The U.S. Chemical Safety Board, after reviewing fatal process incidents, concluded that none of them happened because operators ran out of time to think. In each case, there was time, but it wasn’t used. That finding, buried in a federal safety bulletin from 2001, is still the most uncomfortable sentence in process safety, because it means the usual excuses don't hold.
The incidents the Board was looking at didn't start with a reckless worker or a collapsed procedure. They started with a change that was supposed to be temporary. A valve swapped out. A line rerouted for a shift.
A permit written for four hours that stretched to twelve without anyone noticing. That kind of oversight is a recurring factor in serious incidents, where work continues beyond its original scope without proper reassessment or authorization.
The Temporary Fix Is the Pattern, Not the Exception
Walk any plant long enough and you'll find the hose that was supposed to be there for the weekend, still there at year's end. A jumper cable someone ran on a Tuesday. A chained-open valve, and above it, a handwritten sign taped over the gauge. Each one started as a reasonable response to a real problem. None of them went through a formal review, because formal review felt like overkill for something that would be gone by Monday.
Nobody deferred the analysis under duress; they deferred it because the change looked small. A disciplined approach to this problem is what a management of change process is for: catching the modifications that don't feel big enough to warrant paperwork and treating them as the live risks they are.
A Permit Is a Promise About a Window of Time
Every work permit, hot work, confined space, lockout, line break, carries an unspoken clause: the conditions described in this document are the conditions that will exist for the duration of the work. The gas readings, the isolations, the standby person, the fire watch. All of it is a snapshot.
Snapshots age. A permit written at 7 a.m. describes a plant that no longer exists by lunch. The adjacent unit started up. A tank is now being filled.
The wind shifted. The welder who was briefed went home sick and the replacement was handed the paperwork without the walk-through. The permit still looks valid. On paper, nothing has changed. In the plant, everything has.
Shift Change Is Where the Thread Snaps
The handover is where temporary changes do their worst damage, because they stop being anyone's clear responsibility. The outgoing crew knows what they did and why, while the incoming crew only knows what the board shows. Between those two things is where the next incident lives.
In many operations, handover preparation is thinner than people assume, and the structured elements that should travel with it — written notes, a walk-around of what changed, explicit confirmation of what is still open — are not consistently present. More forms won't help. A shorter list of non-negotiables, carried through every handover, will.
Expired Doesn't Mean Finished
A permit's expiry time is a hard stop that forces someone to look again, not a prediction about when the work will end. That is the entire point. If gas readings have to be retaken, if the fire watch has to be re-briefed, if the isolation has to be re-verified, the time pressure of "we're almost done" is exactly the pressure the expiry is designed to resist.
The failure mode is familiar. The crew is forty minutes from finishing. Renewing the permit means stopping, finding the issuer, re-testing.
So the work continues and the paperwork catches up later, or doesn't. The conditions that were true at 7 a.m. are now assumed to still be true at 3 p.m. Sometimes they are. The incident reports are written about the times they weren't.
The Warning Sign Is a Fix That Won't Leave
One of the clearer indicators that a change program isn't working is a temporary fix that outlives its intent. If the clamp has been on the line for six months, it is no longer a clamp. It is the line. Treat it that way, with the engineering review, the drawings update, and the risk assessment that any permanent change would get.
The question worth asking at every morning meeting is small and specific. What is still in place from last week that was only supposed to be here for a day? Which permits were renewed, and were conditions actually re-verified, or did somebody initial the box? If the answers are vague, the next serious event has already started. The reports will note the exact moment later.
Founder & Editor at Durofy
