Simultaneous Operations (SIMOPS) conflict matrix in ePTW: spatial clash detection, well-bay hot-work locks, and PIC/OIM override governance

Topics: simops management, electronic permit to work oil and gas, offshore safety software.

On multi-well onshore shale pads and compact offshore platforms, drilling rigs, wireline/coiled-tubing units, construction welding crews, pedestal cranes, and live hydrocarbon production skids operate within metres of one another across stacked grated decks. Major process safety incidents repeatedly trace back not to the absence of a permit, but to uncoordinated concurrent permits—for example, a construction crew grinding a handrail on the weather deck (+26 m) directly above a wellhead (+18 m) where a wireline crew is bleeding down a lubricator, or a crane swinging a heavy mud pump over a pressurized Christmas tree without a crash deck. While O066 governs single-permit lifecycles and LOTO isolations, this guide (O120) defines the 3D spatial and activity SIMOPS conflict matrix, pairwise clash evaluation engine, vertical drop-cone interlock, and PIC/OIM coordination workflow.

Scope and governance boundary

This article defines the electronic Permit-to-Work (ePTW) and ERP maintenance scheduling control architecture for SIMOPS governance:

• What this workflow governs: Pairwise activity compatibility matrices ($\text{Activity}_i \times \text{Activity}_j \times \text{Spatial/Vertical Relation}$), automatic mutual-exclusion locks (Red clashes), conditional interface checklists (Yellow clashes), dynamic permit suspension on process upsets, and daily SIMOPS coordination board signoffs.
• What this workflow does not replace: It does not replace formal HAZID/SIMOPS risk-assessment workshops conducted by qualified drilling, production, marine, and HSE engineers (IMCA M 203), nor does it substitute automated software logic for the physical deck walkdown and Ultimate Work Authority (UWA) of the OIM or Pad Person-in-Charge (PIC). Software can never downgrade a Red (Prohibited) matrix rule without a formal Management of Change (MoC) signed by the Asset Technical Authority.

1. Step 1 — Record intake & baseline identification: Distinguish individual Permit-to-Work validation (`O066`) from **Simultaneous Operations (SIMOPS) clash governance (`O120`)**: two permits that are individually safe and fully isolated can become catastrophic when activated concurrently in the same fire zone, hydrocarbon dispersion envelope, or vertical crane drop cone ([IMCA M 203](https://www.imca-int.com/product/guidance-on-simultaneous-operations-simops/)).
2. Step 2 — Cross-system reference & custody linkage: Encode a three-tier **SIMOPS Compatibility Matrix** (`Green: Permitted`, `Yellow: Restricted — Requires Interface Controls & PIC Signoff`, `Red: Prohibited — Mutual Exclusion Lock`) across both **3D plant zones (horizontal radius + vertical deck line-of-fire)** and **activity hazard classes** ([HSE HSG250](https://www.hse.gov.uk/pubns/books/hsg250.htm)).
3. Step 3 — Exception quarantine & authority check: Configure automatic cascading suspension: if a high-priority operation (such as wellhead depressurization, slickline/coiled-tubing intervention, or gas detector alarm) transitions to *Active*, the ePTW engine must immediately suspend conflicting *Active* or *Ready* hot-work and overhead-lift permits in the affected zones.
4. Step 4 — Verified disposition & audit trail closure: Preserve clear human command boundaries ([API RP 75 / 30 CFR 250 Subpart S](https://www.ecfr.gov/current/title-30/chapter-II/subchapter-B/part-250/subpart-S)): software enforces the approved SIMOPS matrix rules and blocks unreviewed clashes, while the designated **Offshore Installation Manager (OIM) / Person-in-Charge (PIC)** retains sole human authority to sequence permits, approve `Yellow` interface controls, or order an all-stop.

Why 2D map boards miss vertical and state-driven SIMOPS clashes?

Facilities that track permits with magnetic pins on a 2D control-room plot plan fail to catch three critical SIMOPS conflict patterns:

1. Vertical Grated-Deck Line-of-Fire Clashes: Offshore platforms and refinery structures stack 3 to 5 grated decks vertically. Welding slag, dropped scaffolding clamps, or crane load swings on the +26 m Weather Deck pass straight through open grating or hatchways onto live wellheads and manifolds on the +18 m Mezzanine and +12 m Sump Deck. Spatial clash logic must evaluate shared (X, Y) footprints across all Z elevations.
2. State-Transition Clashes During Well Intervention: A coiled-tubing or wireline rig-up is relatively benign while mechanical rigging is underway, but becomes a high-hazard hydrocarbon release boundary the moment the blowout preventer (BOP) / lubricator is pressure-tested or the downhole safety valve (DHSV) is opened. The SIMOPS engine must link to the live sub-step of the well intervention program.
3. Shift-Handover Permit Reactivation Drift: When a day-shift welding permit is suspended at 14:00 to allow a 2-hour well flowback test, night-shift or next-morning crews must not re-issue the welding permit until the well bay is confirmed closed, gas-free tested, and released by the Production Authority (HSE HSG250).

• Primary control scope: simops management across compliance & safety and connected ERP/EAM records.
• Segregation boundary: Operational status updates never auto-close engineering, safety, or finance sign-off gates.
• Verification cadence: Reconcile open exceptions, overrides, and late adjustments at each shift or period close.

SIMOPS compatibility and spatial clash control matrix

Illustrative worked example: 6-permit offshore platform SIMOPS clash evaluation

Illustrative operating scenario with synthetic figures to demonstrate pairwise SIMOPS clash combinatorics and permit sequencing; not a client case study or site safety case.

Consider Offshore Wellhead Platform WHP-B (3 stacked decks: +12 m Sump Deck, +18 m Wellbay Mezzanine, +26 m Weather/Pipe Deck; divided into 4 horizontal sectors Z1..Z4) scheduling 6 candidate work permits for the 08:00–16:00 day shift:

• PTW-401 (Priority 1 — Critical Well Path): Slickline perforation & lubricator pressure operations on Well B-04 in Z1-Wellbay-North at +18 m.
• PTW-402 (Priority 3 — Construction): Class-A open-flame structural beam welding in Z1-Wellbay-North at +18 m ($6.5\text{ m}$ horizontal separation from Well B-04).
• PTW-403 (Priority 2 — Production Maint): Cold mechanical seal replacement on isolated Glycol Pump P-202B in Z3-Process-Skid at +18 m ($28.0\text{ m}$ away behind blast wall).
• PTW-404 (Priority 3 — Rigging): Pedestal crane $14.0\text{ tonne}$ blind heavy lift of a chemical skid through the open deck hatch directly over Z1-Wellbay-North from +26 m to +18 m.
• PTW-405 (Priority 3 — Inspection): Gamma-ray radiography (NDT) on piping spools in Z4-Laydown-Deck at +26 m ($12.0\text{ m}$ radiation cordon overlapping Z3 walkway).
• PTW-406 (Priority 2 — I&E): Intrinsically safe (Ex ia) transmitter loop calibration in Z2-Wellbay-South at +18 m.

Step 1: Execute pairwise combinatoric clash check ($\binom{6}{2} = 15$ pairs)

The ePTW SIMOPS engine evaluates all $\frac{6 \times (6 - 1)}{2} = \mathbf{15\text{ pairwise combinations}}$ across horizontal distance, blast-wall separation, and vertical Z-axis drop cones:

Step 2: Day-shift authorization summary signed by the OIM

• Total candidate permits evaluated: $6$ permits ($15$ pairwise interactions).
• Authorized for concurrent 08:00 activation: $3\text{ permits}$ (PTW-401 Slickline, PTW-403 Cold Pump Maintenance, and PTW-406 Intrinsically Safe Calibration with personal gas detector control).
• Suspended / Rescheduled by SIMOPS interlock: $3\text{ permits}$ (PTW-402 Hot Work and PTW-404 Overhead Lift held in SIMOPS_SUSPENDED until PTW-401 lubricator bleed-down and well barrier verification complete; PTW-405 Radiography shifted to the 22:00 night window).

Acceptance tests and operational readiness criteria

1. ACT-O120-01 (3D Vertical Drop-Cone & Horizontal Radius Clash Block): When a user attempts to move a permit to Active/Issued, the ePTW engine must evaluate all active permits sharing the same (X, Y) zone across higher/lower Z deck levels and block activation if any pairwise rule resolves to RED (Prohibited).
2. ACT-O120-02 (Cascading Suspension on High-Hazard State Entry): When a Priority-1 well intervention permit (PTW-401) transitions to Lubricator Pressurized / Well Open, any active Hot Work or Non-IS Electrical permits inside the exclusion zone must automatically transition to SIMOPS_SUSPENDED and trigger control-room/field push alerts.
3. ACT-O120-03 (Yellow Interface Multi-Authority Co-Sign Gate): A YELLOW (Restricted) permit pair cannot transition to Active until both functional Area Authorities (e.g., Drilling/Well Services Supervisor and Production Supervisor) plus the OIM/PIC digitally sign the interface barrier checklist.
4. ACT-O120-04 (No Software Override of Red SIMOPS Rules): The ePTW role-permission matrix (ERPNext Workflows) must forbid any field user from bypassing a RED clash without linking an approved, multi-discipline Management of Change (MoC) certificate.

Next steps

1. Map facility plot plans in 3D (Zone X, Zone Y, Deck Elevation Z) coordinates: Ensure overhead crane arcs, open deck hatches, and grated floor drains link upper-deck activities to lower-deck wellheads and process vessels.
2. Digitize the site-approved IMCA/IOGP SIMOPS compatibility matrix as deterministic ePTW lookup rules: Replace subjective memory checks at the morning permit meeting with automated pairwise validation.
3. Link heliport operations (HLO) and fixed gas-detection alarm relays to ePTW batch suspension: Automatically pause open-flame and crane permits whenever helicopter operations begin or a gas detector crosses $20%$ LEL.
4. Enforce shift-handover physical re-verification before lifting SIMOPS_SUSPENDED holds: Require fresh gas testing and Area Authority visual inspection before resuming any suspended hot-work permit.

Frequently Asked Questions

How should digital Permit-to-Work (ePTW) systems enforce Simultaneous Operations (SIMOPS) conflict matrices when wireline/coiled-tubing, crane heavy lifts, and live process maintenance occur on the same pad or platform?

Teams should govern simops management by linking every transaction to its source evidence, timestamp, and assigned owner before permitting downstream posting. Distinct from O066 (individual PTW lifecycle); O120 governs multi-activity spatial/system clash detection (e.g., forbidding hot work or heavy overhead lifts within perforated/pressurized well-bay zones) while keeping PIC/OIM human authority paramount. Rather than relying on informal spreadsheet overrides, the workflow enforces a documented verification gate and preserves the original observation whenever a correction is recorded.

How does electronic permit to work oil and gas handle exceptions and mismatches?

When a discrepancy occurs during electronic permit to work oil and gas, the system routes the blocked record into an owned exception queue rather than silently dropping or auto-adjusting the balance. Assigned operational, quality, and finance owners must review and approve exceptions before posting. Each exception retains the original quantity, date, and counterparty reference until the designated reviewer resolves the variance with supporting evidence.

What should teams test before automating offshore safety software?

Before scaling offshore safety software, run a bounded pilot using historical records that include partial receipts, late updates, duplicate messages, and rejected lines. Verify that the integration preserves idempotency, maintains a clear segregation of duties between operational entry and financial approval, and produces an auditable trail for every state transition.

Summary and next actions

1. Map the current simops management record boundaries, system of record, and named approval owners before changing workflow rules.
2. Separate operational status updates from engineering, safety, or financial disposition sign-off.
3. Validate exception queues, duplicate handling, and cutoff reconciliation in a bounded pilot before production rollout.