The Permit Register With a Cancellation Rate of Zero

A confined space permit gets written at 06:20. The space is isolated, the blinds are in, the meter reads clean at four points, and the unit next door is down for a tie-in. The entry supervisor signs. Twelve hours later the same permit comes off the board marked complete.

Somewhere inside those twelve hours the neighbouring unit came back up and started a purge forty feet away. Day shift handed to night shift. The scope crept from a visual inspection to grinding on an internal weld, because once the crew was inside it seemed wasteful not to. None of that is on the permit. The permit still describes 06:20.

Nobody falsified anything. That is what makes it worth looking at.

Cancellation is a sensor, not paperwork

In United States general industry, the confined space rule does not treat a permit as a document that runs until the job is done. Under 29 CFR 1910.146(e)(5), the entry supervisor must terminate entry and cancel the permit when entry operations are completed, or when “a condition that is not allowed under the entry permit arises in or near the permit space.” Two triggers. Most registers only ever record the first one.

The rest of the standard makes clear this was not meant to be a rare event. 1910.146(f)(9) and (f)(10) require the permit to state the acceptable entry conditions and to carry the results of initial and periodic tests, with who tested and when. 1910.146(d)(5)(ii) requires the employer to test or monitor “as necessary to determine if acceptable entry conditions are being maintained during the course of entry operations.” And 1910.146(i)(6) puts a standing duty on the attendant to determine, whenever responsibility for the entry is transferred and at intervals set by the hazards, that operations remain consistent with the terms of the permit.

Read those together and the permit is not a licence. It is a hypothesis with a test schedule attached. Cancellation is what happens when the test comes back negative.

So a register with thousands of permits and no cancellations is telling you one of two things. Either conditions on your site never once departed from what was written at issue, or nobody is looking. On a running plant with weather, shift change, adjacent work and scope creep, the first is not credible.

The hot work version is older and blunter

Hot work has the same structure and the same failure. In United States general industry, 29 CFR 1910.252(a)(2)(iv) says that before cutting or welding is permitted, “the area shall be inspected by the individual responsible for authorizing cutting and welding operations,” who then designates precautions, preferably as a written permit. An inspection. Singular. At a moment. The standard’s only explicit look forward in time is the fire watch under 1910.252(a)(2)(iii)(B), which “shall be maintained for at least a half hour after completion of welding or cutting operations to detect and extinguish possible smoldering fires.”

The gap between the inspection and the fire watch is the entire job, and the standard does not fill it. The CSB does. Among the seven key lessons it draws from its hot work investigations, the Board’s guidance is to conduct gas monitoring “prior to and during hot work activities, even in areas where a flammable atmosphere is not anticipated” (CSB, Safe Hot Work Practices). During is the word doing the work.

The 2017 explosion at a Louisiana pulp and paper mill is the shape of the problem. Contract workers tested for a flammable atmosphere with a gas detector outside a foul condensate tank before starting hot work on piping above it. The condition that killed three of them was inside the tank, where turpentine had accumulated over months and where non-routine shutdown conditions had let in more air than usual (CSB final report release, 24 April 2018). The test was real. It was just a test of a boundary that had moved.

What a mid-shift reassessment actually looks like

Not a stand-down. Not a form. It is short, it is scheduled, and it has an owner.

The attendant or fire watch reads the permit’s stated conditions back out loud against what is in front of them, at fixed intervals and at every handover: isolation still proven, atmosphere still inside the stated band, adjacent work still what it was, weather still within the assumption, scope still the scope. Anything that has moved gets written on the permit face with a time. If a stated condition no longer holds, the permit is cancelled and reissued. Reissue takes ten minutes and is the cheap outcome.

Then the register should show it. Under 1910.146(d)(14), cancelled permits retained under (e)(6) are the designated dataset for the annual programme review. The rule already assumes cancellations are the raw material of learning. A file of clean closures gives the reviewer nothing to review.

A healthy register has a cancellation and reissue rate that is small but not zero, clustered where you would expect: shutdowns, weather, multi-shift jobs, work adjacent to live systems. It has permits with more than one atmospheric reading on them. It has permits closed early with the job unfinished.

The point is not that your issuers are careless. It is that a permit system with no cancellations has quietly redefined itself from a control into a record. Controls fail loudly. Records fail silently, and they close out on time.