ModulesPermit to WorkWork Control
Authorised work, here and now.One permit, from the request to the closed site.
For area authorities, permit holders and the EHS lead who has to show control of work: each permit type sets its gates, and a permit goes active only when every gate is met. The same record on the phone at the job and on the plant board.
8 of 8 gates met · gas re-test due 15:30
- Holder
- Carlos Mendes · Arden Welding
- Authoriser
- Thiago Moreira · area authority
- Work order
- WO 48213
| Gate | State | Reason | Who |
|---|---|---|---|
| Field check with the holder | Done 07:15 | Combustibles cleared 11 m; drains within 15 m covered | Thiago Moreira · Carlos Mendes |
| Isolation held and proven | Held | ISO-2026-0031 · 3 of 3 points proven | Lucas Almeida · isolating authority |
| Gas test in range | In range | 0% LEL at 14:30, work point and vapour space | Ana Lima · gas tester |
| Named roles present | Present | Signed present 07:24 | Ana Lima · fire watch |
| Competence valid | Valid | Hot work · valid to 10 Jan 2027 | Read from Training |
| Contract eligibility | Eligible | Arden Welding · CT-2026-014 | Read from Contractor Management |
| Task assessment attached | Reviewed | TRA-2026-0088 · reviewed at the job 07:10 | Carlos Mendes · crew of 3 |
| No conflicting work | Met · 1 held | PTW-2026-0147 drain and vent T-202 is held, not authorised | Compatibility rules |
Gas plan · LEL alarm 5% · stop 10% · O₂ 19.5–23.5% · re-test every hour
- 07:28
- 0% LEL
- 08:30
- 0% LEL
- 09:30
- 1% LEL
- 10:30
- 0% LEL
- 11:30
- 1% LEL
- 12:30
- 0% LEL
- 13:30
- 0% LEL
- 14:30
- 0% LEL
Alarm 5% · Stop 10%
What the plant knows about T-201
- Process Hazard Identification
- Tank farm node · hot work during filling rated in the top band · 1 open recommendation
- Bypass Control
- BYP-2026-0008 · LSHH-201 on T-201 bypassed for its function test · 3 h of 4
- Chemical Management
- At T-201: diesel (flammable)
- Energy Isolation
- ISO-2026-0031 · held · 3 locks on
One permit, three moments in its day. Switch the state: the gates, the gas strip and the answer change. An example permit; the fields are the product’s, the values illustrative.
Where it connects
On the same loop: Task Risk Assessment, Confined Spaces, Contractor Management and 38 more modules in one workspace.
Method note
Test the gas once, or keep testing? Both are in use, for different jobs.
A test before work proves the start of the job. Only readings during the work prove the middle.
Leandro · Founder, UProcess
Many sites test once before hot work and again after a break. Investigators keep asking for readings during the work as well, inside the vessel and not only at the arc, because conditions change after the permit is signed. Which one is right depends on what is behind the work point.
So each permit type sets its own gas plan.
- Before workA reading for every gas in the plan, inside the plan’s window, before the permit can go active.
- At an intervalRe-tests fall due on the plan’s clock and show as due to the gas tester.
- From a monitorA detector attached to the permit sends readings. A reading at the stop limit suspends the permit.
Where Permit to Work usually breaks
Four places a permit goes wrong, and what the record does about each.
The signer does not know the process.
At a chemical plant in Buffalo, the people who signed a contractor’s hot work permit were not familiar with the process connected to the tank. The air above the tank was tested; the vapour inside it was not. The explosion was fatal.
Source: U.S. Chemical Safety Board, DuPont Buffalo
In UProcess Before signing, the authoriser sees what the plant already knows about the equipment tag: hazard study scenarios, past investigations, barrier elements on the tag, live bypasses, held isolations and the chemicals at the work point.
What the plant knows about T-201 · before you sign
- Hazard study
- Hot work during filling · top band · 1 open recommendation
- Investigation
- Public case · similar equipment · tank roof explosion during welding
- Bypass
- LSHH-201 bypassed · BYP-2026-0008 · 3 h of 4
- At the work point
- Diesel (flammable)
Read by equipment tag at the moment of signing. Each item opens in its own module.
The shift changes, the permit does not.
Many accidents start with a failure of communication at shift handover, most of them during planned maintenance. The Piper Alpha inquiry named it among the causes.
Source: HSE, human factors: shift handover
In UProcess A permit is valid for one shift. Before the change, the incoming area authority revalidates it: the holder and crew confirmed, a new gas test where the type asks, and a signature. A permit not revalidated is suspended.
Shift change 19:00 · PTW-2026-0142
- 18:40
- Revalidation due · Rafael Santos, night area authority
- 18:48
- Field check at the roof
- 18:52
- Gas 0% LEL · Ana Lima
- 18:55
- Revalidated · signed, confirmed on device
Not revalidated by the change: suspended. Nothing continues on its own.
The gas is tested once, then trusted.
After a series of fatal explosions during hot work on and near tanks, the CSB’s lesson was that the absence of flammables must be verified before and during the work, with a gas monitor that is calibrated and used by trained people.
Source: U.S. Chemical Safety Board, hot work safety bulletin
In UProcess Each type carries a gas plan with alarm and stop limits per gas. A reading at the alarm limit leaves the gas gate unmet, says which gas, and a reading at the stop limit suspends an active permit.
LEL at the work point · 12 Nov 2026
- 13:30
- 0% LEL
- 14:30
- 0% LEL
- 14:52
- 12% LEL
14:52 · 12% LEL · stop limit reached · permit suspended
Alarm 5% · Stop 10%
Two safe permits, one unsafe combination.
HSE guidance expects permits to coordinate activities so jobs do not conflict, and related permits to be linked where tasks run at the same time or depend on each other.
Source: HSE, human factors: permit to work
In UProcess Your compatibility rules set which activities may run together and at what distance. A prohibited pair cannot be authorised while the other permit is active, and two permits on the same tag always show each other.
Compatibility rules · Tank farm
| Hot work | Drain and vent | Grit blasting | |
|---|---|---|---|
| Hot work | — | Prohibited within 15 m | Allowed with conditions |
| Drain and vent | Prohibited within 15 m | — | Allowed |
PTW-2026-0147 drain and vent at T-202 is held while PTW-2026-0142 is active. Two permits on one tag always show each other.
Process accident case · Hydrostatic test
The pressure test with people still nearby.
The tank was new. The water was clean. The hazard came in with the hose.
See the case →Permit PTW-2026-0142 · 12 Nov 2026
| Time | Person | Event | Signature |
|---|---|---|---|
| 15:20 | Thiago Moreira | Resumed · gas 0% LEL, 8 of 8 gates met | Confirmed on device |
| 15:12 | Ana Lima | Gas reading 0% LEL, work point and vapour space | Confirmed on device |
| 14:52 | Ana Lima | Gas reading 12% LEL · stop limit · permit suspended | Not re-confirmed (sent offline) |
| 14:30 | Ana Lima | Gas reading 0% LEL | Confirmed on device |
| 07:30 | Thiago Moreira | Activated after gas 0% LEL | Confirmed on device |
| 07:24 | Carlos Mendes | Accepted the permit and its conditions | Confirmed on device |
| 07:22 | Thiago Moreira | Authorised · 8 of 8 gates met | Confirmed on device |
| 06:50 | Carlos Mendes | Requested | Session |
The record an auditor asks for.
A permit is evidence only if it shows what was true at the moment each person signed.
- Every permit with its type version, and each gate with the reason it was met.
- Each signature with its time, and whether it was confirmed on the device.
- Gas readings with tester, instrument and position, and the limits they were read against.
- Revalidations, suspensions and the hand-back, shift by shift.
What’s in a permit
- Lifecycle
- Requested → Prepared → Authorised → Active ⇄ Suspended → Handed back → Closed, or Cancelled before work starts. Every step records who, when and why.
- Types
- Each permit type is your company’s own, versioned, with its gates, precautions, gas plan and roles.
- Gates
- Field check, isolation held and proven, gas in range, named roles present, competence, contract eligibility, task assessment, rescue plan, no conflicting work.
- Gas
- Alarm and stop limits per gas, readings with tester, instrument and position, re-tests on the plan’s interval, by hand or from an attached monitor.
- Board
- Your uploaded site plan with pins for permits, isolations, confined-space entries and bypasses, and conflicts drawn between them. A list on the phone.
Questions
Can anyone override a gate?
No. A gate is met or it is not. If a legitimate job cannot meet it, the permit type is wrong for the job, and the type is changed as a new version.
What happens at the shift change?
Every active or suspended permit shows revalidation due to the incoming area authority. Revalidated, it carries on; not revalidated, it is suspended.
Do we need Training and Contractor Management?
No. Without them, the authoriser attests competence and eligibility with a signature, and the permit shows that it was attested, not checked by the system.
Who can stop the work?
Anyone with Work Control access at the site, viewers included. One tap, a short reason, and the permit is suspended.