Permit to Work Software Problems: The 5 That Put People at Risk, and How to Avoid Them

Why does a permit project end up as a digital form instead of a safety control?

Because the form is what everybody can see. The permit office queue at 05:40 is visible, the paperwork is visible, and the obvious improvement is to stop printing, signing, scanning and filing. So the project gets scoped as permit types, fields, signature stages and a mobile view, none of which addresses the failure mode that actually injures people.

Simultaneous operations conflicts are not tag against tag. The jobs that hurt crews share a common drain, a common flare header, a vent stack, a scaffold platform above another live job, a crane radius over an operating unit, or a firewater ring main that one of the permits has depressurised. A permit list cannot see any of that. Neither can a permit to asset link, which is where most electronic systems stop before handing the problem back to a manual review meeting at 06:00. That review meeting is a human reading a printed list, which is precisely the control that failed in the first place.

The fix is a scoping rule set before the first workshop. The first release contains a site model: equipment tags rolled into systems, systems into areas, areas carrying elevation and access relationships, plus the drain, flare and firewater relationships that drive conflict rules. Then when an issuer opens a permit against a tag, the system already knows every other live or planned permit touching that tag, anything on its isolation boundary, anything on the same sump or flare sub header, and anything physically above or below it in the same structure. Forms and workflow sit on top of that. Built the other way round, the model never gets added, because by the time anyone asks for it the budget has gone on permit types.

What goes wrong when you build the site model from your P and IDs?

This is the discovery work that decides whether the project delivers, and it is almost always underestimated because it looks like data entry.

Three things surface. Your equipment register and your P and IDs disagree, usually because the register was built from a construction handover and the drawings have been revised since. Tags exist in the field that exist in no system. And the relationships you actually need, meaning which equipment drains to which sump and which relief paths share a header, are held in drawings and in the heads of two operators rather than in any database.

The second half of the problem is cutover. On the day you go live there are live isolations in the field, some of them long term, applied months ago by a contractor who has left, against a tag number that has since been reused. Migrating those is not a data import. It is a walkdown, and it needs to be planned as one.

What works: scope the model to one unit for the first release rather than the whole site, so the discovery is finite and the learning is real before you commit to the rest. Capture relationships as data with a named owner and a verification status, so an unverified drain relationship is visibly unverified rather than quietly asserted. And treat the isolation register migration as a field exercise with operations, with each existing isolation point re verified, photographed and given a review date as it enters the system. Sites that skip that inherit a register that nobody trusts, and a register nobody trusts is not a safety control.

Why does the SAP or Maximo link break after go live?

Because functional location and work order data is owned by maintenance planning and changes on their schedule, not yours. A functional location hierarchy gets restructured after a plant modification. A new contractor is set up with a different work order type. A planner starts using a notification where they previously used an order. Every one of those is routine maintenance system housekeeping and every one of them can silently break the link that tells the permit office which job a permit belongs to.

The symptom is not an error message. It is duplicate data entry returning, because the issuer cannot find the work order and types the details in to keep the queue moving. Once that starts, the electronic record has a gap and adoption erodes from the permit office outward.

The realistic integration is narrow and defensive. Work order and functional location reference in, permit status out, so the planner can see whether a job is permit ready. Store the maintenance reference as an attribute with a validity check rather than as your own key, and run a scheduled reconciliation that routes orphaned references to a named person. Do not attempt to run permits inside the maintenance system itself, because the approval and isolation logic does not fit there.

What happens when the shadow paper process is not eliminated?

Every site has grown its own control of work standard, usually after an incident. Hot work in a classified area needs the area authority plus a fire watch nomination plus a recent gas test. Confined space entry needs a rescue plan and a named standby person. Night shift extension is cold work only. Contractor supervisors can request but never issue.

Configurable workflow engines get you close, then force a compromise on the last part of your standard, and the compromise always moves toward the vendor's model. Sites respond by running the exceptions on paper, so the electronic record is now incomplete in exactly the permit types unusual enough to need special handling, which are the ones an investigator will ask about.

The fix is expressing permit types, fields, signature stages and escalation rules as data rather than code, so your health and safety lead can change a rule without a release. Validity windows and shift handover behave the way your standard says. Then audit for the shadow process deliberately: count permits issued on paper each month and treat a non zero number as a defect in the software rather than a discipline problem in the field.

Should you build custom or configure what you already own?

Buy if you are a single plant issuing under about ten permits a day with one permit issuer and no turnaround larger than a few dozen contractors. Damstra and the entry tiers of the larger platforms will digitise your form properly, and a custom build would be an expensive route to a better PDF. We would tell you that in the first conversation and we have.

Comply, rather than build, if you are a group site being told to standardise on a corporate Enablon or Sphera instance. Fighting that is a political project, not a software one. The productive move is to get your site's exceptions properly represented in the corporate configuration.

Enablon Control of Work and Sphera Control of Work are credible platforms and if your site is happy inside their permit model you should stay there. Build when the coordination logic between permits, isolations and areas has become the actual safety control on your site. The practical signals are these: several area authorities issuing in parallel, conflicts that depend on someone remembering how systems connect, an isolation register that is paper or a spreadsheet with long term isolations older than a year, a shadow paper process for permit types the package cannot express, or a turnaround permit office that delays the 07:00 start every morning. Once that logic is your control, it belongs somewhere you can change it the week after an incident rather than in a vendor backlog.

How do hidden costs get into the quote?

Five items, and they are specific to control of work rather than to software generally.

• Hazardous area rated hardware. Devices taken inside a process unit must suit the area classification, usually intrinsically safe tablets or handhelds. Smaller screens and slower processors than the demo laptop roughly double field application effort.
• Offline synchronisation. There is often no reliable coverage at the far end of a unit, so the field application must work fully offline and reconcile later, with explicit rules about what is permitted offline.
• Site model discovery. Reconciling the equipment register against the P and IDs and capturing drain, flare and firewater relationships is the largest single unknown. Price it after a walkdown rather than against a description.
• Per site rollout. Each additional site is mostly model building and standard reconciliation, and sites insist their standard differs because it usually does. The rules layer must be site scoped from the start.
• Turnaround surge. A system acceptable at 40 permits a day behaves differently at several hundred. Pre approval of routine permit packs, group issue and gate kiosks are features, and features get quoted.

What separates a control of work build that works from one that fails?

Three decisions, all made early.

The first is an append only event log. Every issue, extension, suspension, gas test, isolation application and close is stored as an immutable timestamped event, and corrections are new events rather than edits. An investigator can then reconstruct what was live on a piece of equipment at a given hour in minutes, including concurrent work, which is the question paper systems answer with a guess. It also proves the record was not tidied afterwards.

The second is conflict detection evaluated at issue, not as a report someone can run. If the issuer has to remember to check, you have rebuilt the morning review meeting inside a browser.

The third is isolation points as objects rather than lines in a book. Each carries its energy source, method, applied by, verified by, tag number, drawing reference and photograph. An isolation certificate groups points into a boundary, permits hang on the boundary, and de isolation is blocked while any permit is hung. Long term isolations get review dates and escalate when they pass. Partial de isolation is a first class operation with its own approval, because crews do it whether or not the software supports it, and pretending otherwise pushes it into the dark.

Then settle ownership in writing before kickoff: the repository, the infrastructure accounts and the right to hire anyone else. At Digital Heroes the code is yours from the first commit, and on a safety critical system you should walk away from any supplier who hedges.