly document the precise point at when it's handed over to the next group to take ownership and accountability for, and they need to clearly understand what's gone on, what state the equipment is in, and then do their work so they can then safely hand that back to the operations group.
So it's really around managing this interface between different groups who have very different purposes and making sure that at that interface time everybody understands the state the equipment is in so that we know it is safe for the next stage of operation. So for example, it might be if the operators have drained it down to remove any flammable liquid from it, for example, that when the maintainers come in they know that the operators have drained it down, and so that the permit-to-work process is part of that handover. And that doesn't mean that they shouldn't also check things as well. So any good maintainer will know that when they do go to crack a flange, they always crack it away from themselves after having done some other sort of testing just to make sure there's no pressure in that line, no potential fluid in that line that could harm them in any way. And likewise, that at the end of the job they've bolted it all back up safely again to hand back to the operator so the operators can then go through the process of refilling that particular piece of equipment as well.
What’s Included in a Permit to Work Document?
Traci: Let's talk a little bit about what elements are included, which you talked a lot about what needs to go into it, but are there specific elements that need to be included in the permit-to-work documents?
Trish: Yeah, absolutely. One of the key ones is the isolations. So precisely what has been isolated and how? So is that closing valves, is it opening of drains, is it racking out electrically of equipment? Those sorts of things. So we need to know, we need document what the isolations are, but really importantly as well, we need to make sure we do a risk assessment of the activity that's about to be undertaken. And that's really important to make sure that when the person doing the work goes to actually undertake that task, they have been involved in that risk assessment and they know, they've had a discussion about what the hazards are and what controls need to be put in place to manage those hazards.
So I think for me, some of those key areas is obviously that we've got the isolations right, we've done the risk assessment. And I think the other really key part is some of the fundamental basics of the report, like the time the report is valid for and the scope of work because keep in mind if you get a permit to do a particular task and you get out to that job and you discover that the task is bigger than you thought and it needs extra stuff to be done, you can't just go and do the extra stuff because the permit scope is what has been considered when people isolated and when people do the risk assessment. So if you change that scope, the isolations may not be valid, the risk assessment is not valid, they all have to be rechecked again, so we can't just do someone a favor by doing that extra little bit of work.
It sounds a bit bureaucratic that it's easy, "I could do it, I'm right here, I could just do that bit." But if it wasn't written down in the scope, we don't know it's been considered in the risks and in the isolations. And if we do a task that has not considered the isolations or the risks adequately, unfortunately those are the sort of tasks that actually kill people when it comes to permit-to-work incidents.
Different Types of Permits
Traci: And that brings up the point of different activities require different permit types. Can you comment a little bit about that?
Trish: Yes. So, in most organizations, I'm sure people have a cold work permit or a standard work permit. That's a piece of work that happens that doesn't generate any heat or have the potential to cause any ignition sources, and it's pretty straightforward kind of work. Then you've got a hot work permit. That's when we are generating ignition sources, whether it's through heat, spark, or electrical activity that might generate a spark, for example. So we need to understand that we've got cold work and hot work. And if you've got a cold work permit, you cannot do hot work on a cold work permit because a hot work permit would've also considered atmospheric testing to make sure there's not a flammable atmosphere, whereas a cold work permit doesn't have to do that necessarily all the time.
But there are other sorts of permits as well. There are things like confined space entry permits. If you need to go into a confined space, we need to go through the permitting process. Now, a particular job might have multiple permits. For example, you might have a hot work permit inside a confined space, so you could have multiple types of permits available to you. You'll also have various other permits potentially like excavation permits. So if you're going to start digging a hole, we know we're not going to dig through a gas main or an electrical cable for example. So there's all those different sorts of permits that we want to understand and make sure that we cover adequately as we go through our work so that we are covering all of the right hazards and risks that we've got to deal with.
Permit to Work Timeframes
Traci: And now there are timeframe restrictions, correct, for these permits? And are there circumstances where the permits become invalid? What are we looking at there?
Trish: Yeah, so all permits will have a start time and an end time to them, and typically that will last over a shift in general. It'd be at the start of the shift till the end of the shift because once we actually change the work group in a shift change, the circumstances have changed, so the permit doesn't automatically just continue. We need to actually then make sure potentially that we extend that permit, so there are some processes that you might have that allow you to extend the duration of a permit to say the next shift or a subsequent shift. Then there'll be other requirements where no, you can't extend that permit, you have to finish that one, and then we'll start a new one.
Some things that could invalidate a permit for example, is if you've got a permit and you're doing some work and the emergency alarm goes off at the site and everybody has to muster. That invalidates a permit, you can't just go back and keep doing the work once the muster's over. There will have to be several checks done to make sure that that work is still safe again, so that permit is no longer valid at that point. It will need to be revalidated and go forward there. So there're just a couple of examples of the sort of time durations you might see.
Traci: Now, do people adhere to these things? Is it something that is regimented or something that has to be reminded?
Trish: Well, it should be something that's regimented because permit incidents in process safety and in occupational safety as well are very, very common. Sadly, people go and do the work because they think they're doing the right thing. I don't think they do the work without a permit because they want to be radical and go and do the work without a permit. I think they think they're doing the right thing. It's, "I can just get this done really quickly. It's such a small job, I don't need that permit. That's going to take me an hour to get that permit. I could do the job in five minutes." But if you don't know all the hazards that are going on at that point in time, and if you don't know that equipment's been prepared adequately, and if the operators don't know that you're about to do that quick five-minute job, this is all starting to be a recipe for disaster.
So we actually do need to really focus on making sure people understand why permits are so important. And they're actually not there to slow you down and just delay your work. They're actually there to keep you safe and to keep the equipment safe as well. And so that's one of the challenges that we have.
Another really, really common permit incident that happens is when people go and do hot work without the appropriate hot work permit and checks in place. And sadly, this is something that usually involves welding on the outside of a tank somewhere without realizing that inside that tank is a flammable atmosphere, and you only need one thing to go wrong and we have an explosion occur. And this is actually something that does occur quite regularly around the world, people welding on a tank and then an explosion occurs. And the people doing the welding usually don't survive this incident. And so hot work on tanks, not understanding the flammable atmosphere around you, is probably one of the most common fatality permit-to-work situations around the world.
Lessons from Piper Alpha’s Deadly Permit to Work Failure
Traci: Speaking of incidents around the world, one of the most prominent permit-to-work failures was the Piper Alpha oil rig sinking in the North Sea killing 167 men who were aboard. Can you walk us through the permit-to-work system failures that contributed to this disaster?
Trish: Yeah. So the Piper Alpha anniversary was actually a week or so ago now, and this was a situation where they were actually doing some routine maintenance and inspection on pressure relief valves across the whole platform. And so they had contractors on board and their role was to work with the operators, get the permit so that the pressure relief valves were isolated, go and remove the pressure relief valve, do the testing to make sure it was still functioning, do any necessary maintenance and retrofitting, have that valve inspected by the quality inspector and then reinstall that valve, and then hand the permit back to the operators for that particular piece of equipment to be allowed to be put back in service.
Now, they're getting towards the end of doing all the valves on that vessel on that platform. And what actually happened was they removed a pressure relief valve off a pump. Now, this pressure relief valve was actually located quite a distance away from the pump and on a different level of the platform. So actually, if you are standing looking at this pump, you can't see the pressure relief valve for it. And that's important to note here. So the pressure relief valve had been removed and the job task was to, as I said, take it to the workshop, do the test, do any maintenance on it, have it inspected, install it back, and the fitters that remove that valve made the assumption that that would be all done within that shift. And what they then did was when they put a blank flange over the pipe where they just removed that valve, they didn't torque up the studs on that flange, they actually just finger tightened the studs, the nuts and bolts, and then they went away and they did their work.
And so this pump is out of service, it's locked out electrically, its valves are isolated and locked out, so it can't be turned on. You can't just go and turn that pump on. But importantly, it's got no relief valve and it's not adequately sealed. The relief valve pipe is open because it's only finger-tightened. Now, there was a delay in having that valve inspected before it was to be reinstalled. Because of that, the valve wasn't reinstalled before the end of that shift. The permit was taken back into the permit hut and just put down, and those workers went about their evening because they weren't on shift at that point in time. Later that evening, one of the other pumps in that service tripped out. That meant that if the operators couldn't get that pump started, they were actually going to have a power outage situation potentially and create some other issues on the platform as well.
And so what they decided to do was they looked and they said, "Okay, the permit's back here, that's all fine. The work's done. We'll go and put say pump A back into service that was isolated." And remember, has no relief valve but also has a non-secured flange as well. And so they went about the task of putting pump A back into service because pump B had tripped out. And sadly, pump A should not have been returned to service because of the fact that it was lacking a relief valve and was not adequately sealed off. And so what happened is when that pump went back into service, it created a massive release of hydrocarbon that found an ignition source. And that explosion took out the control room, the firefighting system, and that meant that basically the fire just continued to burn and was unable to be controlled.
The workers mostly followed their emergency response plans, which was to muster in the mess and await rescue, a rescue that was unable to be affected because of the smoke and the flames. And sadly, most of those, 167, men tragically died of smoke inhalation and they were later recovered from the seafloor after the rig had sunk. There were several survivors and the survivors all actually talk about how they jumped off the platform into a burning sea in the dark and were rescued by rescue boats at that point in time.
And so Piper Alpha very much changed a whole lot of things. It changed how we design isolation valves. That's a whole other story on Piper Alpha, the rig isolation valves. It changed how we do emergency evacuation and muster activities. Again, that's a whole other story, but it also changed how we do permit to work and it really got quite rigorous and structured around this handover process and the fact that a permit can't be left unsigned and assumed to have been done. And so we've learned an enormous amount from Piper Alpha, but sadly we still keep making similar mistakes over the years. And so we still today see permit to work, process safety, and as I said, occupational safety incidents as well.
Addressing Non-Compliance
Traci: We keep making the same mistakes, so obviously we have to make sure that people are doing these things. And we touched on it a little bit earlier, but organizations need to conduct permit checks and they need to measure compliance rates and they need to address non-compliance issues. How do they do all of these things?
Trish: Yeah, so that is really important. This is our verification stage of process safety, which is so important because we actually need to know that our critical controls are working, and a permit system is a critical control in your organization. I once heard someone refer to when talking about managing critical controls, "Manage them like your life depends on it because it does." And that resonated with me ever since. So we need to make sure those controls work because our lives depend on these controls working. And so the way to do that is if you understand the workflow of your permit system and what is included in it, then you should have a checklist that actually would allow anybody with a little bit of knowledge of the facility to pick up the checklist and pick up a permit and actually start to look and say, "Okay, do we have the date right? Do we have the scope? Is it the scope of the work they're actually doing or have we extended the scope? Do we have the isolations? Are all the isolations in place? Can I see that?"
And so checking every single element of that permit, and a checklist is a useful way to make sure you remember all of those bits and pieces. And so a typical rule is that you want to actually go out and make sure that you are checking several permits a week in your facility, and permit-check doesn't need to take a long time. It might only take 10 minutes or it might be a really complex one that's going to take you potentially half an hour to an hour to do because you actually might want to go and walk those isolations if it's a really complex task just to make sure it's all okay.
And so doing the check it allows us to highlight, "Is there a problem with this permit right now? Do I need to stop something for safety's sake and rectify it right now?" But it also allows us to uncover whether there's systemic issues in our facility. "Do we always get this part of our process wrong?" If everybody or most people are getting that part of the process wrong, we need to go and look at that and see if there's something we can do to fix it. So the important part is that we do permit checks and we should count that we do those checks so that we could say, "Yes, we did 10 permit checks this week."
And so you go through and you do that process, but you need to make sure that those permit checks also range from permits that are open as well as permits that are closed, because if you only check permits that are open, you are never verifying the closure process, which is when we hand the equipment back to the operators, so we have to check that too. That can be a catch the people go, "I'll go and check the live permits." Yeah, that's great. But what about the closed permits? Have they been closed properly and safely? Because keep in mind, remember Piper Alpha, that permit wasn't adequately closed because that pump should not have gone back into service. So that was missed in that process, so you've got to check your closed permits too. You also then counting that we've done 10, 15 checks, that's lovely. I can tick, "I've got a target to do 10 checks this week. I've done my 10 checks. Isn't that great?"
But that's what I'd call a task-based metric. "I've done a task, I can tick a box." What have you found in that check? And that's where the checks then actually need to be analyzed. And this is where your safety teams come into it. They need to look at those checks and go, "Okay, we're seeing 80% compliance, but the 20% that we're not seeing is people keep writing down the date wrong or something. It might be something really minor." "Well, does that matter? That's why we need to analyze it. That's why we need to understand." It might be something insignificant or it might be, "Gee, 20% of the time we're working outside the scope." Now, that's massive. So we need to make sure that we analyze the actual compliance results and go, "Okay, we are missing this. There's a problem in our process that we keep missing this bit. We're just not getting that bit right."
So there's some of the sorts of things that you can do. So your permit check form needs to align with what your permit looks like. There's no point doing a generic check form on a very specific permit because you won't necessarily be checking everything. So you've got to create your check form, you've got to make sure you have a process to do your checks. You've got to count your checks to make sure they're happening. You've got to do them on open and closed and then you have to analyze. You've got to do the quality check on the checks to see what we're getting wrong each time so that we can try and intervene and rectify that before it creates an incident for it.
Traci: Lots of good stuff there, Trish. Is there anything that you want to add to this topic?
Trish: I think really if you are involved in a permit system, whether you are the operator, whether you are a maintainer, whether you are an authorizer or someone that authorizes particular elements of it, such as complex isolations or confined spaces, we need to get you to focus a little bit more on permits and really understand the value of them.
Take a look at some of the material about Piper Alpha. 167 men died that day. There are many, many incidents of hot work explosions because we didn't permit them right, we weren't monitoring and managing the ignition sources with the vapor sources. So permits are too important for us to get wrong. And these are the sort of incidents that if you are the person at the pointy end with the spanner or the welding machine or whatever it is, potentially you are the one that's going to be caught in this. And we want you to go home safe, focus on your permits, make sure you understand them, make sure you are working within the scope of them.
And we need to get more disciplined with how we do this because permits, it's a simple process and it's a critical process, but it's an administrative process, which means as humans, we've got to really focus on getting it right. It's easy to make a mistake, and we can't afford to make mistakes in permits because when we do that in permits, sadly people die.
Traci: Well, you said it earlier, "manage like your lives depend on it," and you always help us to do that, so I appreciate the time you put into this. Unfortunate events happen all over the world, and we will be here to discuss and learn from them. Subscribe to this free award-winning podcast so you can stay on top of best practices. You can also visit us at chemicalprocessing.com for more tools and resources aimed at helping you run efficient and safe facilities. On behalf of Trish, I'm Traci, and this is Process Safety with Trish & Traci. Thanks, Trish.
Trish: Stay safe.
