The permit for risky work — a gate, not a sheet of paper.
Issue, track and close permits to work in one place: issuer ≠ requester, a two-sided hand-back, a daily expiry. Every step is recorded by an append-only, hash-chained signature — and open permits show up where the shift works.
Process Safety Excellence
- Site
- V-3 blokk
- Plant
- 2-CP
- Location
- Tank T-208, manway
- Task
- Welding on a new flange
- Validity
- 2026-09-07 08:00 — 18:00
- Issuer
- B. Kovács · 08:05
- Requester
- K. Nagy (Contractor Ltd.)
Issuer ≠ requester — nobody can issue a permit to themselves.
Illustrative data — your real permits live in the system.
A permit isn’t a form — it’s a gate before risky work.
In most tools a permit to work is a filled-in PDF that has no idea whether the machine is down or whether there’s a work order. In OPEREX the permit is part of the process: tied to the log, to maintenance, and to the proof.
The permit shows up where the shift works: preparation in the log, open permits visible in the shift handover.
Running a maintenance work order requires an active permit — the gate lives in CMMS, PTW supplies the fact.
Every state change is an append-only, hash-chained signature — who, when, in what role. A single later edit visibly breaks the chain.
Step through it — and watch the proof build
Click through the permit lifecycle. Each step writes an append-only signature row with a real SHA-256 hash, chained to the previous one. Change the location on an already-signed permit — and see the chain break.
- Plant
- V-3 blokk
- Location
- T-208 tartály, búvónyílás
- Validity
- 2026-09-07 08:00 — 2026-09-07 18:00
Issuer ≠ requester — nobody can issue a permit to themselves.
- RequesterSHA-256
…broken - IssuerSHA-256
…broken - Activator (handing plant)SHA-256
…broken - Daily closeSHA-256
…broken - Hand-back (worker)SHA-256
…broken - Taking back (plant)SHA-256
…broken
This is what it would look like if someone edited an issued permit afterwards. The append-only chain won’t let it pass unnoticed.
Illustrative data — your real permits live in the system.
Capabilities
All live, from phases ①–③. Verifiable claims, not promises.
From request to close, a server-enforced state machine (CAS): two people can’t make conflicting moves at once.
Nobody can issue a permit to themselves — the separation is enforced server-side (HSG250).
The worker hands it back, the plant takes it back — closing requires the concurring signatures of both sides.
Every step writes a hash-chained signature row; the chain can be verified in the browser too. The database also forbids edits (not just the code).
An authentic, downloadable on-site copy for every issued permit — with the serial number and the first hex of the content hash.
An expired permit flips to expired automatically (it does not release isolation — that’s a human call); at day’s end it day-closes at the configured time.
Over a dozen gates you can set, with a “Base” and a “Strict” profile — the organisation sets its own rigor, and the interface states which gate is on.
General, hot-work and confined-space entry permits out of the box; you compose the rest in the template editor.
Qualifications, training and medicals with expiry; a person and document master, xlsx/csv import. The issuer's authorisation is checked too.
Isolation points with LOTO / blind-flange reference numbers and signed certificates (e.g. gas-free) — tied to the permit.
Time-valid gas-test records (LEL / O₂ / toxic); re-tested on extension. The module checks the record exists and is still valid.
One person on one open permit at a time; simultaneous operations (SIMOPS) along the technical-location tree; last-minute risk assessment (LMRA).
Work order → permit → log → back to the work order
Maintenance, the log and the permit closed into a single loop — the thing “forms + WO” tools can’t do, because there the permit is an island.
- Work order (WO)
The maintenance work order sets how many shifts ahead preparation must start.
- Preparation in the log
The prep task lands in the log; the shift reports back when it’s done.
- Issue the permit
It starts pre-filled from the work order — but the gates and checklists start empty, by design.
- Open permits in the handover
Open permits are visible in the log; the incoming shift confirms they continue.
- Hand-back
Closing the work is two-sided: the worker hands back, the plant takes back.
- WO gate
The work order can’t start or close without an active permit.
The log weld and the WO gate are live today (①). The permit always knows what’s happening around the machine.
You set the rigor — the interface states which gate is on
MOL-level rigor is available but not mandatory; so is SME Excel-level simplicity. Gates are off / warn / block — “warn” asks for a reason, “block” stops issuance.
- Production lead co-signatureWork touching a production area also needs the production lead’s signature.OffWarnsBlocks
- Taker ≠ handerThe hand-back and the take-back are signed by two different people.OffWarnsBlocks
- Mandatory daily closeThe active permit day-closes at day’s end; it must be re-activated the next day.OffWarnsBlocks
- Simultaneous operations (SIMOPS)Flags when there’s a time-overlapping permit in the same plant.OffWarnsBlocks
- Issuer two-factorA fresh TOTP check from the issuer before issuing/closing.OffWarnsBlocks
Two ready profiles: “Base” and “Strict” — or set it gate by gate.
What is live today — and the standards it aligns to
The interface never claims more than the code: every point below is a live, verifiable capability. Beneath them, how the module aligns to the relevant safety standards.
Live today
- 12-state permit lifecycle, issuer ≠ requester, two-sided hand-back
- Append-only, hash-chained signature trail + verification that also runs in the browser
- Log weld: open permits in the log and the shift handover
- WO gate: maintenance tied to a permit
- Expiry + daily cutoff cron, PDF of record
- off / warn / block policy gates, 3 ready templates, paper fallback
- Competence gate with expiry: person and document register, xlsx/csv import, issuer authorisation
- Isolation points (LOTO / blind-flange reference numbers), certificates with signatures, time-valid gas testing — re-test on extension
- Worker lock: one person on one open permit at a time; SIMOPS conflict along the technical-location tree
- Last-minute risk assessment (LMRA) before activation, plus a risk sheet on the permit
- With Operations Analytics, permit metrics reach the dashboard (issued, gate-blocked attempts, throughput by type)
What it aligns to
Every state change leaves an auditable trail — retrievable per §7.5 (documented information).
The permit lifecycle aligns to the mandatory elements of HSG250 best practice.
The mandatory content of occasional hot-work activity (fire-safety exam number).
Appointing a coordinator when several employers work at one site.
OPEREX supports compliance with an auditable trail — the software itself is not a certificate.
Frequently asked questions
What does the module give today, and what’s coming?
In production: the permit lifecycle, the append-only signature chain, the log weld, the WO gate, expiry/cutoff, the policy gates and 3 ready templates — plus the competence gate with expiry, structured isolation points, certificates and time-valid gas testing. The worker lock, LMRA, retention automation and QR verification are planned — the “Live today” section lists exactly which is which.
What does “append-only, hash-chained” signature mean?
Every state change writes a new, immutable signature row carrying the SHA-256 hash of the whole permit content, chained to the previous row. If anyone edits a field afterwards, the chain breaks, and that shows up on verification — the demo above shows it. It’s not a “blockchain”, it’s an append-only proof chain.
Can I tailor it to my own plant?
Yes. Gates are off / warn / block, with a “Base” and a “Strict” profile, and you compose templates in the template editor (question-driven: a flagged hazard opens the required blocks). The 3 ready templates are a copyable starting point.
Do I need the shift log or the maintenance module?
PTW is strongest when it runs alongside the log and maintenance — the permit shows in the log and the shift handover, and it’s gated to the work order. The modules work on their own too, but the value is in the loop.
Is this ISO 45001-certified software?
No — we don’t certify software. What we give: a §7.5 auditable trail (documented information) for every permit step, plus a lifecycle aligned to HSG250 best practice. We support compliance; we supply the proof.
Who can issue a permit?
A separate permission (ptw:issue), and the issuer can’t be the requester — the server enforces it. Optionally, issuer two-factor (TOTP) can be required before issuing/closing.
Related reading from the knowledge base
Go deeper into the methodology behind this module.
- Near-miss: record and investigate
- Safety cross — the daily colour code
- MOC — Management of Change
- Black Swan events in process safety
Part of the OPEREX system
One module among several — all built around operational excellence, sharing data with each other.
Let's start a pilot
We'll show you OPEREX on your own operational processes — no strings attached.
Request a demo