UK Health and Safety Executive research into chemical industry accidents found that around a third were maintenance-related — and the largest single cause was a failure or deficiency in permit-to-work systems. That finding is the foundation of the HSE’s permit-to-work guidance (HSG250), and it should tell any rig supervisor why the PTW system is not paperwork for paperwork’s sake. It is the last administrative control standing between a routine maintenance task and a fatality.
This guide breaks down how the PTW system actually functions on a working rig: hot work permits, confined space entry, electrical isolation, LOTO, and SIMOPS — and how to run them so they hold up under audit and, more importantly, under real conditions.
Key Takeaways
| Question | Answer |
|---|---|
| What is a permit to work system? | A formal, documented process that authorizes specific high-risk tasks (hot work, confined space, electrical isolation) only after hazards are identified and controls verified. |
| Who signs the permit? | The issuing authority (usually the OIM, rig manager, or designated authority) and the performing authority — both carry accountability for what’s written on it. |
| Is LOTO negotiable? | No. Every stored energy source — electrical, hydraulic, pneumatic, or mechanical — must be isolated and physically locked before work starts. See rig safety systems. |
| How are SIMOPS managed? | With a documented compatibility matrix, not memory, before two crews work near each other in the same permit period. |
| What does hot work always require? | A fire watch and a gas test, every time — even for a five-minute grinding job. More detail in the rig welding guide. |
| Do permits expire? | Yes. A shift change, a gas reading change, or a scope change voids an active permit until it’s re-verified. |
| Paper or digital in 2026? | Digital permit systems are becoming standard as operators close the gap between paper permits and real-time isolation status on the BOP and drill floor. |
What Is a Permit to Work System on Drilling Rigs?
A permit to work system is a formalized control document and process that authorizes personnel to carry out a defined task, at a defined location, within a defined time window, under specific safety conditions.
It exists because drilling rigs concentrate multiple hazard categories in a small footprint: pressurized systems, hydrocarbons, rotating equipment, electrical systems, and confined spaces — often all within a few hundred feet of each other.
The permit is not a suggestion. It is a legal and operational record that ties a specific worker or crew to a specific risk assessment, and it becomes the primary evidence reviewed after any incident investigation.
Rigs typically run several permit categories concurrently: hot work, cold work, confined space entry, electrical isolation/LOTO, excavation, and lifting operations. Each has its own hazard checklist, but they all follow the same underlying logic — no work starts until the risks are identified, controlled, and signed off by someone with the authority to do so.
Core Permit Types on the Rig Floor
Not every task needs the same permit. Matching the right permit type to the actual hazard is where most PTW failures start.
Hot Work Permits
Hot work covers any activity that introduces an ignition source — welding, grinding, cutting, brazing, or use of non-intrinsically-safe equipment in a classified area.
On a rig handling hydrocarbons, this is one of the highest-scrutiny permit categories, because the consequence of ignition in a gas-rich atmosphere is catastrophic. Full process detail is covered in the oil rig welding guide, with certification requirements on the welding certifications page.
Confined Space Entry Permits
Confined space entry applies to tanks, mud pits, cellars, void spaces, and any area with restricted entry/exit and the potential for oxygen deficiency or toxic gas accumulation.
These permits require continuous atmospheric monitoring, a standby attendant, and rescue equipment staged at the entry point before anyone goes in. Where H₂S is possible, the H₂S detection and safety protocols apply on top of the permit requirements.
Electrical Isolation and LOTO Permits
Electrical isolation permits authorize work on or near energized systems, and they are inseparable from lockout/tagout (LOTO) procedure.
The permit identifies every energy source — electrical, hydraulic, pneumatic, mechanical, stored — and confirms each has been isolated, locked, and verified de-energized with a zero-energy check before work begins.
SIMOPS Permits
Simultaneous operations (SIMOPS) permits apply when two or more incompatible activities are scheduled at the same time in overlapping areas — for example, crane lifting operations running alongside well control activity.
A SIMOPS permit requires a documented compatibility assessment, sometimes called a SIMOPS matrix, that maps which activities can run together and which cannot.
How to Complete a Permit to Work Correctly: Step-by-Step
Filling out a permit correctly is a sequence, not a form-filling exercise. Skipping steps — even ones that feel redundant — is how gaps get introduced.
- Define the task scope precisely. Vague descriptions like “maintenance work” are not acceptable; state the exact equipment, location, and activity.
- Identify all hazards specific to the task and location. Cross-reference against equipment documentation, especially for pressure-containing systems like the BOP stack.
- Isolate energy sources and apply LOTO devices. Every isolation point gets its own lock and tag, tied to the individual performing the work — not a shared department key.
- Conduct atmospheric testing where applicable. Confined space and hot work permits both require gas testing before entry or ignition source introduction, and periodic re-testing during the job.
- Verify competency of the workforce. Confirm certifications match the task, particularly for welding, rigging, and confined space rescue roles — see the certifications overview.
- Check for SIMOPS conflicts. Review the daily operations schedule before signing to confirm no incompatible activity is running concurrently in the same zone.
- Obtain authorization signatures. The issuing authority signs only after physically verifying conditions on location, not from the office based on a verbal report.
- Display the permit at the worksite. It must be visible and accessible for the duration of the job.
- Close out and cancel the permit. Once work is complete, isolations are removed, LOTO devices come down in reverse order, and the permit is formally closed and archived.
Hot Work Permits: Requirements and Common Pitfalls
The single most common failure with hot work permits is treating short-duration jobs as exempt from full procedure. A two-minute grind still needs a fire watch, a gas test, and a signed permit.
Requirements typically include:
- Gas testing immediately before work starts, and at defined intervals during the job
- A dedicated fire watch with extinguishing equipment on standby for the full duration, plus a defined period after work stops
- Removal or shielding of combustible materials within the hot work radius
- Confirmation that the area is not within a classified zone unless specifically rated equipment is used
Confined Space Entry: Verification and Monitoring
Confined space permits fail most often on re-verification. Atmospheric conditions can change minutes after the initial test, particularly in mud pits or tanks with residual hydrocarbon vapor.
A properly completed confined space permit specifies continuous or periodic monitoring intervals, not a single test at entry. It also names a standby attendant who never leaves their post and has direct communication with both the entrant and emergency response.
A confined space permit with a gas test timestamp from three hours earlier is not a valid permit. It’s a liability.
Electrical Isolation and LOTO: Locking Out Stored Energy
Stored energy is one of the major hazard categories on any rig, alongside H₂S and dropped objects, as outlined on the rig safety hazards page.
A correct LOTO procedure on an electrical isolation permit includes:
- Identification of all isolation points, primary and secondary
- Application of individual locks by each worker exposed to the hazard (group lockout boxes for larger crews)
- A zero-energy verification check performed and documented before hands-on work starts
- A clear removal sequence, with locks removed only by the person who applied them
Mechanical stored energy — springs, pressurized accumulators, suspended loads — needs the same rigor as electrical isolation and should never be treated as a lower-tier hazard on the permit.
Managing SIMOPS Under the Permit to Work System
SIMOPS failures happen when permits are issued in isolation from the daily operations plan. A crane lift permit and a well control operation permit issued independently, without cross-reference, can put personnel in the same footprint at the same time without either supervisor realizing it.
The fix is a SIMOPS matrix reviewed at every shift handover, listing which task combinations are compatible, which require additional controls, and which are prohibited outright. This matrix should be a standing agenda item at the pre-tour safety meeting, not an afterthought when a conflict is noticed on the floor.
Common Permit to Work Failures on Rig Floors
Most PTW breakdowns fall into a small number of repeatable patterns, and recognizing them is the fastest way for a supervisor to prevent them.
| Common failure | Why it happens | Prevention |
|---|---|---|
| Permit issued without site verification | Signed off remotely based on verbal description | Require issuing authority to physically inspect location before signature |
| Expired permit still in use | Shift change occurs without permit renewal | Automatic expiry tied to shift boundaries, mandatory re-issue |
| Incomplete hazard identification | Generic checklist used instead of task-specific assessment | Task-specific hazard review required at every issuance |
| LOTO devices removed early | Pressure to complete job ahead of schedule | Locks removed only by the applying worker, verified by supervisor |
| SIMOPS conflict undetected | Permits issued without cross-referencing daily ops schedule | Mandatory SIMOPS matrix review before permit approval |
Did you know? The UK HSE’s study of chemical industry accidents that led to HSG250 found permit-to-work failures were the largest single cause of maintenance-related accidents — ahead of equipment failure and training gaps.
Best Practices for Rig Supervisors Running a Permit to Work System
Supervisors carry the operational weight of the PTW system, and a few habits separate crews that run it well from crews that treat it as a formality.
- Walk the site before signing. Never authorize based on a description alone.
- Hold a pre-job briefing for every permit-controlled task. Confirm the crew understands the scope, hazards, and isolation points — not just that they read the form.
- Track all active permits on a live board. Paper systems should still have a central status board visible to the entire crew.
- Audit closed permits periodically. Review completed permits for gaps in documentation, not just incidents.
- Cross-train crews on permit categories. A roughneck who understands why a confined space permit requires continuous monitoring is less likely to bypass it under pressure.
Reference material like the drilling glossary is worth keeping close at hand for crews working across multiple operators, since permit terminology and isolation naming conventions vary between companies.
Conclusion
The permit to work system is the procedural backbone that keeps hot work, confined space entry, electrical isolation, and SIMOPS from turning routine maintenance into a major incident. As activity levels and contractor headcounts rise, the margin for a rushed or incomplete permit keeps shrinking.
Getting the PTW system right on your rig means treating every signature as a verified commitment, not a formality — and running the process the same way on a slow Tuesday as during a tight completion schedule. Crews and supervisors who understand this are the ones who keep their people, and their operation, out of the incident report.
Frequently Asked Questions
What is a Permit to Work (PTW) system on a drilling rig?
A Permit to Work system is a documented authorization process that controls high-risk activities like hot work, confined space entry, electrical isolation, and SIMOPS. It requires hazard identification, control verification, and formal sign-off before any covered task can begin.
Who is responsible for issuing a permit to work on a rig?
The issuing authority — typically the rig manager, OIM, or a designated competent person — is responsible for verifying site conditions and signing the permit. They remain accountable for the accuracy of that permit until it is formally closed.
How does LOTO relate to the permit to work system?
LOTO (lockout/tagout) is the physical isolation procedure that supports electrical and mechanical work permits within the broader PTW system. A permit cannot be validly issued until every energy source is locked, tagged, and verified de-energized.
What makes a hot work permit different from a cold work permit?
A hot work permit covers any task introducing an ignition source — welding, cutting, grinding — in areas where flammable atmospheres may be present, and requires gas testing plus a fire watch. Cold work permits cover lower-risk tasks without ignition potential and generally carry fewer control requirements.
What is SIMOPS and why does it need its own permit process?
SIMOPS (simultaneous operations) refers to two or more potentially incompatible activities happening in overlapping time and space on the rig. It needs its own permit control because standard single-task permits don’t account for the combined risk of overlapping operations like lifting and well control work.
Is a digital permit to work system better than paper permits?
Digital permit systems reduce approval delays and give supervisors real-time visibility into active isolations across the rig, which paper systems can’t match at scale. For rigs managing high permit volumes, digital PTW platforms are increasingly standard — though the verification steps they enforce are the same ones a good paper system requires.
What is the most common cause of Permit to Work failures on rigs?
The most common failure is issuing or continuing a permit without physical re-verification, particularly after a shift change or a change in task scope. Incomplete hazard identification and premature removal of LOTO devices are the next most frequent causes documented in incident investigations.