The Permit Says Clean. That Was Six Hours Ago.

A permit for a tank entry shows one atmospheric reading, timestamped 7:45 AM: 20.9% oxygen, 0% LEL, 0 ppm H2S. The crew enters at 8:00, applies an interior epoxy coating starting around 9:30, and exits at 2:10 PM. The permit’s atmospheric-testing block has exactly one line filled in. Nobody re-tested the air for the six hours that followed the first reading, and the paperwork does not say anyone was supposed to.

That permit will pass most internal audits. It shouldn’t.

What the standard actually says

Federal OSHA’s permit-required confined space standard splits atmospheric evaluation into two separate duties, not one. Under 29 CFR 1910.146(d)(5)(i), the employer must “test conditions in the permit space to determine if acceptable entry conditions exist before entry is authorized to begin.” That’s the pre-entry number everyone’s permit captures.

The second duty sits in 1910.146(d)(5)(ii), and it doesn’t end when the first duty is satisfied: the employer must “test or monitor the permit space as necessary to determine if acceptable entry conditions are being maintained during the course of entry operations.” That’s a continuing obligation for the length of the entry, worded independently of the pre-entry test.

OSHA does draw one bright line on continuous monitoring: under (d)(5)(i), if isolating the space is infeasible because it’s large or part of a continuous system, such as a sewer, pre-entry testing is done “to the extent feasible” and entry conditions in the areas where people are working must then be continuously monitored. That’s an explicit continuous-monitoring trigger tied to a specific fact pattern (large or continuous spaces), not a general rule for every permit space.

For the more common case, an isolable, single-access space, the standard doesn’t hand employers a fixed retest interval. A 1999 OSHA standard interpretation letter confirms the type and frequency of testing depends on “the hazards that are present within the space,” not a boilerplate schedule, and reiterates that the testing sequence, oxygen, then combustibles, then toxics, matters because most combustible and toxic sensors don’t read accurately in an oxygen-deficient atmosphere. A 2014 interpretation letter on centralized monitoring systems draws the same line the regulatory text draws: it treats pre-entry testing and ongoing monitoring during entry as two different compliance questions, and requires that whatever system is used during entry be “capable of alerting the entrants quickly enough” for immediate evacuation. The obligation to keep testing doesn’t disappear because the space is small enough to isolate. It just isn’t pinned to a clock.

That’s not a loophole. It’s a judgment call the standard leaves to the employer, based on the hazards actually present, and it’s exactly the call most programs never make on paper.

What changes in six hours

“As necessary” is not a synonym for “never.” A space that reads clean at 7:45 can stop reading clean by 9:30 for reasons that have nothing to do with whether the first test was done correctly.

Ventilation is the most common failure mode: a duct kinks, a blower trips a breaker, a fan gets unplugged so a cord can reach a grinder, and the forced-air supply that diluted the space during the pre-entry test simply stops. Work itself is often the hazard generator. Hot work consumes oxygen and produces carbon monoxide. Coatings, adhesives, and solvents off-gas flammable or toxic vapors as they cure, often building over the course of hours rather than appearing instantly. Cleaning chemicals can react with residue in the vessel. Engulfment materials, sludge, grain, decomposing organics, can release trapped gas as they’re disturbed. Purge or inert gases used elsewhere in a facility can migrate into a space that was never the intended target: a 1988 NIOSH FACE investigation traced a fatal oxygen-deficient atmosphere in a steel mill service area to an undetected leak in nearby argon piping, gas that had nothing to do with the task at hand and everything to do with what was happening elsewhere in the plant at the same time.

NIOSH’s own confined-space fatality research is blunt about the pattern this produces. In its analysis of 16 confined-space deaths, the agency concluded that “confined spaces should be tested prior to entry and continually monitored,” and that had the spaces “been properly evaluated prior to entry and continuously monitored while the work was being performed,” none of the deaths would have occurred. OSHA’s own public guidance repeats the same two-part framing verbatim: tested before entry, and continually monitored after. Neither agency treats the pre-entry reading as sufficient on its own. The gap is what happens after it.

Where programs quietly fail the second half

Ask most EHS managers whether their confined-space program complies with (d)(5), and they’ll point to the atmospheric test block on the permit and the instrument calibration log. Ask whether the program complies with (d)(5)(ii) specifically, and the answer usually depends on a form field that doesn’t exist: most permits have one line, sometimes two, for atmospheric readings, and no structured place to log a third, fourth, or tenth. When the form has no space for ongoing readings, ongoing readings tend not to get logged, whether or not they were taken.

That’s the failure worth auditing for. Not whether the crew owns a multi-gas meter. Not whether the pre-entry number was recorded correctly. Whether the permit, as a document, can actually show that someone checked the air again after the work started changing what was in it.

A clean pre-entry reading tells you the space was safe to start in. It says nothing about whether it stayed that way, and under (d)(5)(ii), knowing that is not optional. It’s the second half of the same requirement most programs only do the first half of.