“No hazards recorded” is not the same as safe.
When a machine's hazard panel is empty, Zenith says so plainly: silence rather than a reassuring tick — nobody has assessed it. That refusal to show a comfortable green check is the instinct behind everything else here: a permit that dies at an instant rather than at midnight, an issuer who cannot be the holder, and an isolation that counts only once somebody has walked to the panel.
Bilingual EN / FR · Multi-site · WCAG 2.2 AASix things the safety layer holds
A hazard is a standing fact about a machine or a place — this panel is live, this room is confined. A permit is a decision made about one job in front of one of those facts, this afternoon, by a named person who is not the person doing the work. Reading them apart is how somebody ends up looking at a register of hazards with no idea whether anything is authorized against them right now.
Hazards
A library of what can hurt somebody — six categories, four severities ordered worst-first, and the harm written in the words somebody would use out loud.
Where they are
Attached to a machine, a place or a model. Recorded on a model once — every chiller of that model carries a refrigerant charge — rather than typed onto every unit.
PPE
Derived from the hazards actually present, as one union: a person puts on one set of equipment before walking in, and two hazards each wanting a hard hat do not want two hard hats.
Permit types
The template: how long one may run, whether it demands isolation, whether it excludes others, and which tickets the issuer and the holder each need — two lists, because they are two questions.
Permits
The instance: a window in time on one subject, held by one person and issued by another, with a hard end it cannot be created without.
Isolation
A fact about this job, not a property of the type. Confirmed at the equipment by somebody who walked there — or the permit authorizes nothing.
A permit that “expires today” covers the night shift
Every other expiry in a maintenance system is a date: a certification lapses on a day, a calibration runs out on a day. A permit does not. Hot work issued at eight for eight hours is dead at four — so permits carry instants, and every question about them is asked at an instant. It is the one place where the extra precision is the safety property rather than pedantry.
- Dead at the instant, not at the end of the day — in force at 15:59, not in force at 16:00, and the tests say so in exactly those terms.
- A permit is never open-ended — leave the end blank and it takes the type's maximum, because a permit with no end is the thing the whole idea exists to prevent.
- The maximum is a cap, not a suggestion — one shift for hot work. A permit good for a week is a sign on a door: the value of the thing is that somebody reassesses the job.
- Expired-but-open is its own list — an expired permit still on the board is how a crew comes back from lunch and carries on under a piece of paper that stopped meaning anything at four o'clock.
A second pair of eyes, or a signature on a piece of paper
The person who issues a confined-space permit is not the person who climbs into the vessel. That separation is the entire mechanism — so it is a refusal rather than a warning, and the two roles carry separate ticket lists, because a type may reasonably demand more of the person signing than of the person entering.
- Same person in both roles: refused — not flagged, not warned, not permitted with a note.
- Each side is checked against your workforce records — asked rather than restated, so a lapsed ticket is lapsed everywhere at once.
- Judged at the instant it was issued — a permit written in February under a ticket valid in February stays explicable in August, instead of turning retroactively into a violation.
- The refusal names the ticket — “issuer not certified —
FIRSTAID” is a person and a certificate, which is a fixable thing. - Exclusivity is by overlap, not by simultaneity — two hot work permits whose windows merely touch still mean two crews with a flame on the same vessel.
Somebody has to walk to the panel
A type saying isolation is required and a permit recording that isolation happened are two different facts. Confirming it is a separate act from issuing it, deliberately — folding it into the paperwork would mean the paperwork could claim it happened.
- Until it is confirmed, the permit is not in force — however current its window, however properly signed.
- The points are recorded in words — “supply fan breaker locked off”, “damper actuator air bled” — beside the permit they belong to.
- The panel says what is waiting — “issued and waiting on isolation”, because “no permit is in force” is true and hides the most relevant thing on the page.
- A cancellation says why — the reason is appended to the permit rather than lost with it.
Asbestos is in a building, not in one room of it
A hazard recorded against a facility applies to everything inside it. Recording it once per room would mean that the day somebody adds a room, the asbestos is not in it — so hazards roll down the location tree, and an inherited one always says where it came from.
Worst first, because that is what somebody is looking for
Somebody reading this before walking to a job wants the thing that can kill them at the top, not the alphabetically first thing. So the list sorts by severity, the harm is a sentence rather than a category, and an inherited hazard names the building it came from.
- An inherited hazard names its source — “inherited from Science & Engineering Building”. Asbestos with no explanation on a room whose record never mentions it reads like a data error; named, it reads like the truth.
- Four severities, deliberately — a five-point scale invites debate about the middle three, and the debate is never about the ones that matter.
- The harm is written to be read — “permanent hearing loss above 85 dBA over a shift”, because a hazard register written in categories is one nobody opens before a job.
- An empty panel admits it is empty — “silence rather than a reassuring tick: nobody has assessed it”, which is the one sentence a safety tab must never replace with a green check.
- The same tab on three kinds of record — a machine, a place and a model each gain it, without any of those modules knowing this one exists.
What this is, and what it is not
This is the safety layer inside a maintenance system — the part that makes sure a job knows what can hurt somebody and whether it is authorized. It is not a safety management system, and that difference is worth saying on a web page rather than discovering in a procurement meeting.
The parts we do not have, named
Safety is the module where over-claiming does the most damage, because the person who finds out is the one it was meant to protect. So the absences get the same treatment as the features.
- No incident or near-miss reporting — none, and we will not imply otherwise. It is a different product category, and a maintenance system that pretends to it gets one incident logged and never a second.
- No risk matrix — one severity on the hazard, four levels, described as “how bad it is if the controls fail”. There is no likelihood axis and no score, so if your process needs a scored assessment per job, this is not that.
- Not a full lockout/tagout programme — isolation is a rule, a confirmed fact and a list of points in words. There is no padlock register, no per-point lock-tag-verify state and no group lockbox.
- Certifications live with your people records — safety asks whether a ticket is valid on a date rather than keeping a second copy to drift out of step with the first.
Everything around the permit
Your word for a permit
A refinery says Work Permit, a hospital says Authorization to Work, a utility says Clearance. The tab, the heading and the type all follow your vocabulary — including the word people click.
PPE standards are never renamed
“Gloves” is not a specification: class 0 insulating gloves and general-purpose gloves are both gloves, and one of them is what stops an electrician dying. So the standard rides on the item — CSA Z94.1 stays CSA Z94.1.
One moment, every row
The board reads as of a single instant, stamped at the top — so two rows can never disagree about what time it is, and “in force” means in force right then.
Filter by in force, not by status
Because Active and authorizing are different facts, and the filter that matters is the one that tells them apart.
It refuses to start broken
A hazard pointing at a PPE code or permit type that does not exist would be a requirement nobody could satisfy — discovered by whoever it was meant to protect. So the register refuses to load rather than open with a hole in it.
Exclusive where it matters
Two crews can work at height on the same building without endangering each other; two cannot have a flame on the same vessel. Exclusivity is set per type rather than imposed on all of them.
Four figures on one page
In force, expired-and-still-open, the hazard library, and how many hazards are attached to something — because a hazard nobody has attached to anything is a definition, and a definition hurts nobody.
Who holds it, who signed it
Both are on the permit, and either can be searched — “what is this person holding, and what have they signed for?” is a question with one answer.
Two languages, all the way down
Every label, hint, empty state and refusal exists in English and French — including the sentence that says nobody has assessed this machine.
Refusals, not warnings
A warning is something a busy person clicks past. Everywhere the safety rules matter, they are refusals — and everywhere a list could drift out of step with another, it is derived instead of typed twice.
Refusals, not warnings
Issuer-is-holder, an uncertified signer, a permit longer than its type allows, a clash on the same equipment — each is a refusal that names its own reason.
Derived, never hand-kept
Hazards are the one list kept by hand; PPE, permits and certifications derive from them — because four hand-kept lists are four lists that drift apart, with the safety one drifting silently.
Bilingual by birth
Full en-CA / fr-CA parity on every screen, hint, empty state and refusal — plurals handled properly, not by concatenation.
Accessible to everyone
WCAG 2.2 AA as a build rule: real table semantics, states announced in words, and focus that moves to the field an error refers to.
Before you book the demo
Can we report incidents and near misses?
What can we actually do on screen today?
Is there a JSA, or a risk matrix?
Is this a full lockout/tagout programme?
Does a missing permit stop somebody starting work?
What does block a work order from closing?
Where do certifications live?
Do hazards on a building apply to the equipment inside it?
What happens when a machine has nothing recorded?
Can we use our own words and our own hazards?
Is there an audit trail?
How would we start?
Bring the permit nobody closed.
Every site has one — the piece of paper still on the board from a job that finished on Tuesday. Show us the equipment, the permit type and who is allowed to sign it, and we'll model it: the window, the tickets each side needs, and the isolation that has to be confirmed before it authorizes anything at all.