Safe Work Systems and Operational Control

Introduction

Industrial fires and explosions rarely arise from a single failure. They usually result from the interaction of hazardous materials, energy sources, unsuitable work practices, defective equipment, weak supervision, and ineffective communication. Safe work systems convert general safety intentions into controlled operating arrangements. They specify who may perform a task, what hazards must be controlled, what authorization is required, and how equipment is returned safely to service.

In fire and explosion prevention, operational control is particularly important during non-routine work: maintenance, inspection, commissioning, modification, cleaning, opening of process equipment, and work by contractors. These activities may defeat normal safeguards or introduce ignition sources into areas containing flammable substances. A robust system therefore combines permits to work, isolation and lockout/tagout, hot-work control, confined-space entry, management of change, preventive maintenance, contractor management, pre-startup review, and inspection and testing.

This chapter presents these systems as connected elements of one risk-control process. A permit alone does not make work safe; it is effective only when supported by sound hazard assessment, physical isolation, competent people, supervision, and verification.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Explain the purpose and structure of a permit-to-work system.
2. Apply lockout/tagout principles to hazardous energy sources.
3. Establish controls for hot work and confined-space entry.
4. Explain management of change and pre-startup safety review.
5. Describe preventive maintenance, inspection, testing, and defect management.
6. Identify essential controls for contractors and temporary work.
7. Evaluate the limitations, governance requirements, and practical performance of safe work systems.

1. Safe Work Systems as a Layer of Protection

A safe work system is a documented and supervised method for controlling hazards associated with a task. It normally contains five linked stages:

1. Planning: define the work scope, hazards, resources, and competent personnel.
2. Authorization: approve the work through a permit, work order, or equivalent control.
3. Preparation: isolate energy and process hazards, test conditions, establish barriers, and brief workers.
4. Execution: perform the work within the approved conditions and monitor for change.
5. Restoration and close-out: inspect the work, account for personnel and tools, remove controls in a planned sequence, and return equipment to service.

The system must distinguish between routine work covered by approved procedures and non-routine work requiring additional authorization. It should also identify simultaneous operations, commonly called SIMOPS. For example, welding near a tank-cleaning operation may create an unacceptable ignition risk even if each activity is individually authorized.

A permit is an administrative control. It does not replace elimination, substitution, engineering controls, or physical isolation. The hierarchy of controls remains important: eliminate the hazard where possible; use engineering controls such as ventilation and automatic isolation; establish administrative controls such as permits and procedures; and use personal protective equipment as the final layer.

2. Permit-to-Work Systems

2.1 Purpose and scope

A permit to work is a formal written or electronic authorization for a specified task, location, equipment, and time period. It communicates the hazards and precautions agreed by the work group and the operating authority. Typical permits include:

• hot-work permit;
• confined-space entry permit;
• electrical work or electrical isolation permit;
• line-breaking or breaking-containment permit;
• excavation permit;
• work-at-height permit; and
• radiography or other special-process permits.

A permit should be required when work could expose personnel or plant to fire, explosion, toxic release, oxygen deficiency, unexpected movement, electrical shock, stored pressure, or other significant harm. It should not be used indiscriminately for trivial work, because excessive paperwork can encourage superficial compliance.

2.2 Essential permit information

A technically adequate permit normally states:

The permit must describe the physical boundaries of the job. “Repair pump” is inadequate; “replace mechanical seal on pump P-204 in the west process area” is more useful. Equipment identification should be checked in the field, not assumed from drawings alone.

2.3 Permit lifecycle

The issuing authority confirms that the work is necessary and that the operating area is prepared. The performing authority confirms that workers understand the scope, hazards, and controls. Before work begins, both parties should conduct a joint field verification. A permit becomes invalid when its conditions change, the work is suspended beyond the stated period, an alarm or emergency occurs, or the area is handed over to another operating shift unless formally revalidated.

Permit suspension is essential during alarms, loss of ventilation, deteriorating weather, gas-test failure, or conflicting work. Revalidation requires reassessment; it is not merely a new signature. At close-out, the work group reports completion or outstanding defects, removes tools and waste, and leaves the equipment in a known safe condition.

2.4 Common failures

Frequent weaknesses include copying old permits, signing without visiting the site, failing to identify all energy sources, treating a gas test as permanent, unclear responsibility between operations and maintenance, and allowing permits to remain open after the work has stopped. Audits should examine field conditions as well as paperwork.

3. Lockout/Tagout and Control of Hazardous Energy

Lockout/tagout (LOTO) prevents unexpected energization, start-up, movement, or release of hazardous energy while work is performed. Hazardous energy includes electrical, mechanical, hydraulic, pneumatic, chemical, thermal, gravitational, radiation, and stored pressure or vacuum energy.

3.1 The isolation sequence

A general LOTO sequence is:

1. Identify the equipment, task, and every energy source.
2. Notify affected and authorized employees.
3. Shut down the equipment using the normal control.
4. Isolate energy sources using disconnectors, valves, blinds, or other suitable devices.
5. Apply personal locks and identification tags.
6. Dissipate or restrain stored energy: discharge capacitors, bleed pressure, block elevated parts, drain chemicals, and allow hot equipment to cool.
7. Verify isolation using a suitable test or try-start procedure.
8. Perform the work while maintaining control of the locks.
9. Inspect the equipment, remove tools and personnel, and confirm guards are restored.
10. Remove locks according to the site procedure, notify affected persons, and re-energize in a controlled manner.

The verification step is critical. A locked electrical isolator does not prove that a circuit is dead unless an appropriate, tested instrument confirms absence of voltage. For process equipment, closing one valve may not isolate pressure if another line, bypass, thermal expansion, or reverse flow path exists. Double-block-and-bleed, physical disconnection, or insertion of a blind may be required according to the hazard and facility standard.

3.2 Personal locks and group isolation

Each worker should normally apply an individually identified lock. A supervisor’s lock cannot replace personal control. For group work, an isolation coordinator may place the primary isolation keys in a group lockbox; each worker then applies a personal lock to the box. A worker must never remove another person’s lock except under a documented emergency procedure involving verification, attempts to contact the absent worker, managerial authorization, and notification before return.

LOTO is distinct from merely switching equipment off. “Off” is an operating state; isolation is a verified condition that prevents hazardous energy from reaching the work area.

4. Hot-Work Control

Hot work includes welding, flame cutting, brazing, soldering, grinding, use of non-intrinsically safe electrical equipment, and any activity producing flame, heat, sparks, or hot surfaces. It is a major ignition source in process facilities.

Before hot work, the responsible authority should determine whether the job can be eliminated or moved to a designated workshop. If it must occur in the hazardous area, controls should include:

• removal of flammable liquids, gases, residues, and combustible materials;
• isolation, draining, depressurization, cleaning, and purging of equipment;
• verification that connected vessels and lines cannot release flammable material;
• gas testing at the work point, nearby low and high locations, drains, pits, and enclosed spaces as appropriate;
• suitable screens and spark containment;
• protection or isolation of fire detection and suppression systems only under controlled impairment procedures;
• suitable extinguishers and charged hose lines;
• a trained fire watch with no competing duties;
• control of cylinders, hoses, cables, and electrical equipment; and
• post-work fire watch for a defined period based on the risk and site procedure.

Atmospheric testing should be performed with a calibrated and bump-tested instrument by a competent person. Testing must consider oxygen concentration, flammable vapour concentration, and toxic contaminants relevant to the process. A single reading is not a guarantee of safety because ventilation, temperature, agitation, or process leakage can change conditions. Acceptance limits must come from the applicable legislation, facility standard, and equipment limitations; they should not be invented by the permit issuer.

The fire watch observes the work and adjacent areas, maintains communication, stops the work if conditions deteriorate, and initiates emergency action. The fire watch is not simply a person holding an extinguisher.

5. Confined-Space Entry

A confined space is an enclosed or partially enclosed space that is not designed for continuous occupancy and may present hazards such as oxygen deficiency, toxic or flammable atmospheres, engulfment, restricted movement, heat stress, or difficult rescue. Examples include tanks, silos, pits, sewers, vessels, and some ducts.

Entry control begins with avoiding entry. Remote inspection, mechanical cleaning, cameras, or external repairs may remove the need for personnel to enter. If entry is necessary, a written entry permit and rescue plan are required.

Essential controls include:

1. identification and isolation of all process, mechanical, electrical, and material-flow hazards;
2. cleaning, draining, purging, and ventilation appropriate to the contaminant;
3. pre-entry and continuous or periodic atmospheric testing;
4. a trained entrant, attendant, and entry supervisor;
5. reliable communication and a means of summoning help;
6. suitable lighting, respiratory protection, retrieval equipment, and intrinsically safe equipment where required;
7. prevention of unauthorized entry; and
8. a rescue plan based on realistic equipment, access, and trained rescuers.

The attendant remains outside, maintains the entry log, monitors conditions, communicates with entrants, and orders evacuation when necessary. An attendant should not enter to attempt an unplanned rescue. Many confined-space fatalities occur when an unprotected rescuer follows an incapacitated worker.

Atmospheric testing is interpreted rather than merely recorded. Oxygen enrichment increases fire risk, while oxygen deficiency can impair judgment before unconsciousness. Flammable readings may rise during disturbance of sludge or residue. Ventilation must not create a new hazard by spreading vapour to ignition sources or other occupied areas.

6. Management of Change

Management of change (MOC) is a formal process for evaluating and controlling modifications that could affect process safety. Changes may involve equipment, materials, technology, software, procedures, staffing, organization, operating limits, or the physical arrangement of a plant.

A useful MOC process includes:

• description and justification of the proposed change;
• screening to determine whether formal MOC is required;
• identification of hazards and affected safeguards;
• review of design, relief capacity, electrical classification, fire protection, human factors, and emergency response;
• definition of temporary and permanent controls;
• approval by competent technical and operational personnel;
• updating of drawings, procedures, training, inventories, and maintenance plans;
• communication to affected workers and contractors; and
• confirmation that conditions of safe operation have been achieved.

Replacement-in-kind means a replacement that satisfies the original design specification and does not introduce a new hazard. It should not be used as a loophole for an unreviewed change. A pump with a different seal material, a change in solvent, revised control logic, or a temporary bypass may all require MOC.

MOC should address the full life cycle. Temporary changes require an expiry date, an owner, interim safeguards, and a plan for removal. Uncontrolled temporary modifications often become permanent and create hidden risk.

7. Preventive Maintenance, Inspection, and Testing

Preventive maintenance is planned work performed to reduce the probability of failure or deterioration. It includes time-based, usage-based, condition-based, and reliability-centred approaches. The objective is not merely to service equipment, but to preserve safety functions.

Safety-critical equipment may include emergency shutdown systems, fire pumps, deluge valves, gas detectors, flame detectors, pressure relief devices, fixed extinguishing systems, explosion isolation devices, earthing systems, alarms, and ventilation. Each item should have:

• a defined safety function;
• an inspection or test method;
• an interval based on risk, manufacturer information, legal requirements, and operating experience;
• acceptance criteria;
• competent personnel and suitable instruments;
• records of results and defects; and
• a process for managing overdue or failed tests.

Inspection and testing are not identical. Inspection may identify visible deterioration, corrosion, leakage, damage, or incorrect position. Testing challenges the function under specified conditions. A fire pump may look satisfactory but fail to deliver required flow; a gas detector may display normally but fail its response test.

A simple risk-prioritization model can support maintenance planning. One common qualitative approach ranks risk as:

Here, consequence and likelihood are rating scales defined by the organization. The result is not a physical unit and must not be confused with a precise probability. The model is useful for ranking work only when the scales are consistently defined. Critical safeguards may require mandatory testing regardless of the calculated ranking.

Defects should be classified by consequence and urgency. A failed emergency shutdown may require immediate shutdown or compensating controls, while minor paint damage may be scheduled. Deferral must be approved, time-limited, visible to operators, and supported by a documented risk assessment.

Reliability and human factors

Maintenance itself can introduce hazards through incorrect reassembly, wrong materials, bypassed alarms, poor isolation, or incomplete testing. Shift handover and independent verification are especially important after intrusive maintenance. Where a safety instrument has been bypassed, the bypass should be clearly identified, authorized, tracked, and removed promptly.

8. Contractor Control

Contractors often perform specialized and high-risk work, but responsibility for site safety remains with the operating organization. Contractor control should begin before selection and continue through demobilization.

Prequalification should examine competence, relevant experience, training, supervision, equipment condition, incident history, emergency capability, and understanding of hazardous-area requirements. A low price is not evidence of adequate control.

Before work starts, the organization should provide site orientation covering alarms, muster points, prohibited activities, permit arrangements, hazardous materials, traffic routes, emergency reporting, and stop-work authority. Contractor method statements and risk assessments should be reviewed for compatibility with plant operations. Interfaces between contractor and host personnel must be explicit.

During work, supervisors should verify compliance in the field. Contractors must use the same isolation and permit standards as employees, or a demonstrably equivalent system approved by the site. Multiple employers create communication risks, especially during shift changes and simultaneous operations. At completion, the contractor should provide test certificates, as-built information, defect lists, waste documentation, and confirmation that temporary facilities and isolations have been removed.

9. Pre-Startup Safety Review and Inspection

A pre-startup safety review (PSSR) confirms that a new, modified, or significantly repaired facility is ready for safe operation. It is not a substitute for design review or commissioning procedures.

The review should verify that:

• construction and installation match approved design;
• pressure tests, electrical tests, calibration, and equipment certification are complete;
• relief devices, alarms, interlocks, shutdown systems, and fire protection are available and functional;
• operating, maintenance, emergency, and inspection procedures are issued;
• personnel are trained and competent;
• MOC actions are closed or formally controlled;
• hazardous-area classification and equipment suitability are confirmed;
• chemicals and material inventories are accurate; and
• outstanding defects have an approved disposition.

A PSSR team should include operations, maintenance, engineering, process safety, and—where necessary—fire protection and contractor representatives. The review should be field-based. A checklist is useful, but it cannot replace technical judgment. Start-up should be blocked when critical safeguards are incomplete.

10. Integrated Operational Control

These systems are most effective when integrated rather than managed as isolated documents. For example, installing a new solvent-transfer pump may require MOC, contractor control, electrical-area verification, LOTO during installation, hot-work restrictions, updated preventive maintenance, PSSR, and revised emergency procedures.

A practical control chain is:

Plan → assess hazards → isolate and prepare → authorize → execute and monitor → inspect and test → restore → learn and improve.

Digital permit systems can improve visibility by linking permits to work orders, isolations, gas-test records, and plant drawings. Sensors and mobile devices may provide real-time status, but technology does not remove the need for field verification. Artificial intelligence can help identify overdue inspections, recurring defects, or conflicting work orders, but its recommendations require human validation and should not authorize hazardous work autonomously.

Useful performance indicators include both leading and lagging measures. Leading indicators include percentage of critical equipment tested on time, quality of permit audits, number of overdue isolations, completion of contractor inductions, and closure of PSSR actions. Lagging indicators include fires, releases, injuries, equipment failures, and unwanted shutdowns. Counting permits alone is a poor measure of safety; a high number may represent either strong control or unnecessary bureaucracy.

Illustrative Case Study: Hot Work Near a Solvent Storage Area

Background

A maintenance contractor was asked to repair a steel support near an outdoor solvent-storage tank. The work required grinding and arc welding. The tank farm was operating normally, and several tanks were connected to a vapour-recovery system.

Problem

The initial work request described the task as “minor structural repair.” The first permit draft identified only sparks and burns. It did not identify vapour migration, drains leading to the work area, the possibility of solvent release during tanker operations, or the need to coordinate with the vapour-recovery system.

Analysis

A field review identified four credible fire pathways: vapour escaping from tank vents, vapour accumulation near a low drain, sparks travelling beneath a temporary barrier, and a simultaneous tanker connection operation. The contractor’s grinding equipment was not suitable for the classified area without additional controls. The fire watch had also been assigned responsibility for another job.

Approach and solution

The team first considered eliminating the ignition source by fabricating the support in a workshop. This was not feasible because the support was fixed and access for removal was limited. The work was therefore rescheduled outside tanker receipt periods. The affected tank connections were isolated under LOTO, drains were covered or verified gas-free, combustible materials were removed, and continuous atmospheric monitoring was established. Spark containment screens were installed, and a dedicated fire watch was assigned. The hot-work permit was linked to the isolation certificate and confined-area gas-testing plan. A supervisor conducted a pre-job briefing with operations and the contractor.

Outcome

During preparation, the gas detector recorded a rising solvent-vapour trend near a drain. Work was stopped before ignition. Investigation found a leaking valve on an adjacent transfer line. The valve was repaired, the area was retested, and the job was completed under renewed authorization.

Learning points

The case demonstrates that a permit is a live control system, not a form completed once. Field verification, continuous monitoring, SIMOPS review, competent fire watch, and stop-work authority prevented a possible flash fire. It also shows why a “minor” job must be assessed by hazard, not by duration or cost.

Challenges, Governance, and Ethical Responsibilities

Safe work systems can fail through normalization of deviance, production pressure, inadequate staffing, poor competence, or excessive reliance on checklists. Workers may feel unable to stop work when supervisors reward schedule completion. Ethical safety leadership requires that stop-work decisions be supported, investigated fairly, and not treated as disloyalty.

Governance should define authority, competence, record retention, audit frequency, escalation, and consequences for bypassing controls. Records must be accurate because false entries can conceal risk and undermine legal accountability. Personal data collected through access systems or wearable devices should be limited to legitimate safety purposes and protected appropriately.

Regulatory requirements vary by jurisdiction. Organizations must comply with applicable occupational-safety, fire, electrical, pressure-equipment, environmental, and hazardous-substance laws, as well as recognized industry standards. Site procedures should identify the controlling requirements rather than relying on informal custom. Where standards conflict, the organization should obtain competent technical and legal advice and adopt the more protective practicable control.

Best-Practice Checklist

An effective safe work system should:

• define roles for the issuing, performing, and area authorities;
• use field verification rather than paperwork alone;
• identify all hazardous energy and process connections;
• require competent atmospheric testing where relevant;
• control simultaneous operations;
• provide personal lock control and group-isolation arrangements;
• establish clear suspension, renewal, and close-out rules;
• link MOC to training, drawings, maintenance, and emergency response;
• prioritize safety-critical inspection and testing;
• manage defects with compensating controls and deadlines;
• prequalify and supervise contractors;
• block start-up when critical safeguards are incomplete; and
• learn from near misses, failed tests, permit audits, and stop-work events.

Chapter Summary

Safe work systems control the conditions under which hazardous industrial work is planned, authorized, performed, and closed. Permit-to-work systems communicate task-specific hazards and precautions, but they are effective only when supported by physical controls and competent supervision. LOTO prevents unexpected energization and requires identification, isolation, dissipation, and verification of hazardous energy. Hot work requires elimination of ignition sources where possible, atmospheric testing, combustible control, fire watch, and post-work monitoring. Confined-space entry requires avoidance where feasible, isolation, atmospheric control, trained roles, communication, and a realistic rescue plan.

MOC ensures that changes to equipment, materials, technology, procedures, and organization do not introduce unrecognized hazards. Preventive maintenance, inspection, and testing preserve the function of safety-critical equipment, while contractor control manages competence and interfaces. PSSR confirms readiness before start-up. Together, these systems form a continuous operational-control cycle supported by field verification, accurate records, stop-work authority, and learning from experience.

Key Terms

Permit to work: Formal authorization for a defined hazardous task.

Issuing authority: Person responsible for confirming that work conditions are safe for authorization.

Performing authority: Person responsible for directing the work party and complying with permit conditions.

Lockout/tagout: System for isolating and controlling hazardous energy.

Hazardous energy: Electrical, mechanical, pressure, thermal, chemical, gravitational, or other energy capable of causing harm.

Hot work: Work that produces flame, heat, sparks, or hot surfaces.

Fire watch: Competent person assigned to monitor hot work and surrounding areas.

Confined space: Enclosed or partially enclosed space with restricted access or potential atmospheric or physical hazards.

Attendant: Person who remains outside a confined space and monitors entrants and conditions.

Management of change: Formal evaluation and control of proposed modifications.

Replacement-in-kind: Replacement meeting the original design specification without introducing a change in hazard.

Preventive maintenance: Planned maintenance intended to prevent failure or deterioration.

Safety-critical equipment: Equipment whose failure could cause or worsen a serious incident.

Inspection: Examination to identify condition, damage, or deterioration.

Functional test: Test that challenges whether equipment performs its intended safety function.

Pre-startup safety review: Formal confirmation that a facility is ready for safe operation.

SIMOPS: Simultaneous operations whose interaction may create additional risk.

Compensating control: Temporary or alternative measure used when a normal safeguard is unavailable.

Stop-work authority: Right and responsibility to halt work when unsafe conditions exist.

Review Questions

Short Answer Questions

1. What is the purpose of a permit-to-work system?
2. Why is verification required after hazardous energy has been isolated?
3. State four controls required before hot work in a process area.
4. What are the principal roles of an entrant, attendant, and entry supervisor?
5. What is the purpose of a pre-startup safety review?

Long Answer Questions

1. Explain the complete lifecycle of a permit to work, from planning through close-out.
2. Describe a suitable lockout/tagout procedure for equipment containing electrical and stored-pressure energy.
3. Discuss the relationship between management of change, preventive maintenance, and process safety.
4. Explain how an organization should select, induct, supervise, and demobilize contractors performing high-risk work.
5. Compare inspection, functional testing, and preventive maintenance, including their limitations.

Analytical / Application Questions

1. A contractor must grind a pipe support beside a solvent pump while tanker unloading is scheduled nearby. Identify the hazards, decide whether the work should proceed, and specify the controls and authorization needed.
2. An emergency shutdown valve fails its functional test but production management wants to continue operating for three days. Analyze the decision using risk, compensating controls, defect escalation, and ethical governance.
3. A plant changes the solvent used in a cleaning operation and installs a different ventilation fan. Develop an MOC and PSSR plan identifying technical, procedural, training, and emergency-response issues.

Multiple Choice Questions with Answers

Question 1

Which statement best describes the purpose of a permit to work?

A. It replaces the need for physical isolation.

B. It formally authorizes a defined task under specified safe conditions.

C. It guarantees that no incident can occur.

D. It transfers all safety responsibility to the contractor.

Correct Answer: B. It formally authorizes a defined task under specified safe conditions.

Question 2

What is the most important verification after applying a lockout?

A. Checking that the warning tag is brightly coloured.

B. Confirming that the equipment is clean.

C. Testing that hazardous energy cannot reach the work area.

D. Asking a second worker whether the lock looks secure.

Correct Answer: C. Testing that hazardous energy cannot reach the work area.

Question 3

Which person should normally maintain a personal lock during group isolation?

A. Each individual worker performing the task

B. Only the plant manager

C. The fire watch alone

D. The equipment manufacturer

Correct Answer: A. Each individual worker performing the task

Question 4

Which control is most appropriate for hot work near flammable vapours?

A. Increase the welding speed.

B. Use a dedicated fire watch and conduct suitable atmospheric testing.

C. Remove the permit after welding begins.

D. Turn off all site alarms without authorization.

Correct Answer: B. Use a dedicated fire watch and conduct suitable atmospheric testing.

Question 5

What is the primary responsibility of a confined-space attendant?

A. Perform welding inside the space

B. Remain outside, monitor entrants and conditions, and summon help when needed

C. Leave the area to obtain tools whenever required

D. Enter immediately for an unplanned rescue

Correct Answer: B. Remain outside, monitor entrants and conditions, and summon help when needed

Question 6

Which situation normally requires management of change?

A. Replacing equipment with an identical approved item

B. Changing a process solvent and its ventilation arrangement

C. Cleaning an office floor

D. Recording a routine toolbox talk

Correct Answer: B. Changing a process solvent and its ventilation arrangement

Question 7

What is the main purpose of a pre-startup safety review?

A. To calculate employee wages

B. To confirm that a new or modified facility is ready for safe operation

C. To eliminate the need for commissioning tests

D. To approve all future maintenance work automatically

Correct Answer: B. To confirm that a new or modified facility is ready for safe operation

Question 8

Which is an example of a leading safety indicator?

A. Number of completed critical-equipment tests on time

B. Number of injuries after an incident

C. Cost of fire damage

D. Number of emergency evacuations caused by a fire

Correct Answer: A. Number of completed critical-equipment tests on time

Question 9

Why should a fire watch have no competing duties?

A. To allow the fire watch to perform more welding

B. To ensure continuous attention to ignition and fire conditions

C. To avoid the need for extinguishers

D. To permit work without a hot-work permit

Correct Answer: B. To ensure continuous attention to ignition and fire conditions

Question 10

Which statement about a permit is correct when site conditions change significantly?

A. The original permit remains valid until the job is finished.

B. Only the contractor may decide whether work continues.

C. Work should be suspended and the permit reassessed or revalidated.

D. The gas test can be ignored if work has already started.

Correct Answer: C. Work should be suspended and the permit reassessed or revalidated.