Safe Hands: Digital Permit to Work and Shift Handover – White Paper

Executive summary

A permit-to-work system is a formal process for controlling hazardous work such as hot work, confined-space entry and work on energised equipment.¹
The public inquiry into the 1988 Piper Alpha disaster found serious failings in the permit-to-work system and in communication at shift handover.²
Isolation of hazardous energy before maintenance is a legal requirement in many jurisdictions, for example under the US lockout/tagout standard.³
Digital systems can make every live permit, isolation and handover visible to everyone who needs it, and can warn when two jobs clash.
Digital tools support, but do not replace, competent people and a strong safety culture.

1. Why permits and handovers matter

Most of the time a plant runs as designed. The riskiest moments are when that design is deliberately interrupted: equipment is opened, isolated, entered or worked on hot. Permits exist to control those moments. Shift handover is when knowledge of them is most easily lost, because the people who set up the work go home and others take over.

Established

The Piper Alpha inquiry identified weaknesses in the operation of the permit-to-work system and in the transfer of information between shifts among the factors behind the disaster, which killed 167 people.²

2. What a good permit system does

The UK Health and Safety Executive’s guidance HSG250 describes the essential features of a permit-to-work system.¹ In summary, it should:

Clearly identify the work, the location and the equipment involved.
Identify hazards and the precautions required, including isolations and gas testing.
Define who requests, authorises, issues and accepts the permit, and their responsibilities.
Control how permits are suspended, handed over between shifts and closed out.
Ensure the plant is returned to a safe state before normal operation resumes.

3. Where paper systems struggle

Visibility. The full picture of live permits sits in a rack or a binder in one control room.
Clashes. Two permits for incompatible work in the same area can both be valid on paper.
Isolation status. Whether an isolation is applied, verified or removed may depend on a tag and a memory.
Handover. Status is passed on verbally or in free-text logbooks.
Audit. Reconstructing who approved what, and when, after an incident is slow.

4. What digital adds

Templates and job safety analysis so each permit type starts from agreed hazards, precautions and protective equipment.
Defined approval steps with the right roles, for example safety review followed by plant review.
Isolations and gas tests recorded against the permit, with apply, verify and remove steps.
A live view of every active, suspended and pending permit by area.
A complete audit trail of every status change, with user and time.

Isolation steps reflect the principle behind lockout/tagout requirements: hazardous energy must be isolated and verified before work begins, and restored only under control.³

5. Detecting clashing work

Simultaneous operations are a recurring source of incidents. A digital system can compare each new permit with those already open and flag overlaps: the same machine, the same unit or area, or contradictory work types such as hot work near confined-space entry or work involving flammables. Clashes can then be resolved, the work rescheduled, or the risk explicitly accepted by an authorised person — with that decision recorded.

6. Making handover formal

Handover works best as a structured record, not a conversation alone. The outgoing shift submits a handover listing open permits, isolations in place, abnormal conditions and outstanding tasks; the incoming shift reviews and formally accepts it. Both are timestamped, so it is always clear who was responsible at any moment.

7. People still make it work

Design principle

Software should make the safe path the easy path — but authorisation, site inspection and judgement remain human responsibilities. Training, competence and supervision are as important as the system itself.¹

8. How inShift implements it

Permit types, templates, checklists and job safety analysis templates, with central hazard and protective-equipment lists.
Two-stage approval (safety review, then plant review) with approve, reject and return.
Isolations applied, verified and removed; gas tests recorded on the permit.
Issue, activate, suspend, revalidate, resume, revoke and close, with checkpoints along the way.
Automatic clash detection rated critical, medium or low.
Shift logs and formal handover with acceptance, plus a full audit log.

9. Conclusion

Permit to work and shift handover are where good process and human attention matter most. Lessons from past accidents point to the same needs: visibility, control of isolations, clear responsibilities and reliable communication between shifts. inShift was designed around those needs.

References

Health and Safety Executive (2005). Guidance on permit-to-work systems: A guide for the petroleum, chemical and allied industries (HSG250). HSE Books. https://www.hse.gov.uk/pubns/books/hsg250.htm
Cullen, The Hon. Lord (1990). The Public Inquiry into the Piper Alpha Disaster (Cm 1310). HMSO, London.
Occupational Safety and Health Administration (1989). 29 CFR 1910.147 — The control of hazardous energy (lockout/tagout). U.S. Department of Labor. https://www.osha.gov/laws-regs/regulations/standardnumber/1910/1910.147

This white paper is provided for information. Figures labelled “Established” or “Peer-reviewed” are taken from the cited sources; figures labelled “Industry claim” have not been independently verified by LIDAVI; anything labelled “Design target” or “Hypothesis” is LIDAVI’s own and must be confirmed in a site-specific feasibility study. Nothing here is a performance guarantee.