Safer permit-to-work in oil & gas with digital twins

Every year, unplanned shutdowns cost the Global 500 an estimated $1.4 trillion in lost production, with process industries accounting for a disproportionate share. In oil and gas specifically, a significant portion of that cost traces back not to equipment failure but to human-factors incidents during maintenance and modification work: isolations performed out of sequence, wrong valves operated, permits signed off on incomplete information. The stakes are not financial alone. Hydrocarbon releases and energy isolation failures kill people.

This piece looks at why the permit-to-work system, despite decades of regulatory refinement, still produces incidents at the execution layer, and what it means practically to close the gap between the written permit and what happens in the field.

Where the permit-to-work system breaks down

Permit-to-work is a well-established control. OSHA’s process safety management framework lists it as a core element of a recognised programme, alongside hazard analysis, mechanical integrity, and management of change. The logic is sound: before hazardous work begins, the hazards are identified, controls are put in place, and authorisation is documented.

The failure mode is not in the design of the system. It is in the translation from paper to practice. A permit describes what should happen. It does not see what is actually happening. An operator working from a P&ID, a printed permit, and a verbal handover is operating from an abstract representation of the plant. If the plant has drifted from the drawings, if the valve is mislabelled, or if the isolation sequence is ambiguous across two adjacent lines, the permit provides no correction.

Incident investigation reports across the sector repeat a consistent pattern: isolation errors, where the wrong valve was operated or the correct valve was operated in the wrong order; verification failures, where lock-out/tag-out was assumed rather than confirmed; and knowledge transfer gaps, where a task that a veteran would complete safely became hazardous in the hands of a contractor unfamiliar with that particular unit.

The execution gap and why it persists

The phrase “execution gap” refers to the distance between what the permit authorises and what can be verified in the field. In a large process unit, that distance is both physical and informational. The permit is held at the control room or permit office. The work is happening on level four of a debutaniser structure, thirty metres away, in a noisy environment, under time pressure from a turnaround schedule.

Three structural conditions sustain the gap. First, permits are still predominantly paper-based or converted to PDF equivalents that replicate the paper format without adding interactivity. Second, the spatial knowledge required to execute a complex isolation correctly, knowing which valve, in which order, in which physical direction from your current position, lives in the heads of experienced operators rather than in the permit itself. Third, contractor workforces rotate constantly. A major turnaround may bring in hundreds of contractors who have never set foot on that site. The onboarding window is short and the plant is complex.

What capturing the site as a twin changes

A spatial digital twin, a photorealistic, navigable model of the physical plant tied to its asset register, changes the information available at the point of work. Instead of a schematic, the operator sees the actual valve in context. Instead of a numbered list on a permit, isolation steps are pinned to the physical objects they act on and presented in the order the work proceeds through the plant.

Step-locking is the critical mechanism. In a step-locked guided isolation, each action must be confirmed complete before the next one becomes visible. The system cannot be skipped or reordered from the field. The completed sequence is logged with timestamps and user identifiers, producing an audit trail that reflects what was done, not just what was authorised. That trail has direct value for incident investigation, but it also changes the behaviour of the work itself: people perform steps differently when they know the record is created at execution time rather than written up afterwards.

Spatial context matters for contractor onboarding as well. A contractor crew can walk the unit virtually before mobilisation, learning the layout, identifying hazard zones, and rehearsing the approach to a complex isolation. That preparation does not replace a site induction or a permit briefing. But it compresses the orientation time that would otherwise be spent on the plant itself, under live process conditions, in a turnaround window where every hour on the critical path carries a cost.

Turnaround planning and the case for pre-work familiarisation

Turnarounds concentrate risk and cost simultaneously. Hundreds of contractors, dozens of simultaneous work packages, compressed schedules, and a plant that is transitioning between live and isolated states at multiple points. The margin for procedural error is thin.

Pre-work familiarisation on a spatial twin has a measurable effect on one specific problem: the time spent on the tools versus the time spent finding and understanding the work location. Contractors who have navigated the unit virtually before arrival arrive with a spatial map that experienced operators build over years. They can identify the permit boundary, locate the isolation points, and confirm the approach before they put hands on the equipment.

The same spatial model supports permit preparation. Engineers planning the work package can trace the isolation boundary through the twin, confirm that the proposed sequence is physically coherent, and identify any conflicts with adjacent packages before work begins. Conflict identification at the planning stage costs far less than a re-permit on the day.

Process safety management culture and the role of verification

Process safety culture is built on the premise that the system should make the safe procedure the easiest procedure. That principle is well-established in theory but inconsistently applied in practice. One consistent finding in process safety reviews is that manual verification steps, those which require a person to confirm a completed action rather than having the action confirmed by the system, are the most likely steps to be skipped under time pressure.

Digital isolation management does not replace the physical act of operating a valve or fitting a lock. It does, however, change the verification step from optional to required. The next step does not appear until the current one is confirmed. The permit cannot be closed until all steps are logged as complete. That structural enforcement is not a substitute for a safety culture, but it is consistent with what process safety management research describes as a well-designed system: one where the correct action is also the path of least resistance.

Treedis applies this approach in oil and gas environments, with step-locked guided isolations, contractor onboarding on the spatial twin, and a full audit log of execution, linked to the relevant permit. Details are at treedis.com/industries/oil-gas/.

The permit-to-work system will remain the legal and procedural framework for hazardous work in process industries. What can change is the quality of information available when a contractor stands in front of a valve array, and the rigour of the record created when the isolation is complete. Connecting the written permit to the physical work through a verified, step-locked process on the actual asset is not a technology argument. It is a process safety argument: the gap between authorisation and execution is where incidents happen, and closing it requires operating at the point of work, not the permit office.