Rooftop Valve, 55 km/h Gusts, Two Technicians
Two maintenance technicians are scheduled on Saturday, 08:00-11:00, to replace a failed pressure-relief valve on a rooftop chiller. Access is by a fixed caged ladder. The fall-arrest anchor on the roof was last proof-load tested 14 months ago, and the site standard requires testing every 12 months. The forecast is 42 km/h gusting 55 km/h, and the chiller manufacturer's roof-work limit is 38 km/h. The permit-to-work requires a three-person crew - two technicians plus a safety observer - for any work within 2 metres of the roof edge, and the valve sits 1.4 metres from the edge. The third person called in sick. The plant manager notes the chiller is running at 60% capacity, that a two-day slip risks a EUR 22,000 production loss plus a possible customer penalty, and asks for the job to proceed. Deferral costs nothing else because the chiller can hold reduced load. A scissor lift is on site but the parapet blocks access, and the roof surface is wet from overnight rain.
1. Is this a go or a no-go? Show the criteria you apply and how each constraint scores against them.
Read the worked answer
Criteria. A job proceeds only if every mandatory control is in place; a single failed hard control is a no-go regardless of the others, and cost never converts a failed control into an acceptable one.
- Fall protection: the anchor is 14 months past a 12-month proof-load requirement. No compliant anchor, no work at height. Fail.
- Wind: 42 km/h gusting 55 against a 38 km/h manufacturer limit. Gusts exceed the limit continuously, and a 1.4 m edge distance gives no margin for a lost footing. Fail.
- Crew: permit requires an observer, one person called in sick, no substitute arranged. Fail.
- Surface: wet roof under a fall-arrest scenario adds slip and doubles the chance the arrest system is ever loaded. Aggravating.
Verdict: no-go. Three independent hard stops exist, so the decision does not depend on weighing them against each other. The correct framing for the plant manager is not EUR 22,000 against a schedule, but EUR 22,000 against an uncontrolled fall from height - a fatality-class outcome that no production loss justifies accepting. The chiller's reduced load removes the urgency argument entirely.
2. The plant manager asks you to sign the permit anyway, arguing the observer can be available by phone. What do you say, and what do you do?
Read the worked answer
Say. A phone contact cannot perform the observer function: the observer watches the fall-arrest attachment point, controls access to the edge, calls a stop, and initiates rescue. From a phone they can do none of these. Signing would also put my name on a permit that records a control as present when it is not, which turns a safety error into a falsified record - and that record is the first document inspected after any incident.
Do.
- Decline to authorise, and state the specific failed controls rather than a general objection, so the refusal can be actioned rather than argued with.
- Record the refusal, the reason and the time in the permit system, and notify the operations manager in writing the same day.
- Offer the constructive alternatives: move the job to Monday or Tuesday when wind is forecast inside the limit; book a third person; arrange for a competent person to inspect and proof-load the anchor now, with the certificate before any work.
- Leave the chiller at reduced load with an increased monitoring frequency and a contingency plan if it degrades.
Do not sign a permit with a written exemption written into the margin, and do not let the job proceed on a verbal 'I'll take responsibility'.
3. What would make the job permissible at the next production window, and what must be verified before the crew goes on the roof?
Read the worked answer
Prerequisites. The anchor must be inspected and proof-load tested by a competent person and the certificate issued with a new due date; the crew must be at its permitted strength with a named observer who is on the roof; the work must be rescheduled to a day whose forecast, including gusts, sits inside the 38 km/h limit; and the scissor lift question should be revisited, since a compliant alternative access may remove the edge exposure altogether and is preferable to managing it.
Morning-of verification.
- Weather re-checked against a defined stop threshold, for example gusts above 30 km/h or any lightning forecast, with authority to stop restated in the toolbox talk.
- Anchor certificate sighted, not assumed.
- Surface dried and housekeeping done; drip trays under the work area to keep the roof from rewetting.
- Full fall-arrest kit inspected, with a rescue plan that addresses suspension trauma and names who performs the rescue and how the casualty reaches ground.
- Permit reviewed against actual conditions, observer confirmed present, and the stop-work authority of every crew member confirmed aloud.
If any item cannot be verified at the roof door, the job returns to the planner.