Coactivity & SIMOPS: Detecting Conflicting Work on Equipment

Every crew on a shutdown works under its own controls: its permit, its lockout procedure, its job hazard analysis. The hazard those controls miss sits between them, when two crews land on the same equipment at the same time.

What is SIMOPS (and coactivity)?

SIMOPS, short for simultaneous operations, refers to two or more activities carried out at the same time, in the same work area or on the same or connected equipment, where one activity can create a hazard for another. Coactivity (also written co-activity) and concurrent operations describe the same situation. A welder on a scaffold showering sparks onto a crew working below is coactivity. So are two crews on the same conveyor. In offshore oil and gas, the term often covers whole operations running side by side, such as a mobile drilling unit or support vessel working alongside an installation (HSE, HSG250, par. 16).

The hardest form to see is on shared equipment, where two crews may never cross paths: one works on the drive, the other on the steam joint, and the machine connects them.

Taken one at a time, each job is usually well controlled. The danger comes from the combination. One crew’s normal step, such as removing its locks to test a motor or pressurizing a line, becomes an unplanned hazard for another crew still in contact with the equipment. UK permit-to-work guidance states the principle directly: one activity must not create danger for another, and whoever prepares a permit should account for other work planned or underway (HSE, HSG250, par. 22).

Three situations show how this plays out:

Both permits were valid:

During a shutdown, a belt crew is splicing a conveyor belt, using a cold-vulcanizing cement that gives off flammable solvent vapor. On the same conveyor, a welder is repairing the discharge chute under a hot work permit. Each job has its own permit, and each permit is valid for the work it covers. The belt crew’s controls did not include ignition sources, because there were none in their job. The welder’s fire watch checked the chute, not the splice area a few meters away. Neither permit was wrong, but the combination created a fire hazard that neither one accounted for.

Both lockouts were correct for their own jobs:

Two crews are working on the same dryer section. A mechanical crew is aligning felt rolls under a lockout procedure that isolates the drives. On the back side, pipefitters are replacing a rotary joint under a procedure that isolates steam and condensate. Their job hazard analysis treated the drive as out of scope, since the section was already down for the other job. The mechanical crew finishes, follows its procedure to the letter, clears its own work area, removes its locks and jogs the section to check alignment. The dryer cans turn with the pipefitters still at the joint. Each crew followed a procedure built for its own task, and no one had both jobs in view.

The restart happened on a different machine:

Equipment rarely stands alone. A chip conveyor feeds a screen, which feeds a chute. A crew clearing the chute works under a lockout procedure that covers the chute’s own energy sources, but not the conveyor that feeds it. Upstream, a second crew repairing that conveyor runs it briefly to test the repair, and motion and material travel downstream toward the first crew. Both crews followed their procedures. The gap was in where the chute’s isolation boundary had been drawn.

None of these situations are exotic. They are the ordinary result of busy operations, and they peak during planned shutdowns, when maintenance, operations and contractor crews converge on the same lines within a few days. OSHA notes that group lockout typically calls for more coordination and communication than individual lockout, especially when more than one craft or department is involved (OSHA, Group Lockout/Tagout Procedures). In each of the three situations above, the individual task was not the weak point. The weak point was that no one held the full picture of who was working on what.

Why do permit-to-work systems miss conflicting work?

When conflict detection depends on the permit issuer, it depends on what that person knows at the moment of signing: which jobs are open, which lockouts are in place, which crews are on the floor. That knowledge is spread across a logbook, a whiteboard, a radio channel and someone’s memory. It holds as long as all of them are current.

On a shutdown, issuers have more permits than time:

Only qualified people can issue permits, and each one can only check so many work sites properly. HSE guidance warns that supervision gets diluted when one person controls a large number of permits, and it names plant shutdowns as the very active periods where sites must either limit active permits or add coordination resources (HSE, HSG250, par. 27 and 28). When the issuer is tied up elsewhere or on another shift, the cross-check waits, or it gets done from what the issuer remembers.

Shift changes and hand-backs break the chain:

A job that runs over several shifts passes from one crew and one issuer to the next. The incoming shift has to learn which permit-controlled jobs are still open, where each one stands and what state the plant is in (HSE, HSG250, par. 23). All of that information exists, but it travels person to person. The same gap shows up when a permit is handed back while part of the crew is still working.

Contractors multiply the interfaces:

A shutdown brings crews from several employers onto the same lines. In the United States, the host employer and each outside employer must inform each other of their lockout procedures (29 CFR 1910.147(f)(2)). That exchange settles how each crew will lock out. Knowing which other jobs are active on the same equipment that morning is a separate question, and it has to be answered again every shift, for every crew.

In each case, someone on site knew about the other job. The person signing the permit did not. On a quiet day, experience fills that gap. During a shutdown, the picture changes faster than anyone can carry it in their head.

What can go wrong when two crews share equipment?

The clearest lessons come from cases where each group did what its own job required, and the hazard crossed over from the other job.

Maintenance removed the relief valve. Operations restarted the pump:

On the Piper Alpha platform in the North Sea, in July 1988, condensate pump A was isolated for maintenance on its drive coupling under one permit. Its pressure relief valve, located one floor above, had been removed under a separate permit and replaced with a blind flange that was not leak-tested. The work was suspended overnight, and the suspended permits were kept in the safety office, filed by trade rather than by location. That evening, pump B tripped. The night shift knew pump A was down for maintenance that had not yet started, and according to the public inquiry’s most likely scenario, they took steps to restart it. Nothing told them its relief valve was missing. Condensate leaked at the flange and ignited, the first explosion in a disaster that killed 167 people (The Chemical Engineer, IChemE, 2018).

The permit came back before the whole crew did:

In a case described in HSE’s permit-to-work guidance, two fitters were working on steam pipes under a single permit. The first believed the job was finished and returned the permit to the process operator, who opened the steam valve. The second fitter had not completed his part and was scalded at the open pipe. The permit system had no sign-off step for each person working under it (HSE, HSG250, case study 5).

The lockout covered the car, not the machine beside it:

OSHA uses a steel mill scenario in its lockout guidance. A maintenance employee locks out a teeming car and crawls underneath to adjust its drive. While he works, a separate motor-driven unit used to position the cars is started for production and rolls by on the adjacent track, injuring him. OSHA’s conclusion: the employer had to protect him from hazardous energy from interconnected and nearby equipment, not only from the car he was servicing (OSHA, Lockout/Tagout eTool, Case Study 6).

The pattern repeats across very different industries. Each control was sound for the job or the machine it was written for. What failed was the link between them: permits filed where the other crew would not look, a hand-back that did not account for everyone still working, an isolation drawn around one machine instead of everything that could move.

That gap carries regulatory exposure as well as human cost. In the United States, OSHA’s maximum penalties for 2026 remain $16,550 per serious violation and $165,514 per willful or repeated violation (OSHA, 2026 civil penalty adjustments). Both costs trace back to how overlapping work was coordinated before it started.

What should a SIMOPS program include?

A box on the permit form that reads “Other work in progress: yes / no” records a question. It does not manage the answer. Coordinating overlapping work is a cycle, and each step closes a specific gap.

The requirements below refer to U.S. federal OSHA rules. In Canada, lockout requirements are set by each province, with CSA Z460 as the National Standard of Canada for hazardous energy control.

1. Identify the energy and the boundary

Know every energy source and isolation point for the equipment, including the equipment that feeds it. A procedure drawn around one machine leaves out what can move it.

Required: documented energy control procedures (29 CFR 1910.147(c)(4)).

2. Detect overlaps

Know when two jobs target the same equipment, connected equipment or the same work area at the same time.

Good practice: HSE guidance calls for someone with an overview of all work underway and planned, to prevent hazards from simultaneous activities (HSG250, par. 35).

3. Communicate across crews

Make sure each crew knows the other is there and what it is doing.

Required when several crews are involved:

• In general industry, a designated authorized employee coordinates when more than one crew, craft or department works under a group lockout (1910.147(f)(3)(ii)(C)).
• In electric power work, independent crews on the same lines each carry out the deenergizing steps separately, so no group acts on assumptions about what another has done (OSHA interpretation of 1910.269, 2000).

4. Decide, then record the decision

Adjust controls, notify, resequence or postpone, and write down what was decided and why.

Good practice: the lockout standard does not require it, but a recorded decision shows afterward that the overlap was seen and handled.

5. Isolate and verify, person by person

Every worker applies a personal lock and verifies the isolation before starting.

Required: 1910.147(d)(6) and (f)(3)(ii)(D).

6. Keep protection continuous

When work spans shifts or crews change, transfer the lockout in an orderly way.

Required: 1910.147(f)(4).

Group Lockout

Group lockout is where steps 5 and 6 become physical. In one common arrangement, the keys to the locks on every isolation point go into a master lockbox. The master lockbox key then goes into one or more satellite lockboxes, where each worker hangs a personal lock (OSHA, CPL 02-00-147). CSA Z460 describes a similar “security pyramid” in an informative annex (CSA Z460:20, contents).

As long as one personal lock remains on the box, energy cannot come back. Between shifts, control padlocks and seals keep the lockout intact while no one is working (CONFORMiT, Different Types of Locks for Lockout Tagout).

Of the six steps, step 2 is the one that still rests on what the issuer happens to know.

How do you detect conflicting work automatically?

Step 2 is where coordination from memory breaks first. The fix is to move the check out of the issuer’s head and into the permit system itself.

For that to work, every job has to be tied to a specific piece of equipment in a shared equipment list. When someone creates a permit for a job, the system looks at that equipment and checks whether another job on it is already in progress. If one is, the requester gets a coactivity alert. In the belt splicing scenario, the welder’s hot work permit would trigger the alert, because the splicing job is already under way on the same conveyor.

Timing is what makes the difference. Because the check runs when the permit is created, the overlap surfaces while the work is still being planned, when resolving it costs a phone call or a change in sequence. Found at the machine, the same overlap is found by the people exposed to it.

The alert cannot simply be dismissed. The requester has to record a decision, proceed or hold, and why, choosing from a standard list with room for a comment. The decision stays in the job’s history, where approvers can see it and auditors can find it later. It is the opposite of permits filed by trade in a safety office: the check is organized around the equipment, which is where the danger is.

Layer the checks. No single control catches every way two jobs can interact, so protection comes from combining them, each covering what it does best:

• • The automatic check catches two jobs on the same equipment, as early as possible.
  • The lockout procedure covers connected equipment. When procedures are built from a record of how equipment is connected (which machine feeds which, and which isolating devices serve more than one of them), the upstream isolation points are part of the chute’s procedure from the start, and the conveyor that feeds it gets locked out too.

• A live view of every active job, checked by the issuer before signing and by supervisors on the floor, covers interactions by area or proximity, such as a lift overhead or hot work near a vent.

How do you manage coactivity across shifts and sites?

Coactivity rarely fails inside a single permit or a single lockout. It fails at the seams: between a permit and the lockout it depends on, between one shift and the next, between one site and another. Managing it across an operation means closing those seams.

Keep the permit and the lockout together. A permit and a lockout procedure often describe the same machine, yet they can be prepared by different people and kept in different places. The link between them then depends on someone making it. When both are organized around the same equipment record, the permit for a job and the isolation it requires sit side by side, and a second job on that equipment is visible to anyone preparing the first.

Put the answer where the work happens. Before touching equipment, every crew should be able to answer one question: who else is working on this right now, and how far along are they? That answer is only useful if it is available on the floor, on a phone or tablet, and not just in the control room or the permit office. The crew about to jog the dryer section needed exactly that answer, and it would have shown a second lockout still in place.

Give every shift the same starting point. An incoming shift should not have to rebuild the picture from conversations and notes. Active jobs, the isolations in place and how far each one has progressed should be there when the shift begins, as the previous shift left them.

Hold every site to the same standard. When each site coordinates overlapping work its own way, practices drift and lessons stay local. With one approach across sites, a supervisor who moves from one plant to another reads the situation the same way, and the records build up the same way: who isolated what and when, which overlaps were flagged, and what was decided.

If your site is moving off an older permit system, those seams are a fair test for any replacement: does coordination follow the equipment, and can supervisors and crews see all active work in one place?

Catching coactivity before crews reach the equipment

Overlapping work is not a sign that something is wrong with an operation. It is what a busy shutdown looks like. The conflict is already in the schedule. The only question is whether it gets found while the work is being planned, or when the crews reach the equipment.

CONFORMiT’s Control of Work module is built around that question. Every job is tied to a piece of equipment from the same registry used for lockout procedures, so the permits and lockout procedures for an intervention sit together. When a permit is created for a job on equipment where another job is already in progress, CONFORMiT raises a coactivity alert and requires a documented decision before the permit moves forward. The Command Center shows every active job and the status of each lockout as crews work through their steps, on the web and in the CONFORMiT Ops mobile app. Every decision and every lockout step stays in the job’s history.

The logic of group lockout points the way. Energy stays off as long as a single lock remains on the box. Coordinating overlapping work well follows the same principle: the next step waits until the conditions for it are met.

To see coactivity alerts and the Command Center in action, book a demo or explore Control of Work.

This article is general information and does not constitute legal advice.