Hot work permit
when it is required and what it must control

Welding, cutting, grinding, brazing, soldering, thermal spraying — any job that makes a flame, an arc or a shower of sparks. The permit exists because the fire almost never starts where the sparks land: it starts in the void below, in the drain, behind the panel, hours later.

What counts as hot work

The trade does not decide; the ignition source does. If the job can produce a flame, an arc, a hot surface or flying sparks, it is hot work, whoever is holding the tool.

Two of those surprise people regularly. A grinder is treated as a minor tool by everyone except the fire that follows it. A pickup truck driven up to a live wellhead is an ignition source on wheels, and most operators permit it as such.

What the permit has to control

Before the signature. Test the atmosphere with a calibrated instrument, and record the reading with the time and the tester’s name. Isolate and drain the equipment, and prove it — a valve labelled shut is not a valve proved shut. Remove combustibles within 11 m (35 ft) or protect what cannot be moved with fire blankets and screens. Cover or seal drains, ducts, floor openings and cable trays: these are the routes that carry sparks to the fire.

During the work. Keep the fire watch on the job with extinguishing equipment to hand and no other duties — a watch who is also holding the torch is not a watch. Re-test when conditions change, when the job is left, and at whatever interval the permit specifies. Stop on any change in the plant nearby: a vent that starts breathing, a level that starts moving, a smell.

After the last spark. Keep the watch in place for the full period the permit states, then inspect the far side of every wall, floor and pipe the heat could have reached. Close the permit formally and hand back the equipment. Most hot work fires are discovered after the crew has left, in the space no one looked at.

The fire watch: how long, and why the numbers differ

This is the single most misquoted number in the field.

Half an hour was the old habit; it is no longer good practice anywhere. Smouldering insulation, a slow char inside a cable tray or a rag in a drain can take far longer than thirty minutes to declare itself. If your site standard still says thirty minutes, the question worth asking is when it was last revised.

The gas test: the reading that carries the permit

Everything else on the form is protection; the gas test is proof. It answers one question — is there anything here for the spark to find — and it only answers it for the moment the sample was drawn.

What a defensible gas test looks like in practice:

• A calibrated instrument with a current bump-test. A detector that has not been challenged with test gas recently gives a number, not a reading. Auditors ask for the calibration record before they ask for the result.
• The right point, not the convenient point. Sample where the work will happen and where vapour would collect — low for heavier-than-air hydrocarbons, inside the vessel rather than at the manway, in the dead leg rather than at the open flange.
• A named tester and a time. The signature belongs to the person who drew the sample. A reading without a time cannot be judged stale, which means it must be treated as stale.
• A validity window. The permit states how long the reading holds and when re-testing is due: after breaks, after any process change nearby, and at the interval the site standard sets. On a live plant the atmosphere is a moving target; the test is a snapshot, and the permit must say how old a snapshot it will accept.

The number most operators write for hot work is simple: no detectable flammable gas at the point of work, and combustibles in the surrounding atmosphere below 10 % of the lower explosive limit — the level at which OSHA’s confined space rule already calls an atmosphere hazardous. If the reading will not stay there, the answer is not a bigger fire watch; it is a different job plan.

Special cases the form rarely draws for you

Tanks and vessels that have held product. Gas-free at the start is not gas-free for the day: sludge, scale and coatings give vapour back as they warm. This is where hot work and confined space entry meet, and where both permits apply at once — the entry permit for the atmosphere, the hot work permit for the ignition source.

Work at height over a live unit. The 11 m (35 ft) radius is drawn on the floor, but sparks fall further than they fly. Grinding on a platform means the clearance zone is below the work, on whatever the sparks can reach — and the fire watch belongs down there, where the fire would start, not at the welder’s elbow.

Coated and lined steel. Cutting through paint, rubber lining or insulation adds a second fire that the gas test never saw: the coating itself. Old lagging soaked in oil is the classic slow burn — it chars quietly inside the cladding and shows itself hours after the watch stood down. If the torch is going through insulation, the permit should say what happens to the lagging first.

Vehicles and temporary engines. Welders’ diesel sets, compressors and pickups brought into a process area are hot work that arrives on wheels. The controls are the same — position them upwind, outside the clearance radius, with the exhaust pointed away from any vent — and the permit is where that positioning is recorded.

How the requirement is written in different countries

The engineering is the same everywhere. The paperwork has local names.

Where an international contractor works to two systems at once — its own and the client’s — the rule that survives audit is simple: apply whichever requirement is stricter, and write down which one you applied.

Where hot work permits fail

Not on the form. In the same five places, year after year:

• the gas test is recorded but was taken an hour earlier, or in the wrong place — at the manway rather than inside the vessel;
• combustibles are cleared in the line of sight and left in the space below, where sparks actually fall;
• the fire watch is given a second job, or leaves with the crew;
• the permit is extended by signature without a fresh test;
• nobody closes the permit, so the isolation stays in the field and the next shift inherits a live hazard.

Every one of these is visible in the record afterwards. That is why the record matters as much as the control: the permit is the only evidence that the check happened at all.

Frequently asked questions