Field Operations

Permit-to-Work Systems on Oil and Gas Sites: The Paperwork That Prevents Accidents

The most dangerous work on an oil and gas site is the work that happens without anyone authorizing it. A permit-to-work (PTW) system makes high-risk jobs explicit: what will be done, where, when, who is doing it, and what safeguards are in place. This guide covers how the system works and the roles that run it.

What a permit-to-work is for

A permit-to-work is a formal authorization to perform defined work that carries significant risk. It is not the work instruction. It is the control that sits on top of it. The permit answers the questions that prevent accidents: what will be done, where, when, who is doing it, and what safeguards are in place. The permit is written for one job, one crew, and one time window. When any of those change, the permit changes too.

Without a permit system, high-risk work starts informally. A crew shows up, the work looks straightforward, and nobody writes down the isolations or the gas test. A permit-to-work system forces the conversation before the work starts.

The permit is also a record. Weeks later, when the job file is reviewed after an incident or an audit, the permit shows what was authorized, what was tested, and who signed.

Permit types

Oil and gas sites use permits for the work that carries the most risk:

• hot work
• confined space entry
• work at height
• excavation
• lifting operations
• simultaneous operations coordination

Hot work and confined space entry are the two that most sites see weekly. Both sit on top of their own detailed rules. OSHA requires a hot work permit for hot work on or near a covered process under process safety management, 29 CFR 1910.119(k). API RP 2009 is the industry reference for safe hot work on tanks and vessels. See the hot work guide for the full procedure.

The list grows with the site. A wellsite with trucks coming and going adds lifting and simultaneous operations permits. A tank farm adds confined space entry. The permit types follow the work, not the other way around. On a drilling location, the permit system runs alongside well control, so the crews know what is happening across the site at the same time.

Roles: issuer, performer, area authority

Three roles run the system:

• the permit issuer: an authorized, competent person who knows the plant and the work
• the performer: the crew lead who accepts the permit
• the area authority: the person who controls the space where the work happens

The permit is issued, accepted, and later handed back. The issuer checks the job, confirms the safeguards, and signs. The performer accepts it only if it matches the work in front of the crew. The area authority holds the space and coordinates anything else happening nearby.

The issuer and the performer are the two signatures that matter. If the performer cannot read the permit back, the permit does not get accepted.

What the permit carries

The permit documents the essentials:

• job scope and location
• date and valid time window
• hazards identified
• isolation and lockout/tagout measures
• gas test results
• PPE requirements
• fire watch and emergency arrangements
• the signatures of issuer and performer

Isolation and gas testing are the two that matter most on a tank or vessel job. The lockout/tagout measures stop energy from reaching the work. The gas test confirms the atmosphere is safe to work in. Both belong on the permit before any tool is picked up. See the lockout/tagout guide for the isolation procedure. The gas test is recorded on the permit with the time it was taken, so the next shift can see when the atmosphere was last checked.

The signatures close the permit out. The issuer signs to authorize. The performer signs to accept. The area authority signs to confirm the space is controlled. Three signatures, one job.

Time limits and handback

A permit is time-limited. It expires at the end of the shift or the window on the permit, and any change in scope or conditions voids it and requires a new assessment. A permit that started at 6 a.m. does not cover the 6 p.m. crew unless it is re-issued for them. A permit is not extended by default. If the work continues past the window, the crew re-assesses and a new permit is issued.

Handback closes the loop. When the job is done, the crew returns the permit, confirming the area is left safe, isolations are restored or removed per plan, and the work area is cleaned up. The permit is filed as part of the job record.

Handback is not a formality. It is the point where the crew confirms the equipment can go back into service, and the next crew knows the space is theirs again.

Making the system stick

A permit-to-work system only works when supervisors refuse to let an unpermitted job start, and crews refuse to accept a permit that does not match the work in front of them. The paperwork is the control, and the control only holds if both sides enforce it. That includes the small jobs. A 15-minute weld is still hot work, and a quick look inside a tank is still confined space entry.

The discipline holds at the wellsite too. Drilling and service crews run the same permits alongside well control procedures, and the same refusal applies: no permit, no work.

The permit file is also part of the job record. Crews that log permits, isolations, and approvals alongside their tickets close jobs out faster, because the same documents feed the field ticket and the invoice. Field service teams track both in one flow with OpsFlo.

Sources and further reading

• OSHA: Process Safety Management overview
• OSHA 29 CFR 1910.119: Process safety management (hot work permit)
• API RP 2009: Safe Welding, Cutting, and Hot Work Practices