Permit to work

Offshore Norge anbefaling 088 — common model for work permitsThe Norwegian offshore industry’s recommended guidelines for a common model for work permits, currently at revision 06. On a supply vessel working a Norwegian field the charterer expects the shipboard permit to be recognisable as the same model the installation is using, which is a requirement no international convention states and every operations manager knows.

A permit to work is the only document on a ship where the sequence itself is the safety measure. Isolate, test, brief, authorise, work, restore, close — in that order, with different people at different steps, and no step skipped because it was late and everyone knew what they were doing.

This module encodes the sequence as a state machine, which means it cannot be skipped rather than should not be. A permit cannot be authorised before the gas test that its template requires. It cannot be closed while an isolation is still recorded as applied.

• Four permit types, seeded and editable. General work, hot work, working at height and enclosed space entry, each with its own template, its own required tests and its own authorisers.
• Isolations signed on and signed back. Each isolation is a row with who applied it and who removed it. The permit will not close while one is outstanding, which is the failure mode that kills people.
• A gas reading that expires. An enclosed-space reading is valid for a stated period. When it lapses the permit says so rather than continuing to display a number from four hours ago.
• Toolbox talk attached to the permit. The talk is a form, held with the people who are doing the work, signed by them, and filed against the permit rather than in a folder.
• Locations from the vessel’s own register. A permit is raised against a space that exists on this ship — a named tank, a named room — not a free-text field that reads "engine room" in six different spellings.
• The permit board. One screen showing every live permit, what is isolated, and what expires when. It is the screen the duty officer keeps open.

• Permit board — every live permit and what is isolated
• Raise a permit — the template, the tests, the authorisers
• Toolbox talks — held, signed, filed against the permit
• Risk assessment, reusable and versioned

It would have been faster to ship a permit as a form with seven signature boxes. It would also have been useless: the whole value is that the third box cannot be signed before the second, and a form does not know that.

The invariants are tested in the domain package, so the rule holds identically on a tablet with no signal and on the server when that tablet reconnects.