A preliminary risk analysis organizes hazards, exposure scenarios, controls, and decision points before a maintenance activity. It creates value when it describes the actual work, involves people who understand the process and task, reaches the field, and changes when conditions differ. A signed generic form documents participation but does not demonstrate a useful analysis.
Official Brazilian government sources were consulted on August 23, 2026. Brazilian regulations use risk analysis in several contexts, while organizations may use APR as the Portuguese name for their task level method. The official sources do not establish one universal APR form, mandatory matrix, or generic authorization to perform work. Brazilian NRs do not create obligations outside Brazil. Other jurisdictions must follow local law, authorities, standards, employer procedures, and accountable professionals.
Actual installations and activities require their own assessment, risk inventory, engineering records, training, procedures, applicable work permits, and decisions by accountable people.
Risk management, analysis, work order, and permit
Brazilian NR-1 structures occupational risk management through a risk inventory and action plan. A preliminary task analysis can detail an intervention within that system. It does not replace the continuous management process or repair an outdated inventory by itself.
The maintenance work order identifies the technical object, scope, materials, resources, window, and asset history. The task risk analysis evaluates how that scope may expose people and what controls are needed. A work permit, when required by a regulation or company procedure, authorizes specific work under stated conditions. These records can be linked without losing their individual purposes.
Brazilian NR-35 provides a clear official distinction within work at height. Covered work must be preceded by a risk analysis. Routine work may have the analysis included in an operating procedure, while nonroutine work is authorized in advance by a work permit. The permit includes minimum requirements, provisions from the analysis, and the involved people, with limited validity under the stated conditions.
That NR-35 example applies to its own scope and should not be generalized as an identical requirement for every maintenance activity. The applicable regulation and employer procedure must be checked for electrical work, confined spaces, hot work, line opening, excavation, lifting, and other controlled tasks.
A task analysis must describe the real job
“Replace mechanical seal” is not enough if it omits equipment, fluid, temperature, pressure, energy sources, access, lifting, chemicals, simultaneous work, and surroundings. The analysis starts with the expected sequence and the installation condition at the planned time.
Planning gathers drawings, history, work procedures, manuals, process conditions, and earlier lessons. Operations explains process state, changes, and isolation. Maintenance describes tools, movements, contact points, and likely variations. Occupational safety integrates criteria with the risk management system. The people who will execute participate because they recognize differences that may not appear in an office package.
The organization defines the assessment method, matrix, and acceptance criteria. Copying an online score can create false precision. Hazard, scenario, exposed people, existing controls, additional controls, owner, evidence, and acceptance condition need to be understandable and actionable.
Describe a scene, consequence, and control
“Falling,” “energy,” and “chemical” are incomplete labels. A useful line states that while the tube bundle is removed, the suspended load may rotate and strike a person positioned between the exchanger and structure. The team can then define route, lifting equipment, capacity, accessories, exclusion zone, communication, and stop conditions.
Controls follow a hierarchy. Removing exposure, substituting a method, applying engineered barriers, and organizing work precede reliance on behavior or personal protective equipment alone. Some controls belong to engineering, operations, or another accountable function rather than the technician.
A control should be verifiable. “Be careful” offers no test. “Confirm the blind at isolation point ISO-204-B against the approved isolation list with operations and maintenance present” establishes evidence, although the real installation may require a different method.
How analysis passes into a work permit
The analysis supplies conditions and controls that may be carried into a permit. The permit checks whether those conditions exist at the time and authorizes work within its validity and boundaries. A signed permit cannot make an incorrect assumption true. When the field differs, work stops and the analysis returns to the responsible people.
Some sites require multiple authorizations for one intervention, such as confined space entry, work at height, hot work, or electrical work. The organization defines integration and precedence. Combining every decision into one long form can obscure who authorizes each condition.
A permit that has expired, a changed crew, a changed process state, or a revised scope must be handled under the applicable procedure. The digital workflow should surface these conditions instead of silently reusing an earlier approval.
The risk analysis also does not replace lockout and tagout. It identifies unwanted energy release scenarios and required controls. The isolation procedure defines sources, devices, steps, verification, and restoration. An applicable permit confirms conditions and authorization.
Stop and reassess criteria
- The scope, sequence, or method changes after assessment.
- The equipment, line, or tag does not match controlled documents.
- An unlisted energy source, fluid, pressure, or stored condition is found.
- The planned isolation cannot be applied or verified.
- A critical person, tool, material, or equipment item is replaced.
- Simultaneous work creates a new interaction.
- Weather, lighting, ventilation, access, or ground condition changes.
- An alarm, leakage, odor, temperature, or noise indicates abnormal conditions.
- Any participant does not understand a control or considers the condition unsafe.
Stopping is a deliberate barrier when an assumption becomes invalid. Planning must reserve time and authority for reassessment rather than pressuring people to improvise inside the shutdown window.
Roles and evidence
| Role | Contribution | Evidence |
|---|---|---|
| Area manager | Provides resources and stop work authority | Defined responsibilities and decisions |
| Operations | Provides process state, isolation, and interactions | Equipment handover and release |
| Maintenance planning | Connects scope, sequence, documents, and resources | Coherent package and work order |
| Maintenance execution | Explains method, exposure, tools, and changes | Field records and stop decisions |
| Occupational safety | Integrates criteria with risk management | Applicable analysis and oversight |
| Permit issuer | Verifies conditions and authorizes within competence | Valid work permit |
| Workers | Participate, confirm understanding, and stop on deviation | Briefing and defined records |
A list of signatures shows participation. Analysis quality appears in the scenarios, controls, evidence, and decisions rather than in the number of names.
Industrial case: opening exchanger HX-204
Independent teaching scenario: heat exchanger HX-204 has lost performance and its tube bundle will be removed during an 18-hour shutdown. Hot product runs on one side and pressurized water on the other. A hydraulic bundle extractor and overhead crane will move the assembly while another crew works on nearby piping. The asset, values, people, and results were created to explain the method. They do not represent a client, installation, or PM Run result.
Building the work package
The SAP notification records heat-transfer loss and its trend. Engineering defines the technical scope. Planning separates preparation, access, isolation, opening, extraction, inspection, cleaning, assembly, testing, and return. Operations, Maintenance, lifting, inspection, Engineering, and occupational safety participate in the analysis.
The group assesses residual pressure and temperature, product contact, extractor motion, suspended load, crush points, wet floor, line of fire during opening, tools, simultaneous work, and a possible hazardous atmosphere. Confined-space classification depends on official criteria and the actual configuration, not the equipment name.
Filled scenarios and controls
| Scenario | Control decision | Evidence before start |
|---|---|---|
| Product or pressure during opening | Remove from service, isolate, drain, purge, cool, and verify | Accepted isolation list and recorded tests |
| Bundle rotates during extraction | Control the route and keep people outside the line of fire | Inspected equipment and accessories |
| Nearby crew changes the condition | Coordinate work fronts and suspend interference | Joint schedule and controlled area |
| Field condition differs from the drawing | Stop and return the decision to Engineering | Approved revision before scope expansion |
| Leak appears during testing | Depressurize and reassess | Safe state re-established |
Analysis, permit, and isolation
The task analysis describes scenarios and controls. The organization's procedure requires one line-opening permit. Another authorization would be issued only if access were classified under a separate regulated activity. The work order references these records without acting as authorization.
During the pre-job check, a valve on the isolation list does not match its physical tag. The team stops. Operations and Engineering correct the boundary, revise the list, and repeat verification. The analysis is reopened because an isolation assumption changed. The 18-hour target remains subordinate to this decision point.
Execution, results, and history
After controls are restored, the team opens, extracts, and inspects. Unexpected corrosion appears near the tubesheet. Cleaning may continue within scope, but any repair remains conditional on technical assessment. Location, photographs, and measurements enter as a second deviation and reopen the related decision.
After assembly, testing follows defined criteria, the area remains controlled, and return occurs after permit closure and isolation removal under the procedure. The SAP confirmation records work, materials, measurements, verified cause, and recommendations. Engineering and Reliability decide whether the future plan changes.
Day 1 and Day 30 closeout
| Case control | Day 1 | Day 30 |
|---|---|---|
| Scenario, control, and evidence lines | 5/5 reconciled | 5/5 traceable in the order and attachments |
| Found deviations | 2/2 reopened: valve tag and corrosion | 2/2 retained in history, with no closure through labor confirmation |
| Permit and isolation | 1/1 permit and 1/1 list closed after safe return | 2/2 records remain linked to the order |
| Recommendations | 1/2 completed through list correction; 1/2 pending with Engineering | 1/2 completed; 1/2 pending for corrosion assessment, with an owner and Day 45 due date |
Any new tag or drawing discrepancy, simultaneous-work change, product or pressure indication, leak, or corrosion result outside the accountable professional's criterion triggers a stop and reopening of the analysis, isolation, and applicable authorizations. The absence of an accident is not used as evidence of effectiveness. Closeout depends on verified controls, treated deviations, and visible pending work. These results remain didactic and are not performance attributed to PM Run.
Record decisions without turning analysis into paperwork
- Object: link analysis to the correct equipment, location, and order.
- Scope: keep version and sequence aligned with the package.
- Conditions: record process, environment, and simultaneous work assumptions.
- Controls: state owner, evidence, and verification point.
- Permits: reference applicable authorizations without merging their purposes.
- Changes: preserve who stopped, why, revision, and decision.
- Closure: return technical findings to history and the action plan.
The maintenance work order maintains the technical link. A maintenance checklist can support verification without analyzing the scenario.
PM Run and SAP PM boundaries
PM Run is a planning, mobility, and execution layer over SAP PM. It can make the package, documents, sequence, and field records available and return confirmations and evidence to history. That reduces context loss between planning and field work.
PM Run does not perform automatic risk analysis, issue a work permit, validate isolation, detect atmosphere, replace sensors, define procedures, or assume occupational safety and technical responsibility. Required fields can improve completeness but do not prove that a control exists.
Audit and learning
- Is the analysis linked to the executed scope and version?
- Did people who know process and task participate?
- Do scenarios describe concrete exposure?
- Do controls have owners and evidence?
- Were applicable permits valid?
- Did changes trigger stop and reassessment?
- Did findings return to engineering, risk management, plan, or master data?
- Do procedures for routine work preserve relevant variations?
Useful indicators include reassessments after change, preventive stops, expired permits, isolation discrepancies, pending controls, and repeated scenarios. A high number of signed forms does not measure risk analysis quality.
Official sources, date, and limitations
- Brazilian Ministry of Labor and Employment, official NR-1 page, consulted August 23, 2026.
- Official NR-1 wording provided by MTE.
- Official NR-35 page.
- Current NR-35 wording provided by MTE.
- Official NR-10 page, source for electrical risk analysis context.
The technical decision must use the official wording effective on the work date and confirm applicability, incident requirements, and organizational rules. The NR-35 relationship between analysis and work permit remains limited to its Brazilian context and regulatory scope.
Frequently asked questions
Are risk analysis and work permit the same record?
No. Analysis identifies scenarios and controls. A permit authorizes specific work under defined conditions when applicable.
Does every analysis need a numerical matrix?
No universal scale is established here. The organization defines a method coherent with its risk management and applicable requirements.
Does a signed analysis allow work to start?
Not by itself. Scope, controls, isolation, competence, and applicable authorizations must be valid in the field.
Does task analysis replace the Brazilian risk management program?
No. It can detail a task within the system but does not replace the risk inventory and action plan.
Does PM Run create risk analyses automatically?
No. It can support access and records over SAP PM while analysis, decisions, and authorization remain with responsible people.
After the organization defines its process, see how PM Run connects planning, field work, and SAP PM history.
