SIMOPS Risk Management When Safe Jobs Become Unsafe Together
A lift plan can be sound. A hot work permit can be valid. A confined space entry can be properly risk assessed. A vessel movement can be routine. Put them in the same time window, inside the same operating envelope, and the risk picture can change completely.
That is the central problem with simultaneous operations, or SIMOPS. The danger is rarely that teams forgot how to do their own job. The danger is that separately controlled work packages interact in ways the individual permits, work packs, method statements, and job hazard analyses do not fully see.
High-risk industries have known this for decades. Offshore drilling, live plant maintenance, major construction, marine logistics, commissioning, shutdowns, mining, and infrastructure projects all depend on parallel work. Sequential work is often commercially unrealistic. Yet the evidence from major accident investigations, process safety research, human factors, and control-of-work guidance is clear: interfaces are where assumptions hide.
SIMOPS risk management is not a calendar exercise. It is the disciplined control of interaction risk.
Why Independently Safe Work Can Become Unsafe Together
Most conventional HSE systems are built around a work activity. The permit asks what the task is, where it will occur, who will do it, what hazards it creates, and what controls are required. That is necessary, but not enough.
SIMOPS asks a harder question:
What changes when this task happens next to another task, above it, below it, upstream of it, downstream of it, or at the same time?
A hot work job may be adequately controlled when gas testing, fire watch, isolation, and combustible materials management are in place. A confined space entry may also be adequately controlled when atmospheric testing, ventilation, rescue planning, and isolation are confirmed. But if hot work starts near the ventilation intake for the confined space, or if welding fumes migrate into the entry location, the controls no longer stand alone.
A lifting operation may have a defined exclusion zone. Vehicle movements may have a traffic management plan. If the lift exclusion zone pushes pedestrians into a haul road, or the traffic diversion routes vehicles under a suspended load, neither plan has failed internally. The interface has failed.
This is why SIMOPS deserves more than a line on a permit.
Interaction Risk Is Not Additive
A common mistake is to treat SIMOPS as simple risk addition. Task A has a medium risk rating. Task B has a low risk rating. Together they become medium-high. That may be convenient, but it is often technically weak.
Interaction risk can be nonlinear. A small change in timing, location, energy state, or authority can create a new accident pathway. Examples include:
Excavation near live underground services during commissioning when cable energization status changes during the shift
Marine cargo transfer while diving, ROV work, or over-water lifting is underway
Drilling operations during simultaneous well intervention, crane work, or mud system maintenance
Construction work inside an operating plant where process conditions influence gas release potential
Commissioning of electrical systems while mechanical completion punch-list work continues in the same area
Maintenance on rotating equipment while nearby scaffold modification changes access and egress routes
Hot work near temporary chemical storage, fuel transfer, coating operations, or hydrocarbon drains
Major accident investigations repeatedly show how weak interfaces, unclear decision rights, degraded communication, and work pressure contribute to loss of control. The U.S. Chemical Safety Board, UK Health and Safety Executive, National Transportation Safety Board, and offshore regulators have all emphasized organizational and control-of-work factors in serious events. The lesson is not that people failed to “pay attention.” The lesson is that systems allowed conflicting work conditions to coexist.
SIMOPS Is Often Hidden Inside Normal Work
Experienced sites often say, “We do SIMOPS every day.” That may be true. It can also be dangerous if routine concurrency becomes invisible.
Normal plant operation during maintenance is SIMOPS. So is simultaneous civil work and electrical energization. So is crane access through an area with live vehicle routes. So is commissioning a package while construction teams finish insulation, punch-list work, or instrument checks nearby.
The term is sometimes reserved for offshore drilling or major turnaround work. That narrow view misses many severe exposures. In practice, SIMOPS exists when two or more activities can affect each other through:
Physical proximity
Shared access or egress
Shared energy sources
Shared lifting, transport, or marine corridors
Common isolations or process boundaries
Overlapping exclusion zones
Competing alarms, radios, or command channels
Changing plant status
Conflicting supervisors or area owners
If those links are not visible, the risk control system may give a false sense of completeness.
The Main Types of SIMOPS Interface Failure
A mature SIMOPS program should look beyond “too many people in one area.” Congestion matters, but the deeper issue is how work systems couple together.
Shared Energy Sources and Changing Energy States
Energy control sits at the heart of high-risk work. OSHA’s control of hazardous energy requirements, process safety management expectations, and industry lockout and isolation practices all recognize that harm often follows uncontrolled release of energy.
SIMOPS makes this harder because energy states can change while another job is still relying on an earlier condition.
Commissioning is a classic example. A system that was dead yesterday may be energized today for testing. A line that was depressurized during mechanical work may be reintroduced to process conditions. A motor rotation test may affect nearby alignment work. Temporary power may be installed for one activity and create electrical exposure for another.
Warning signs include:
Multiple isolation certificates affecting the same system
Temporary bypasses, jumpers, blinds, or hoses not shown clearly on field drawings
Commissioning boundaries moving faster than permit updates
Energization notices issued by email but not reflected at the work front
Different color coding or tagging systems used by contractors, operations, and commissioning teams
The practical question is simple: Who owns the current energy state of the area, and who has authority to change it?
If the answer is spread across construction, operations, commissioning, electrical, and vendor representatives, SIMOPS controls must define one controlling authority for the boundary.
Conflicting Exclusion Zones
Exclusion zones are often designed task by task. A crane creates a drop zone. Hot work creates a spark and fire watch zone. Radiography creates a controlled radiation area. Blasting or pressure testing creates a stored-energy hazard zone. Excavation requires edge protection and plant separation. Marine operations create approach, mooring, and propeller wash zones.
The conflict appears when those zones overlap, displace people, or require controls that undermine another task.
Examples include:
A crane exclusion zone blocks emergency egress from a confined space entry.
A hot work fire watch cannot maintain line of sight because scaffold sheeting is installed for another crew.
Excavated trenches force forklifts into pedestrian routes.
A marine vessel exclusion zone overlaps a diving operation or over-side maintenance.
Pressure testing requires a cleared area while commissioning personnel need access to verify instrumentation.
A concrete pour changes access for emergency response to a live plant area.
A SIMOPS matrix should not simply list “lifting and hot work: permitted with controls.” It should ask whether each activity’s exclusion zone can be maintained without weakening another activity’s controls.
Communication Overload and Channel Conflict
Human factors research from aviation, nuclear, healthcare, and process industries has long shown that communication degrades under workload, time pressure, ambiguous authority, and noisy environments. NASA’s work on crew resource management and accident investigation methods, along with resilience engineering research, points to the same issue: teams often adapt successfully until the system asks them to coordinate too much with too little shared awareness.
In SIMOPS, communication failures are not always about missing messages. They are often about too many messages competing for attention.
On a large construction or offshore site, separate teams may use different radio channels, permit boards, shift logs, toolbox talks, handover formats, and planning meetings. Each method may be reasonable. Together they can fragment the operational picture.
Warning signs include:
Supervisors attending several coordination meetings but still discovering work conflicts in the field
Radio channels crowded with logistics, lifting, plant operations, and emergency traffic
Contractors relying on their own permit copies rather than a live area plan
Field teams unaware that another job has started nearby
Minor changes approved locally without informing the area authority
“We told them” becoming the main evidence of communication
A good SIMOPS system does not rely on more talk. It creates fewer, clearer coordination points, with defined decision rights and a live view of work boundaries.
Unclear Authority at the Interface
Most organizations define task authority. The lifting supervisor controls the lift. The entry supervisor controls the confined space. The electrical authority controls energization. The operations supervisor controls plant status. The marine controller manages vessel movements.
SIMOPS failure occurs when no one clearly controls the interface between those authorities.
Consider maintenance on live plant during a construction campaign. Operations may own the plant, construction may own temporary works, maintenance may own the work order, and a project team may own schedule integration. If a conflict emerges, such as an urgent lift blocking access to an operating unit during hot work, who has the final call?
Recognized control-of-work guidance from high-hazard sectors, including IOGP operating management system guidance and UK HSE permit-to-work guidance, places strong emphasis on authorization, coordination, communication, and change control. Those elements matter because control fails when authority becomes distributed but not integrated.
A simple test is useful: if two supervisors disagree about whether work can proceed, does the system identify a single area authority who can stop, sequence, or escalate the work?
If not, the SIMOPS system is incomplete.
Where Conventional HSE Systems Miss SIMOPS Risk
Many organizations believe they already control SIMOPS because they have permit-to-work, job hazard analysis, method statements, lift plans, isolations, toolbox talks, look-ahead schedules, and pre-start meetings.
Those tools are necessary. They can still miss interaction risk for several reasons.
The Permit Sees the Job, Not the Operating Picture
A permit-to-work system usually captures hazards generated by the permitted task. It may ask about adjacent work, but the quality of that review depends on the reviewer’s knowledge of what else is happening.
If permits are approved independently, at different times, by different authorizers, the system can produce individually valid permits that conflict in practice.
For example, a permit for scaffold erection may be valid in Area B. A permit for hydrotesting may be valid in the same area later that day. A permit for instrument commissioning may also be valid. The conflict appears only when hydrotest exclusion, scaffold access, and commissioning walkdowns collide.
Risk Assessments Freeze a Moving Situation
Work packs often describe the planned job under expected conditions. SIMOPS risk develops when conditions change:
A vessel arrives late and cargo work shifts into night operations.
A lift overruns and overlaps with a planned confined space entry.
Weather changes crane radius, marine approach, or ventilation effectiveness.
An excavation discovers an unknown service.
Commissioning energizes a system earlier than expected.
Production changes process conditions in live plant.
A contractor adds a second crew to recover schedule.
Static risk assessments struggle with dynamic boundaries. That is why SIMOPS control needs reassessment triggers, not just pre-job approval.
Planning Tools Do Not Always Represent Physical Space
Gantt charts show sequence. They rarely show interference well. A schedule may show “mechanical completion,” “electrical testing,” “painting,” “lifting,” and “operations support” as separate lines. It may not show that all five require the same laydown area, access road, scaffold bay, crane pad, or deck space.
Spatial planning matters. Many effective SIMOPS programs use marked-up plot plans, deck plans, 3D models, permit maps, or digital control-of-work displays. The value is not the software. The value is a shared physical picture.
Contractor Interfaces Create Administrative Gaps
Contractors often bring strong internal systems. Problems arise when contractor systems meet owner systems, marine systems, commissioning systems, or other contractor systems.
A civil contractor may manage excavation permits well. The electrical commissioning team may manage energization well. The interface between buried services, temporary access, energization schedules, and changing exclusion zones may be less well owned.
ISO 45001 expects organizations to coordinate relevant parts of the occupational health and safety management system with contractors and other parties. In SIMOPS, that principle becomes very practical: coordination must reach the field boundary where one organization’s work changes another organization’s risk.
Practical Controls That Make SIMOPS Work
A strong SIMOPS process should be simple enough to use under pressure and structured enough to detect conflicts before work starts. The goal is not to create another approval layer. The goal is to make interaction risk visible and controllable.
Build a SIMOPS Matrix That Tests Interactions
A SIMOPS matrix is one of the most common tools, especially in offshore, shutdown, and commissioning environments. Poor matrices become checklists. Good matrices become decision aids.
A useful matrix compares activities such as lifting, hot work, confined space entry, marine movements, drilling, pressure testing, excavation, energization, radiography, vehicle movement, live plant maintenance, and commissioning.
It should not only mark combinations as allowed or prohibited. It should specify control expectations.
Interaction | Typical Concern | Control Question |
Lifting and confined space entry | Suspended load, blocked rescue route, communication conflict | Can entry, rescue, and lift exclusion zones remain independent? |
Hot work and live plant | Ignition source near flammable release potential | Has plant status, gas testing, ventilation, and drain management been verified together? |
Excavation and energization | Contact with services, changing cable status | Who confirms underground services and controls energization timing? |
Marine movement and over-side work | Vessel impact, wake, mooring line, propeller wash | Does marine control have a live view of all over-water work? |
Commissioning and construction punch work | Changing energy state, incomplete guarding, access conflict | Are system boundaries marked and controlled in the field? |
Vehicle movement and lifting | Traffic diversion into drop zone | Do traffic routes remain safe when the lift exclusion zone is active? |
A strong matrix uses categories such as:
Prohibited
Allowed only with area authority approval
Allowed with defined separation
Allowed with time separation
Allowed with additional controls
No significant interaction expected
The key is to avoid false precision. The matrix should guide professional judgment, not replace it.
Use Area Authority, Not Just Task Authorization
SIMOPS needs a role that owns the operational space. Titles vary: area authority, site controller, performing authority coordinator, offshore installation manager, control room authority, marine controller, construction manager, commissioning lead, or permit coordinator.
The title matters less than the mandate.
The area authority should be able to:
View all active and planned work in the area
Challenge permits that conflict
Set time or physical separation
Suspend work when boundaries change
Coordinate with operations, construction, marine, drilling, commissioning, and contractors
Escalate unresolved conflicts
Confirm that field conditions match the plan
This role should not become a clerical permit stamp. It must carry operational authority.
Make Coordination Meetings Short, Visual, and Decision-Based
SIMOPS meetings often fail because they become status updates. A useful meeting answers a limited set of questions:
What work is planned in each area during the next operational window?
Which jobs create exclusion zones, energy changes, access restrictions, alarms, or emergency response limitations?
Which jobs cannot safely occur together?
Which jobs require sequencing, time separation, or additional authorization?
What changed since the last coordination point?
Who has authority to approve field changes?
The meeting should use visible tools: area maps, permit boards, look-ahead plans, marine movement boards, commissioning boundary drawings, lifting schedules, and isolation registers.
For complex work, the best coordination rhythm often includes:
A look-ahead review several days out
A next-day SIMOPS review
A shift-start confirmation
A mid-shift dynamic reassessment where conditions are changing
A closeout and handover that records deviations, suspended work, and changed boundaries
Define Dynamic Reassessment Triggers
A SIMOPS plan approved at 7:00 a.m. may be wrong by 10:30 a.m. if work overruns, weather changes, or plant status shifts.
Dynamic reassessment should be triggered by clear conditions, including:
A new activity entering the area
Work extending beyond its planned time window
Any change to plant energy state, isolation, or commissioning boundary
Lifting radius, load path, or crane setup change
Marine movement delay or unscheduled vessel approach
Gas test failure, ventilation change, or alarm activation
Discovery of unknown services during excavation
Loss of communication, lighting, access, or emergency response capability
Weather changes affecting lifting, marine, work at height, excavation, or confined space entry
Any supervisor uncertainty about authority or boundaries
This is where stop-work authority must be practical. Stop work should not require proving that serious danger already exists. SIMOPS stop criteria should include loss of boundary control, unresolved conflict, or uncertainty about energy state.
Control Boundary Changes in the Field
SIMOPS fails when the board says one thing and the worksite says another.
Field controls should make boundaries visible:
Physical barriers for exclusion zones, not just tape where hard control is needed
Posted drawings showing live plant, commissioning boundaries, and restricted areas
Clear tagging for energy status and isolation points
Dedicated access and egress routes
Radio channels or call signs assigned for critical activities
Signage that states who controls the area
Field verification before simultaneous work starts
Permit suspension when the work area changes materially
For live plant, the interface with operations is critical. Production changes can alter gas release potential, pressure, temperature, chemical exposure, noise, alarm response, and access requirements. Operations must be involved in SIMOPS decisions, not simply informed after approval.
Leadership Questions and Warning Signs
Senior leaders and project managers do not need to attend every permit review. They do need to know whether SIMOPS risk is being controlled or normalized.
The most useful leadership questions are direct:
Which activities are prohibited from occurring together on this site?
Who has authority to stop or resequence conflicting work?
Where are our current highest SIMOPS areas?
What work creates changing energy states this week?
Where do lifting, vehicle routes, hot work, confined space entry, excavation, and commissioning overlap?
How do we know contractors are using the same boundary information?
What was the last job stopped because of SIMOPS conflict?
Are permit approvals being delayed or challenged for the right reasons?
Can the control room, field supervisor, marine controller, and contractor lead describe the same work picture?
Warning signs deserve attention:
SIMOPS approval is treated as a paperwork step.
Every conflict is solved by “communicate with adjacent crews.”
Different teams maintain separate plans that do not match.
Work regularly starts before area coordination is complete.
The same supervisor covers too many high-risk simultaneous tasks.
Field changes are approved informally to protect schedule.
Exclusion zones are adjusted in the field without reassessment.
Energization and commissioning notices are not integrated with permits.
Traffic routes, crane pads, laydown areas, and emergency access are planned late.
Contractors report conflicts that the permit office did not detect.
These are not weak culture indicators in the abstract. They are operational evidence that the organization may be exceeding its coordination capacity.
When SIMOPS Should Be Escalated
Not every overlap requires senior approval. Over-escalation clogs the system and trains teams to work around it. The challenge is to define the combinations that need higher-level review.
Escalation is usually justified when:
High-energy work overlaps with live plant or public interface exposure
Multiple critical activities share the same access, egress, or exclusion zone
Authority is split across organizations or disciplines
Work affects emergency response capability
Commissioning changes energy states during construction or maintenance
Marine movements overlap with over-side work, diving, or critical lifting
The work has major accident hazard potential
Time pressure is driving resequencing
The SIMOPS matrix gives an ambiguous result
Field conditions do not match the plan
Escalation should not be seen as a failure. In high-risk work, escalation is often the correct control.
Building SIMOPS Into the Management System
The strongest organizations do not run SIMOPS as a special campaign only during turnarounds or offshore campaigns. They build it into planning, permitting, supervision, and learning.
Practical steps include:
Define SIMOPS clearly
Include physical proximity, shared energy states, access conflicts, live plant interfaces, marine operations, and commissioning changes. Do not restrict the definition to major projects.
Create a site-specific SIMOPS matrix
Use actual site activities, not a generic template. Validate it with operations, maintenance, construction, commissioning, marine, drilling, logistics, and emergency response.
Assign area authority
Give the role clear decision rights. Make sure task supervisors understand when area authority overrides task preference.
Integrate with permit-to-work
The permit system should flag adjacent work, incompatible activities, energy changes, and exclusion zone conflicts. Work approval should reflect the live area plan.
Use spatial planning
Mark up plot plans, deck layouts, access roads, excavation zones, crane locations, confined spaces, traffic routes, emergency routes, and laydown areas.
Set reassessment triggers
Make change recognition part of the formal process. Overruns, weather, energization, plant changes, and access changes should all prompt review.
Train for interface recognition
Experienced supervisors do not need generic safety messages. They need realistic scenarios showing how controlled work becomes unsafe through interaction.
Review stopped or resequenced work
Treat successful intervention as useful intelligence. If work was stopped because of SIMOPS risk, study how the conflict reached the field.
Audit the field, not just the permits
Compare the permit board, schedule, isolations, physical barriers, and actual worksite. Mismatches tell the truth.
10. Learn from high-hazard guidance and investigations
Use IOGP, Energy Institute, OSHA, UK HSE, CSB, NTSB, ISO, and sector-specific regulator guidance to test whether local practice is strong enough.
A final point matters. SIMOPS risk management should not become a bureaucracy that blocks all parallel work. High-risk industries need simultaneous work to operate, maintain, build, drill, commission, and respond. The professional standard is not zero concurrency. The standard is controlled concurrency, with clear boundaries, competent authority, and the discipline to stop when the operating picture changes.
Professional Takeaway
SIMOPS incidents often begin with work that looked acceptable in isolation. The weak point is the interface: shared energy, overlapping exclusion zones, changing boundaries, communication load, and unclear authority.
Effective SIMOPS risk management makes those interfaces visible before the job starts and keeps them visible as the job changes. The practical test is simple. If two safe jobs become unsafe together, the system should detect the conflict, assign authority, control the boundary, and stop or resequence the work before the field has to improvise.
Professional References and Further Reading
International Association of Oil & Gas Producers, guidance on operating management systems, control of work, and simultaneous operations in high-hazard environments
Energy Institute, guidance on permit-to-work systems, human factors, process safety, and control of work
UK Health and Safety Executive, `HSG250 Guidance on Permit-to-Work Systems` and related human factors material
OSHA, Process Safety Management standard, hazardous energy control requirements, hot work, excavation, confined spaces, and construction standards
U.S. Chemical Safety and Hazard Investigation Board, investigation reports on major process safety incidents and organizational control failures
ISO 45001, Occupational Health and Safety Management Systems, including coordination with contractors and other interested parties
ISO 31000, Risk Management Guidelines, particularly risk context, change, communication, and monitoring principles
Resilience engineering and human factors literature from researchers and institutions working on complex socio-technical systems, including work associated with NASA, aviation safety, and high-reliability operations
