The Permit That Outlived Its Hazards
A maintenance crew of four is scheduled to enter a 2.4 m deep sump at a food-processing plant to clear a rag blockage. The confined-space entry permit was raised at 07:00 and lists oxygen, flammable gas and hydrogen sulphide as the monitored hazards. Monitors read 20.8% O2 and zero for both gases. At 10:30 the process supervisor, without telling the entry team, starts a CIP (clean-up-in-place) cycle on an adjacent line whose caustic tank vents into the same sump through a shared drain. The entrant is inside with a harness and tripod but no supplied air; the attendant is at the top. At 10:45 the entrant reports stinging eyes and a sore throat but says the monitor still reads normal. The permit has no expiry time written on it and the attendant has not re-tested since 07:15.
1. Identify the control failures in this entry and rank them by how quickly they could kill someone.
Read the worked answer
Rank by time-to-harm, not by how obvious they are.
1. Change in process conditions not captured by the permit (fastest killer). A caustic/CIP cycle venting into the space is exactly the kind of change that invalidates a permit. Caustic mist and vapour can injure the airway within minutes and may not register on an O2/LEL/H2S monitor at all. The monitor reading 'normal' is being read as 'safe' when it only means 'safe against three specific gases'.
2. No permit expiry / no re-test regime. A permit with no stated validity and no periodic re-test is a piece of paper, not a control. Atmospheric conditions in a sump change with every upstream discharge.
3. No supplied air for a space with a known potential for irritant or toxic atmospheres. Harness and tripod only help retrieval; they do not protect the airway.
4. Communication break between process and maintenance. The supervisor's change was legal in isolation but lethal in combination. Permit systems fail at the interface between operations and maintenance.
5. Attendant's role diluted. If the attendant is not empowered to stop the job and pull the entrant on symptom report, the post is decorative.
2. The entrant is symptomatic but the monitor is clear. What is the correct immediate decision and what should happen in the next 30 minutes?
Read the worked answer
Decision: evacuate now. Symptoms trump instruments. The entrant should exit (or be hauled out) immediately, the space should be cleared, and the CIP cycle should be stopped and the drain isolated before anyone goes back in.
Next 30 minutes:
- Move the entrant to fresh air, sit them down, and assess: eyes, throat, breathing, cough. If there is any breathing difficulty, hoarseness or persistent cough, treat as a chemical exposure and get medical assessment - do not let them 'walk it off'.
- Decontaminate: irrigate eyes with clean water for at least 15 minutes if there was any splash or mist exposure.
- Preserve the evidence: note the CIP start time, the line involved, the drain route, and the monitor readings and calibration date.
- Suspend the permit, mark it 'invalidated - process change', and do not re-issue until the drain is isolated and the atmosphere is re-tested after the CIP has finished and the space has been purged.
- Notify the process supervisor and the permit issuer; the root issue is that a change was made without a management-of-change step.
The teaching point: a multi-gas monitor is a control for the gases it is set for. It is not a general safety instrument.
3. Rewrite the permit and entry controls so this cannot recur, and say how you would verify each control actually works.
Read the worked answer
Permit content:
- Named entrants, attendant and supervisor; explicit start and expiry times (e.g. 07:00–11:00, renewable only after re-test).
- Identified hazards including potential process discharges, not just the three monitored gases.
- Isolation list: which drains, valves and lines are locked out, by whom, with tag numbers.
- Re-test interval (e.g. every 30 minutes and after any process change) with the reading recorded and signed.
- Rescue plan with equipment named and checked.
- Stop-work authority written on the permit for the attendant.
Verification:
- Audit a sample of permits weekly against the isolation list - does the tag match the permit?
- Spot-check that re-test intervals were actually met (timestamps, not just a tick).
- Test the management-of-change route: can a process supervisor start a CIP on an adjacent line without a permit review? If yes, the control is not real.
- Drill the rescue: time from 'entrant down' to extraction.
- Review monitor calibration records against the permit dates.