The clean permit and the live line

Boards see control of work as a mature, audited system: permits issued, isolations logged, completion rates reported green. Olin and PBF are the cases that should make a board ask what those green numbers actually certify. In both, the paperwork was in order. In both, a worker opened a live line. The record and the reality had diverged — and the record was the thing the board was being shown.

This is not a story about a broken permit system. The system ran. What it could not do was guarantee that the physical line matched the paper — and that guarantee is the only thing that matters at the moment of break-in. A board that reads "permit compliance: on target" and hears "the work was safe" has made the same error the paperwork made: it has mistaken a record of intent for a state of the world.

Assurance has a comfortable failure mode: measuring the process instead of the outcome. A permit issued, an isolation logged, a tag applied — each is real, auditable and reassuring. None of them is the same as the right valves shut on the right line, proven by a positive test. The record certifies that steps were taken. It does not certify that the stored energy is gone. The distance between those two statements is exactly where the chlorine was.

At Olin the record was clean and the line was live, because the isolation had been performed — correctly — on a nearly identical system. Every box was ticked. The boxes were on the wrong line. A board relying on completion metrics would have seen nothing wrong right up to the moment of the release, because by every measure it was tracking, the job was being done properly.

The wrong-line mechanism does not produce small outcomes. At PBF Martinez it produced an estimated $924 million loss. At Olin it produced around 8,000 pounds of released chlorine and a community ordered to shelter in place. These are not lost-time-injury statistics; they are balance-sheet events, regulatory events and community-trust events — the categories a board is uniquely accountable for. The act is mundane: one worker, one flange, one wrong assumption. The exposure is existential.

At PBF the CSB's remedy was to have a knowledgeable person present to ensure unfamiliar workers opened the correct equipment. Read that as a governance statement: the company had arranged for work on hazardous equipment to be done by people who did not know it, without a knowledgeable person verifying. That arrangement is not a frontline choice. It is a product of contracting strategy, staffing models and turnaround planning — all board-visible decisions. Unfamiliarity at the flange is designed upstream, in rooms the worker never enters.

And the board's exposure here is direct. When contractors open the wrong line, the contracting structure that looked like efficiency becomes the proximate cause named in the investigation — and the duty does not transfer with the task. "Who knew this equipment, and were they there when it was opened?" is a question a board can ask without knowing a single valve, and the answer maps straight back to decisions the board itself signed off.

"The most dangerous number in a boardroom is a true one that measures the wrong thing."

You cannot verify the isolation. You can verify whether your assurance measures verification at all. Three questions establish that.

1. Does our control-of-work reporting measure physical verification, or paperwork completion? — If the board only ever sees permit-compliance and closure rates, it is being shown that the process ran — not that any line was confirmed dead. Red flag: no metric distinguishes "isolation logged" from "isolation independently verified at the point of work."
2. When unfamiliar workers open hazardous equipment, is a knowledgeable person required at break-in — and audited? — Red flag: this depends on informal judgment, or the contracting model routinely puts unfamiliar crews on hazardous break-ins without a knowledgeable person present — the exact arrangement the CSB faulted at PBF.
3. Have we mapped where near-identical systems exist — and treated them as a named hazard? — Red flag: the organisation has no inventory of look-alike lines, and isolation verification does not specifically guard against the wrong-twin error that drove Olin. A hazard you have not named is a hazard you are not managing.

These three move the board from auditing whether the paperwork exists to auditing whether the paperwork corresponds to reality. After Olin, PBF and PEMEX, that distinction is not a refinement of oversight — it is the whole of it. The board that asks them is no longer relying on a record to tell it something a record cannot know.

The most dangerous assurance is the kind that is true and irrelevant. "The permit was issued" is true. "The isolation was logged" is true. Neither tells the board whether the line a worker is about to open is dead. The board's task is to insist its assurance measures the thing that keeps chlorine in the pipe — physical verification at the point of work — and to treat a clean record offered as proof of a safe line as exactly the error the wreckage keeps teaching. On the record is not on the pipe.

"A permit tells the board the process ran. Only verification tells the board the line is dead. Never confuse the receipt for the result."