Issue, track and close permits to work in one place: issuer ≠ requester, a two-sided hand-back, a daily expiry. Every step is recorded by an append-only, hash-chained signature, open permits show up where the shift works — and the QR code on the printed permit tells you on site, without login, whether work may proceed right now.
Process Safety Excellence
Issuer ≠ requester — by default nobody can issue a permit to themselves.
Illustrative data — your real permits live in the system.
In most tools a permit to work is a filled-in PDF that has no idea whether the machine is down or whether there’s a work order. In OPEREX the permit is part of the process: tied to the log, to maintenance, and to the proof.
The permit shows up where the shift works: preparation in the log, open permits visible in the shift handover.
Running a maintenance work order requires an active permit — the gate lives in CMMS, PTW supplies the fact.
Every state change is an append-only, hash-chained signature — who, when, in what role. A single later edit visibly breaks the chain.
Anyone walking the work area can check the posted permit with a phone. The QR code on the paper opens, at your organisation's own address and without login, whether the work is permitted RIGHT NOW — from the system's current state, not the paper's.
WORK MAY PROCEED
The permit is valid; work may proceed now.
Valid until: 16:00
This paper is the latest version.
DO NOT WORK
The permit is SUSPENDED — work must stop.
OUTDATED PAPER — 1 change since it was printed.
Site guard, fire watch, HSE inspector, plant supervisor or contractor lead: scan the QR and see the permit's status without signing in.
The first line is the verdict — they may work, or not — and the reason: suspended, expired, closed, or not started yet.
If the permit was suspended, extended or closed since the posted paper was printed, the page says so: outdated paper.
The page shows the work, the location and the validity — so it shows when the paper is not for the work or place that is going on.
No personal data is shown, the code is not the permit number (it cannot be guessed), and the page never says yes to a broken record.
Click through the permit lifecycle. Each step writes an append-only signature row with a real SHA-256 hash, chained to the previous one. Change the location on an already-signed permit — and see the chain break.
Issuer ≠ requester — by default nobody can issue a permit to themselves.
…broken…broken…broken…broken…broken…brokenThis is what it would look like if someone edited an issued permit afterwards. The append-only chain won’t let it pass unnoticed.
Illustrative data — your real permits live in the system.
All live today — verifiable claims, not promises.
From request to close, a server-enforced state machine (CAS): two people can’t make conflicting moves at once.
By default nobody can issue a permit to themselves — the separation is enforced server-side. Single-person issue is a reasoned, recorded exception that has to be switched on.
The worker hands it back, the plant takes it back — by default, closing requires the concurring signatures of both sides (the hand-back step is a policy switch, on by default).
Every step writes a hash-chained signature row; the chain can be verified in the browser too. The database also forbids edits (not just the code).
An authentic, downloadable on-site copy for every issued permit, with its number and a QR code. Scanned with a phone, it shows without login whether work may proceed on the permit RIGHT NOW, and whether the paper in hand is the latest version.
An expired permit flips to expired automatically (it does not release isolation — that’s a human call); at day’s end it day-closes at the configured time.
Over a dozen gates you can set, with a “Lenient”, an “OPEREX recommended” and a “Strict” profile — the organisation sets its own rigor, and the interface states which gate is on.
General, hot-work, confined-space entry, electrical, ATEX and more permits out of the box; you tailor them to your practice in the template editor.
Qualifications, training and medicals with expiry; a person and document master, xlsx/csv import. The issuer's authorisation is checked too.
Isolation points with LOTO / blind-flange reference numbers and signed certificates (e.g. gas-free) — tied to the permit.
Time-valid gas-test records (LEL / O₂ / toxic); re-tested on extension. The module checks the record exists and is still valid.
One person on one open permit at a time; simultaneous operations (SIMOPS) along the technical-location tree; last-minute risk assessment (LMRA).
Maintenance, the permit and the shift log hand work to each other: a work order becomes a permit request, preparing the work area becomes a task for the shift, the open permit shows in the log, and the work order only starts with a valid permit.
One button on the maintenance work order starts the permit: title, location, site and plant pre-filled — the safety questions empty, on purpose.
On request, preparing the work area (for example draining, isolating, cleaning) goes out as a task to the designated shift.
The task shows up in the shift's log, and the shift confirms when it's done — if it isn't done by issue time, the policy warns or blocks.
The issuer issues on site and hands over the area; work may proceed from this state.
Active permits show in the log; the incoming shift confirms the continuation.
A work order that needs a permit cannot start without an active permit and cannot close with an open one — per the maintenance policy.
The loop closes on the work order: once the permit is handed back and taken back, the work order can be closed.
The three modules together make the loop — the permit also works without maintenance and the log, but then these hand-offs are missing.
Enterprise-grade rigor is available but not mandatory; so is SME Excel-level simplicity. Gates are off / warn / block — “warn” asks for a reason, “block” stops issuance.
Three ready profiles: “Lenient”, “OPEREX recommended” and “Strict” — or set each point, including the required signatures and reasons.
An optional, separately ordered service — the permit module is complete without it, with the recommendation valid at installation.
We review OPEREX's recommended permit-issuing rules — risk assessment, issuing conditions, policy — with an occupational-safety expert periodically and after every significant legal change. We tell you what changed and why, and on request load the update into your organisation's settings. A new installation always starts with the latest recommendation; this service brings you the later changes. You can deviate from the recommendation at any time: the decision is yours, and your justification stays on record.
Details & pricingThe interface never claims more than the code: every point below is a live, verifiable capability. Beneath them, how the module aligns to the relevant safety standards.
Every state change leaves an auditable trail — retrievable per §7.5 (documented information).
The mandatory content of occasional hot-work activity (fire-safety exam number).
Appointing a coordinator when several employers work at one site.
OPEREX supports compliance with an auditable trail — the software itself is not a certificate.
In production: the permit lifecycle, the append-only signature chain, the log weld, the WO gate, expiry/cutoff, the policy gates and the built-in templates — plus the competence gate with expiry, structured isolation points, certificates, time-valid gas testing, the worker lock and LMRA. Retention automation is planned — the “Live today” section lists what works.
Every state change writes a new, immutable signature row carrying the SHA-256 hash of the whole permit content, chained to the previous row. If anyone edits a field afterwards, the chain breaks, and that shows up on verification — the demo above shows it. It’s not a “blockchain”, it’s an append-only proof chain.
Yes. Gates are off / warn / block, with a “Lenient”, an “OPEREX recommended” and a “Strict” profile, and you compose templates in the template editor (question-driven: a flagged hazard opens the required blocks). The built-in templates are a copyable starting point.
PTW is strongest when it runs alongside the log and maintenance — the permit shows in the log and the shift handover, and it’s gated to the work order. The modules work on their own too, but the value is in the loop.
No — we don’t certify software. What we give: a §7.5 auditable trail (documented information) for every permit step. We support compliance; we supply the proof.
A separate permission (ptw:issue). By default the issuer can’t be the requester — the server enforces it. Single-person issue (for a request received on paper or verbally) is a policy switch: off by default, it can only be turned on with a reason, and the chain and the PDF record it. Optionally, issuer two-factor (TOTP) can be required before issuing/closing.
Scanned with a phone, it opens a page at your organisation's own address — without login, so the site guard, the fire watch or a contractor can use it too. Its first sentence is the verdict: work may proceed, or do not work — and why (suspended, expired, closed…). It shows the system's CURRENT status, not the paper's, and also tells whether the paper in hand is the latest version. No personal data is shown, and the code is not the permit number, so it cannot be guessed.
The permit module starts with the OPEREX recommendation valid at installation. With the regulatory-tracking add-in, we review the recommended rules with an occupational-safety expert periodically and after every significant legal change, notify you, and on request load the update into your settings. Your organisation may deviate from any recommendation; loosening asks for a justification, which stays on record. The recommendation is professional advice, not legal advice.
Plant work permits (permit to work, PTW): the built-in templates include a general work permit, hot work, confined space entry, electrical, excavation, crane/lifting, structural modification, ATEX and combined permits, plus a pre-job quick risk assessment (LMRA). Isolations (blind flange, LOTO) are recorded per point on the permit. In an integrated safe system of work (ISSOW), the risk assessment, the permit, the isolations and the maintenance work order belong together — in OPEREX they live in one system rather than as separate papers.
Go deeper into the methodology behind this module.
One module among several — all built around operational excellence, sharing data with each other.
A trust surface for the whole OPEREX platform — not a module-level claim. The details are each on one page, with the limits stated.
We'll show you OPEREX on your own operational processes — no strings attached.
Request a demoNew modules, industrial shift-log tips and ISO 45001 practices — once a month at most, no spam.