The HV record, kept the way the rules are written.
Permit to work, sanction for test, switching programme, ITR, hold point, non-conformance, commissioning gate, turnover package. Each one refuses by name when the record behind it is missing.
A safety document is four documents, in one life.
Issue, receipt, clearance, cancellation. Each part is a signature block, and each signer re-enters their own password to sign it. The gate in front of the issue runs in the order a person meets it on site.
The isolation and earthing registers carry lock kinds, key-box keys and signs; a point cannot be released under a document in force unless every such document is acknowledged. The isolation-and-earthing diagram is a pin layer on the single-line drawing, initialled by the recipient. The HV logbook is a read over the audit log — never a table anyone can write to.
Ten questions, asked in the order you meet them.
Not a checklist someone ticks. Each one is a refusal with a sentence, thrown by the server before the document can issue.
State
An issued document is changed only through its transitions. There is no silent edit, and every transition writes the previous and next values.
Self-issue
“A permit to work is issued by one person to another — it is never issued to yourself.” The whole instrument is one person authorising another.
Party
The holder and the approvers are named people on the project — not a role, not a mailbox, not the company.
Competence
The card the document names, held and unexpired — by the holder and by every approver. An org owner without the card is refused too.
Countersignature
A sanction for test is countersigned by a second authorised person before it is issued — and the person who countersigned it does not issue it.
Mutual exclusion
A sanction for test and a permit to work are never live on the same point. Asked before the lock kind, because a live document is the real problem.
Lock kind
Safety locks for a permit; working locks for a sanction. A point under the wrong kind is named in the refusal.
Applied and earthed
Every point of isolation applied by a named person; a permit to work is issued on earthed apparatus, and the earths are on before it issues.
Proved dead
A calibrated instrument, prove–test–prove in that order, and an accompanying second person who is not the one recording it — or the confirm-dead-after-issue exception, recorded with its reason. It is never silent.
Presence
The issuer's device proves its position inside the site radius, or scans the location tag. A desk cannot issue: “Move to the point of work, or scan the location tag.”
Guidance is public: HTM 06-03 · HSG250 §51 · EN 50110-1. The clause references are ours to cite; the clause text is not ours to publish.
Prepared, checked, countersigned — by three different people.
The approver is a Senior Authorised Person who did not prepare it and did not check it, and the declaration they put their name to is one constant: the same words at approval, on the printed schedule, and in the audit row.
- Executed one step at a time, in order only — the operator re-authenticates at the first step of a run.
- An abort records where it stopped and why.
- A go-back is generated as the reversed draft, not typed again.
- The schedule prints with the numbered sequence and the three names.
A limit, a reading, a result and a clause — on every line.
Form fields carry a unit, a minimum, a maximum and a clause reference, so the sheet evaluates itself as it is filled. A placeholder limit never passes.
A failing sheet needs an open NCR
Sign a sheet with a failing reading and it is refused until a non-conformance is open against it. A pending hold point on the section blocks the signature too.
References, never text
Clause numbers and short titles ride on the field. The standard's words stay with the standard's publisher — a clause chip opens a reference, not a copy.
The snapshot is the sheet
A filed form snapshots its template at file time, and editing the template later never touches a signed sheet. The editor no longer wipes limits and clauses on save.
| Standard | Sheets shipped | Limit values |
|---|---|---|
| IEC · IEEE | HV cable termination (60502-2 / 60840) · LV assembly routine verification (61439-1) · HV switchgear (62271-200) · power transformer (60076-1) · earthing system (IEEE 80 / 81) | Placeholder licensed source |
| ANSI/NETA ATS-2025 | MV cable · switchgear & switchboard assembly · transformer, dry & liquid-filled · battery energy storage · photovoltaic | Placeholder licensed source |
| ANSI/NETA ECS-2024 | UPS system commissioning · automatic transfer switch commissioning | Placeholder licensed source |
| BS 7671 — the IET model forms | Electrical Installation Certificate · Minor Works Certificate · Condition Report · Schedule of Test Results | Real source is free |
| NFPA 70E | Energised electrical work permit | Placeholder licensed source |
Owner action O1 · with your accounts Four of these standards were rewritten inside eighteen months, so any certificate library has to be redone within a year — and where the source is licensed, its limit values are not ours to ship. Those sheets carry placeholders and a “populate from your standard” checklist, and a placeholder limit never passes until you work through it against your own copy. The clause references and the sheet structure are ours; the numbers behind a paywall are yours to enter.
A failed certificate reaches back.
Status is derived, never typed: active, lapsed, quarantined, uncalibrated, retired. A record cannot be confirmed on an instrument that could not have carried it — refused with one sentence, and the picker shows the same sentence before you choose.
- A failed calibration flags every verification and signed form that cited the instrument since its last good certificate.
- One audit row per record, and each confirmer is told.
- No certificate on record makes an instrument “uncalibrated” — unusable, not merely unknown (ISO 9001 7.1.5).
- Competence rides alongside: confirming against a checklist that names a competence requires the reviewer to hold it.
The September research found no product that invalidates a record when an instrument is found out of calibration.
The value arrives from the box that measured it.
Instrument software is a silo keyed to the asset; project platforms cannot take a measured value. This one takes the export and shows it against the sheet before anything is written.
PowerDB, Fluke, OMICRON
An export is previewed against the sheet and matched by a documented heuristic — unit veto, position-marker veto, two-way token agreement. Every mapping is confirmed by a person; nothing lands unattended.
A batch is asked once per day
Readings taken across several days each meet the calibration gate for their own day — not for the day the file was uploaded.
Manual and Bluetooth, through a seam
IEEE 11073 / IEEE 754 parsers and generic GATT profiles sit behind one documented adapter. There is no native module yet, and the simulated adapter says so on the record.
Owner action O2 · with your accounts
A point that actually stops the work.
Hold and witness points hang off activities, ITR sections and commissioning gates. While one stands, the booking, the draft, the approval and the signature are all refused — and the refusal quotes the point's own title.
Released by the named party, never its setter
Invited with a notice period; released by the party the point names; waived only by a PM, with a reason the register keeps; proceeded unattended only once the notice has run. “The party that set a hold point does not release it — that is another person's signature.” The owner gets an attendance calendar of what they are expected at.
Actioned by one person, verified by another
Raised from a failed sheet, a snag, an audit or on its own; actioned with a root cause and what was done; the effectiveness verified by someone who neither raised nor actioned it; closed by a PM or QA; reopened with a reason. “The person who actioned a non-conformance does not verify it — effectiveness needs a second pair of eyes.”
Calibration status · NCR log · competence matrix · document control
The four registers an auditor asks for, assembled as one page, as CSVs and as a PDF over a date range you choose — read from the same rows the site was working in, not re-keyed for the audit.
Five levels, and one sentence when a gate is stuck.
A level cannot start until the one below it is released, and a release is the named party's act — never the act of the person who started it.
| Level | What it is | What stands in the way |
|---|---|---|
| L1 | Factory acceptance | A standing hold point on the gate |
| L2 | Site acceptance | No signed ITR attached · L1 not released |
| L3 | Start-up | L2 not released by its named party |
| L4 | Functional performance | An open major issue on the system · L3 not released |
| L5 | Integrated systems test | L4 not released · the script not approved |
A script frozen by version, a run that snapshots it
Steps in order with hold points that wait for a sign-off party; deviations raised live into the issues log; trend imports per step window with the full-series extremes kept; per-scenario results and multi-party sign-off. The desk shows the script and the live log side by side; the phone shows one step at a time. It prints as a record.
ASHRAE Guideline 0 shape, verified by a second person
The person who resolved an issue is never the person who verifies it. The weekly Cx report says what moved; the ten-section test pack names the calibration certificate behind every ITR in it.
Wherever a gate is stuck, one sentence names the blocker — “You started this level — releasing it is another person's signature.”
Seven steps forward, each gated by the record that proves it.
The asset is the object every record hangs off. Its status arc runs forward, one step at a time, and a step with no record behind it is refused by name.
Specified
The register's own first row
Ordered
The order raised against it
Delivered
A confirmed goods receipt
Installed
A confirmed verification
Tested
A signed ITR
Commissioned
L4 released
Accepted
An issued handover package
An owner-furnished asset needs its rating plate and a second person at the gate as well. The nameplate read is a labelled AI draft a person confirms — and without a vision model the draft is empty at zero confidence, rather than an invented serial. Verifications, ITRs and snags can name their asset; the dossier lists every record that does.
Twelve sections the client accepts, not a promise.
A turnover package is assembled from the asset dossier in twelve stated sections and exported as an archive — record PDFs printed in-process as the person who pressed Export, the photographs, a table of contents and a manifest.
- Issued by a project manager; accepted by the client on the portal, where the archive downloads through their own token.
- COBie in the eight BS 1192-4 sheets; CMMS exports in the Maximo and SAP shapes, both as snapshots.
- A warranty and defects-liability register, with defects linked to snags and shown to the owner.
- An issued package does not change: “its archive is the record of what the client was handed.”
Every document says what it is, and what it is not.
A headless browser prints the page you were looking at — through the app's own print stylesheet, not an export template maintained somewhere else.
| Document | What prints | The line it carries |
|---|---|---|
| Safety document | Its own tint, its serial, the presence line, every signature block and the edit log | “Display at the work location.” |
| Switching schedule | The numbered sequence with prepared, checked and countersigned | The HTM declaration, verbatim |
| ITR | Limit, reading, result and clause, per line | A placeholder limit never passes |
| Arc-flash label | An ANSI Z535-shaped label off the study | Five-year review alarm on the study |
| ISO 9001 pack | A page, four CSVs and a PDF over your date range | Calibration · NCR · competence · document control |
| Every PDF | Producer, the record ids and the approval lineage in its metadata | “App-signed; not hardware-attested” |
| The day's record root | A Merkle root over photos, verifications, signed forms and issued permits | Without a timestamp authority: “not a qualified timestamp” |
Owner action O5 · with your accounts Signing binds a person: the witness re-enters their password within five minutes, and the server signs the document hash, the signer, the time and the re-authentication under an Ed25519 key. The drawn signature stays decoration. The daily root is timestamped through RFC 3161 against a timestamp authority you configure; without one a local stub signs and is labelled “not a qualified timestamp” everywhere it appears.
The registers that were already here.
Permits, submittals, drawings, RFIs, minutes, the muster and the gate — the same rules, in less space.
The raiser closes it
Question, answer, acceptance by the asker. A late answer shows as late, against whoever owes it.
The muster and the gate
Payroll and subcontract labour mustered as names, not user accounts. Every gate movement carries a reference and who recorded it.
A window with signatures on it
A start, an end, a live countdown and an approval panel the holder is barred from. Issue and cancellation are presence-gated; a rejection sends it back to draft with the reason and voids the earlier signatures. A lost original needs a second person; closing sets three-year retention.
Decisions belong to a revision
Named reviewers and a status derived from their decisions, never typed over them. A resubmit bumps the revision and stales every decision taken on the one before — the reviewers are asked again. The reviewer is never the submitter.
Minutes become owned tasks
Each action becomes a dated task in that person's My Work, recurring series included. Every meeting exports an .ics.
Signing binds a person, not a picture
Seven typed field kinds; the template snapshotted at file time; signing locks the record. The witness re-enters their password within five minutes and the server signs the document hash under its own Ed25519 key. Filed paperwork is part of the record — only drafts can be deleted.
A callout link a person confirms
The vision model reads a sheet's own number and the references printed on it as a labelled draft — and the simulated provider reads nothing and says so. A link becomes navigation only once a person confirms it, matched by exact number and never guessed: a fabricated hyperlink sends an electrician to the wrong drawing. Revision compare rasterises both sheets into one frame and reports what changed as a share of the linework, refusing rather than reporting no change when a raster fails.
Pins carried, issues slip-sheeted, as-builts zipped
Pin migration carries pins onto a new revision for a person to accept, move or drop; a superseded sheet keeps its pins read-only and says so before you reach for a control. Slip-sheeting parses the number and revision from the file name and supersedes only after a confirmed preview. The as-built set exports the current sheets, every reviewed pin and the photographs those pins cite — as a zip whose README says what it is not.
A project's shape, copied not linked
A project template captures a running job's locations, hold-point defaults, cost codes and the checklist and form templates it is evidenced against — as a copy. A new project scaffolds from one in a single transaction. Report templates are built by hand or from a Word document's headings (text only, never styles) and render a closed list of registers under your branding, as a page and as a printable document.
As it stands today.
Screens are from the current build on a reset demo world. No customer has used this product.
If the record cannot be faked,
it cannot be argued with.