The confined space entry permit, on the tablet that goes down the hole. Fill it, certify it, log the air and the entrants, and file it — with or without a signal.
A confined space permit is a hazard checklist, an atmospheric log and an entrant log, stapled together and filled in with a gloved hand at the edge of a hole. CS Permit is those three pages, in the order they are printed, plus the things paper never had room for: photographs of the opening, the documents the crew was working to, and a page of notes for everything that mattered and had no box. It works with no signal, because that is the condition it was built for — a permit written in a vault is queued on the tablet and reaches the office when there is something to reach it with.
A crew that has filled hundreds of these on paper should not have to learn where anything moved to, so the printed order is kept exactly. The last three are what the form could not carry.
Hazards, mitigation and required equipment, in the columns they are printed in. Four certifying signatures — entry supervisor, safety officer, attendant, rescue entrant — captured as ink with a real timestamp against each one. Back at the same space tomorrow, start from today's: the header, hazards and equipment carry over, and the signatures and every preparation check are done again.
Readings checked against the limits printed on the permit as they are typed, so an alarm is in front of somebody immediately. The breach verdict itself is the server's, recomputed against the permit's own limits and never taken from the tablet.
Who is in the space right now, answered at the top of the screen rather than read across a grid. Any crew device can log people in and out — in at one entry point, out at another — and every line says who logged it and on which device.
Temperature, humidity, wind and heat index off the meter, with where each reading was taken. The NWS category shows as the numbers go in, so the crew knows where they stand before they look away.
The state of an opening, a lockout tag, the safety plan the crew was working to — kept with the permit, so the filed record answers what they were working to without anybody going through email a year later.
Typed, or spoken and turned into text on the device, for why the plan changed and what the space was actually like. Usually the first thing anybody reads when a permit is questioned later.
Five of them. Each holds on the server as well as the tablet — the device checks so a crew gets an immediate answer, the server checks because a permit is a legal record and the device is not the authority on it.
A step marked required and not done blocks the entry supervisor's signature, and the permit names what is missing rather than only saying no.
The permit cannot be cancelled while anybody is still logged in.
Every reading is re-evaluated on arrival against the gas limits that belong to that permit.
The header, checklists, signatures and closing belong to one device, and move at a shift change by scanning a code. The logs do not: any crew device can add entrants, readings, notes and photos, and nothing written before a handoff is lost to it.
No entrant can be logged in until all four certifying signatures are on the permit. Logging out is never refused — a gate that can trap somebody inside on the record is worse than no gate at all.
The completed permit has to be available at the entry point for as long as the entry lasts. Posting it is the example the rule gives; any equally effective means will do. The permit never depends on the tablet alone.
At the fourth signature the app offers a copy for the portal, stamped with who certified it and when, and prints it to a portable printer on the truck with no signal needed.
At twenty percent, with an open permit on it, the device says so and offers to print the permit or hand it to another device — while there is still charge to do either.
Hand the permit on by scanning a code, underground, with no signal. Whatever the first device logged reaches the office when it next has a connection.
If there is no printer and no second device, the crew fills in and posts the paper permit page and keeps logging on whatever device they have.
This is being written alongside real standby work, and nearly everything in it changed because somebody used it at a hole and said what was wrong. That is what it is for.
The three pages follow one printed revision. If your permit words a box differently, or has one this does not, that is worth knowing.
Every control is meant to be usable one-handed, at a hole, in the dark. Where it is not, say so.
A permit written underground should lose nothing. Take it somewhere with no bars and try to break it.
The PDF is what has to survive a year. Read one against the paper you would have filed and tell us what is off.
Testing is by invitation while the permit form is still settling. If you run confined space standby and want in, ask.
Email support+cspermit@ihwy.com with the company you run standby for and how many crews would be carrying it.
Apple's TestFlight app, from the App Store, on the iPad or iPhone the crew actually carries.
The invite installs CS Permit. The office issues an enrollment code that ties the tablet to your permits — a device only ever sees the permits it is entitled to.
Not a demo permit on a desk. A permit at a hole, with a crew, on a day you would have filled the paper. That is the only test that has found anything.