Guidance on permit-to-work systems A guide for the petroleum, chemical and allied industries

This is a free-to-download, web-friendly version of HSG250 (First edition, published 2005). This version has been adapted for online use from HSE’s current printed version.

You can buy the book at www.hsebooks.co.uk and most good bookshops.

ISBN 978 0 7176 2943 5 Price £8.95

This book describes good practice in the use of permit-to-work systems, and will help operators using these systems to ensure risks have been reduced to a level as low as reasonably practicable.

It will be particularly useful to the onshore and offshore petroleum industry, onshore chemical and allied industries and other industries. The potential for serious incidents in these industries is clear, and permit-to-work systems are a vital part of effective management of the hazards.

The book reinforces previous advice, and reflects recent technical advances (eg electronic permit systems) and good practice identified in these industries.

HSE Books Page 1 of 40

© Crown copyright 2005

First published 2005

ISBN 978 0 7176 2943 5

All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording or otherwise) without the prior written permission of the copyright owner.

Applications for reproduction should be made in writing to: The Office of Public Sector Information, Information Policy Team, Kew, Richmond, Surrey TW9 4DU or e-mail: licensing@opsi.gov.uk

This guidance is issued by the Health and Safety Executive. Following the guidance is not compulsory and you are free to take other action. But if you do follow the guidance you will normally be doing enough to comply with the law. Health and safety inspectors seek to secure compliance with the law and may refer to this guidance as illustrating good practice.

Contents Foreword 4

Introduction 5

How to use this document 6

What is a permit-to-work system? 7

When are permit-to-work systems required? 9

Essentials of permit-to-work systems 11 Display 11 Suspension 12 Permit interaction 13 Handover 13 Hand-back 13 Permit authorisation and supervision 14

Harmonising roles within permit-to-work systems 16

Responsibilities 17 Employers or duty holders 17 Site or installation managers (acting as originator, permit authoriser or area authority) 18 Contractors’ and subcontractors’ management (acting as performing authority or permit user) 18 Responsible authority (acting as permit authoriser, issuing authority or area authority) 19 Supervisory personnel (acting as performing authority or permit user) 20 Individuals (acting as permit user, site checker or isolating authority) 20

Training and competence 20

What does a permit-to-work look like? 22 Electronic permits 24

Work planning and risk assessment 25

Monitoring, audit and review of permit-to-work systems 27

Appendices 28 1 Relevant legal requirements 28 2 Further information on different permit types 30 3 Checklist for the assessment of permit-to-work systems 32 4 Permit-to-work monitoring checklist 36

References and further reading 38

Foreword This guidance replaces the 1997 revision of Guidance on permit-to-work systems in the petroleum industry (ISBN 0 7176 1281 3) which took account of industry experience gained since 1991, and takes into account other relevant guidance, in particular The safe isolation of plant and equipment.1

This revision builds on previous editions by incorporating recent technical advances (eg electronic permit systems) and good practice identified in the onshore and offshore petroleum industry and onshore chemical and allied industries. It highlights key areas for possible future harmonisation of permit-to-work systems.

This document describes good practice in the use of permit-to-work systems, and as such may be useful to operators using permit-to-work systems as part of a demonstration that risks have been reduced to as low a level as reasonably practicable (ALARP). The guidance is applicable to the onshore and offshore petroleum industry, onshore chemical and allied industries and other industries where permit-to-work systems are used.

The document is primarily written around well-established paper-based permit-to- work systems, but where possible it accounts for the newer medium of electronic- based permit-to-work systems.

Introduction 1 The petroleum, chemical and allied industries store and process large quantities of hazardous substances including flammable and toxic materials, so the potential for serious incidents is clear. To prevent such incidents it is vital that there should be effective management of hazards, including the use of safe systems of work.

2 A permit-to-work system is an integral part of a safe system of work and can help to properly manage the wide range of activities which can take place close together in a small space, such as in a storage area or process plant.

3 When incidents do occur, human factors, such as failure to implement procedures properly, are often a cause. These failures may in turn be attributable to root causes such as a lack of training, instruction, communication or understanding of either the purpose or practical application of permit-to-work systems.

4 Permit-to-work systems form an essential part of the task risk assessment process. When a task is identified an appraisal should be carried out to identify the nature of the task and its associated hazards. Next, the risks associated with the task should be identified together with the necessary controls and precautions to mitigate the risks. The extent of the controls required will depend on the level of risk associated with the task and may include the need for a permit-to-work.

5 A permit-to-work is not simply permission to carry out a dangerous job. It is an essential part of a system which determines how that job can be carried out safely, and helps communicate this to those doing the job. It should not be regarded as an easy way to eliminate hazard or reduce risk. The issue of a permit does not, by itself, make a job safe - that can only be achieved by those preparing for the work, those supervising the work and those carrying it out. In addition to the permit-to-work system, other precautions may need to be taken - eg process or electrical isolation, or access barriers - and these will need to be identified in task risk assessments before any work is undertaken. The permit-to-work system should ensure that authorised and competent people have thought about foreseeable risks and that such risks are avoided by using suitable precautions. Those carrying out the job should think about and understand what they are doing to carry out their work safely, and take the necessary precautions for which they have been trained and made responsible.

How to use this document 6 This guidance is intended to provide a basic understanding of what is meant by a permit-to-work system. The advice is of a general nature, and is not intended to be exhaustive. It is essential that it is read in conjunction with the specific instructions and guidance produced by individual companies. In addition, the Task Risk Assessment2 and other guidance published by the Step Change in Safety initiative, and guidance published by the Health and Safety Executive (HSE) (see Further reading) should be consulted as appropriate.

7 This guidance is designed to assist in three basic ways:

■■ to enable assessment of current permit-to-work systems against the principles put forward in this document, and to help to identify improvements to those systems in-line with current good practice; ■■ to offer guidance on harmonisation of permit-to-work formats and terminology to assist people who regularly travel from site to site, from company to company, from refinery to offshore installation, and may have to work under several systems; ■■ to allow development of a new permit-to-work system based on current good practice, and to give ongoing guidance through implementation and continued application.

8 This guide includes recommendations based on good practice from the petroleum, chemical and allied industries and learning from the investigation of incidents and accidents involving failures in permit-to-work systems. Some case studies are highlighted in the text. In particular, readers are reminded of the importance of failures in the permit-to-work system in the sequence of events leading up to the Piper Alpha disaster in 1988, as summarised in the subsequent report by the Hon Lord Cullen.3

What is a permit-to-work system? 9 A permit-to-work system is a formal recorded process used to control work which is identified as potentially hazardous. It is also a means of communication between site/installation management, plant supervisors and operators and those who carry out the hazardous work. Essential features of permit-to-work systems are:

■■ clear identification of who may authorise particular jobs (and any limits to their authority) and who is responsible for specifying the necessary precautions; ■■ training and instruction in the issue, use and closure of permits; ■■ monitoring and auditing to ensure that the system works as intended; ■■ clear identification of the types of work considered hazardous; ■■ clear and standardised identification of tasks, risk assessments, permitted task duration and supplemental or simultaneous activity and control measures.

Case study 1

Contractors were engaged to demolish redundant oil storage tanks in a tank farm on an oil blending and storage site. A pump house was still in operation in the vicinity of the redundant tanks and the occupier was aware of the fire risk. A method of work was agreed with the contractors which involved cold cutting those parts of the tanks nearest to the pump house and taking them to a safe place on site for hot cutting into smaller pieces. A permit-to-work was not issued and the agreed procedures were not documented. The contractors did not follow the agreement and began hot cutting the tanks close to the pump house. Flammable vapours from the pump house were ignited and the resulting fire caused considerable damage to the plant. Five firemen were taken to hospital suffering from the effects of the fumes.

A permit-to-work should have been issued for this job and the work monitored by the client to make sure the contractor stuck to the agreed method.

10 The terms ‘permit-to-work’, ‘permit’ or ‘work permit’ refer to the paper or electronic certificate or form which is used as part of an overall system of work, and which has been devised by a company to meet its specific needs.

11 A permit-to-work system aims to ensure that proper consideration is given to the risks of a particular job or simultaneous activities at site. Whether it is manually or electronically generated, the permit is a detailed document which authorises certain people to carry out specific work at a specific site at a certain time, and which sets out the main precautions needed to complete the job safely.

12 The objectives and functions of such a system can be summarised as:

■■ ensuring the proper authorisation of designated work. This may be work of certain types, or work of any type within certain designated areas other than normal operations; ■■ making clear to people carrying out the work the exact identity, nature and extent of the job and the hazards involved, and any limitations on the extent of the work and the time during which the job may be carried out;

■■ specifying the precautions to be taken, including safe isolation from potential risks such as hazardous substances, electricity and other energy forms (for details of isolation procedures and when they are appropriate see HSE guidance on The safe isolation of plant and equipment);1 ■■ ensuring that the person in direct charge of a unit, plant or installation is aware of all hazardous work being done there; ■■ providing not only a system of continuous control, but also a record showing that the nature of the work and the precautions needed have been checked by an appropriate person or people; ■■ providing for the suitable display of permits (see paragraph 18); ■■ providing a procedure for times when work has to be suspended, ie stopped for a period before it is complete (see paragraph 19); ■■ providing for the control of work activities that may interact or affect one another (see paragraph 22); ■■ providing a formal handover procedure for use when a permit is issued for a period longer than one shift (see paragraph 23); ■■ providing a formal hand-back procedure to ensure that the part of the plant affected by the work is in a safe condition and ready for reinstatement (see paragraph 24); ■■ providing a process for change, including the evaluation of change on other planned activity, a determination of when hazards need to be reassessed, and a means for controlled communication of change.

13 A permit-to-work system will be more effective if site management and other personnel have been consulted. Imposing systems without consultation can lead to procedures that do not reflect the needs of maintenance staff, for example. Procedural violations are then more likely.

Case study 2

In September 1992, a jet of flame erupted from an access opening on the side of a batch still at Hickson and Welch, Ltd, Castleford, West Yorkshire. Five people were killed when the flame destroyed a control room adjacent to the still and damaged the nearby office building. The incident happened while a job was underway to rake out a residue that had built up in the still in the 30 years since it entered service. There were a number of failings identified during the HSE investigation including:

–– failure to analyse the sludge and the atmosphere in the vessel prior to starting the job; –– failure to control the temperature of the steam used to soften the sludge, resulting in temperatures in excess of 90 °C being applied; –– use of a metal rake in a flammable atmosphere; and –– failure to properly isolate the vessel prior to the job.

A permit-to-work system was in place on the site and two permits were issued, one for removal of the lid to the access opening and one for blanking the still inlet base. No permit was issued for the actual job to be done. Had a permit been issued for the raking out of the residue then the permit-to-work system may have allowed identification of the hazards associated with the job and allowed controls to be put into place that could have prevented the incident.

Case study 3

A release of 40 000 cubic feet of highly flammable material occurred on an offshore installation when a compressor balance line was not isolated during a maintenance operation. A permit-to-work was issued for the job by a maintenance operator. The permit identified the mechanical and electrical isolations necessary but did not specify the process isolations because the issuer was not aware of the necessary process controls.

Case study 4

In the permit-to-work system in place at the time of the Piper Alpha disaster, there was no cross-referencing when the work carried out under one permit affected the work under another. Reliance was placed on the memory of the designated authority.

Case study 5

A fitter was scalded by an escape of high-pressure steam from an open pipe. Two fitters were carrying out work on the pipes under a permit-to-work. The first fitter thought the job was complete and returned the permit to the process operator who opened the steam valve. The second fitter had not completed his part and was still working on the open pipe. The permit-to-work system did not contain a signing off procedure.

When are permit-to-work systems required? 14 Permit-to-work systems should be considered whenever it is intended to carry out work which may adversely affect the safety of personnel, plant or the environment. However, permit-to-work systems should not be applied to all activities, as experience has shown that their overall effectiveness may be weakened. Permits-to-work are not normally required for controlling general visitors to site or routine maintenance tasks in non-hazardous areas.

15 Permit-to-work systems are normally considered most appropriate to:

■■ non-production work (eg maintenance, repair, inspection, testing, alteration, construction, dismantling, adaptation, modification, cleaning etc); ■■ non-routine operations; ■■ jobs where two or more individuals or groups need to co-ordinate activities to complete the job safely; ■■ jobs where there is a transfer of work and responsibilities from one group to another.

Case study 6

A major vapour cloud explosion at a chemical complex in Passadena, USA in 1989 killed 23 people and injured 300. The incident occurred during maintenance work on a reactor vessel which was being carried out by a maintenance contractor. During the investigation, it was discovered that there was no effective permit-to-work system in operation that applied to both company employees and contractors. This lack of an effective system led to a communication breakdown and work taking place on unisolated plant.

16 Sites and installations should give particular attention to the permit-to- work system during combined or simultaneous operations to ensure that work undertaken does not compromise safety, for example by a mobile drilling unit or support vessel. Combined operations may require the interface of electronic permit- to-work systems with paper-based systems to enable permits to be transmitted or authorised by remote sites.

17 More specifically, the following are examples of types of job where additional permits or certificates (eg isolation certificates - see Appendix 2) should be considered:

■■ work of any type where heat is used or generated (eg by welding, flame cutting, grinding etc); ■■ work which may generate sparks or other sources of ignition; ■■ work which may involve breaking containment of a flammable, toxic or other dangerous substance and/or pressure system; ■■ work on high voltage electrical equipment or other work on electrical equipment which may give rise to danger; ■■ entry and work within tanks and other confined spaces; ■■ work involving the use of hazardous/dangerous substances, including radioactive materials and explosives; ■■ well intervention; ■■ diving, including onshore operations near water; ■■ pressure testing; ■■ work affecting evacuation, escape or rescue systems; ■■ work involving temporary equipment, eg generators, welding equipment etc; ■■ work at height; ■■ any operation which requires additional precautions or personal protective equipment (PPE) to be in place; ■■ any other potentially high-risk operation.

More details on permits and certificates typically used for these jobs are given in