Turnaround brings thousands of contractors through one gate — each needing valid certificates, induction and a zone permit.
For most of the year, a refinery gate handles a manageable flow of staff, contractors and deliveries. Then a turnaround begins, and for six weeks the same gate processes several thousand contractor workers a day — each one requiring valid certificates, a completed induction and a permit tied to a specific area.
No other sector combines that scale with that consequence. This is why oil and gas sets the highest bar for visitor and contractor systems.
| Factor | Why it raises the bar |
|---|---|
| Consequence of error | An unqualified worker in the wrong area is a major incident |
| Contractor ratio | Contractors can outnumber staff many times over |
| Demand volatility | Turnaround multiplies daily volume dramatically |
| Zone classification | Areas differ by hazard, not by department |
| Site remoteness | Connectivity cannot be assumed |
| Regulatory scrutiny | Records are examined, not merely kept |
The third row is what breaks systems that work adequately elsewhere: a system sized for ordinary operations will not survive a turnaround, and the turnaround is precisely when control matters most.
Turnarounds are the sector's defining operational event and its defining access-management challenge. What has to work:
Point six is routinely underestimated and carries real risk: a turnaround that ends with three thousand access permissions still live has left a large exposure behind it. Revocation should be automatic on contract or event end rather than a task someone completes eventually.
Hot work near hydrocarbons, confined space entry into vessels, and work on live systems are not administrative categories — each carries a specific fatality mechanism, and the permit is the control.
What the system must support: separate approval by the area authority and the safety function, verification steps recorded with timestamps rather than assumed, short windows measured in shifts, and visibility of concurrent permits in the same area — because two individually sound permits can be dangerous together.
Access must follow the permit rather than the person. See permit to work: linking safety to the gate.
A processing facility is divided by hazard classification, and those boundaries are not visible to someone reading a site map as a set of buildings.
Practically this means access is granted per classified zone with the area authority approving, entry conditions attach to the zone rather than to the site, and equipment restrictions apply per zone — a phone or a camera that is unremarkable in the admin block may be prohibited in a classified area.
The badge should therefore indicate zone authorisation rather than merely identifying someone as a contractor.
This is the requirement that justifies the entire investment, and the one where paper systems fail completely at turnaround scale.
What an emergency headcount must deliver:
The last two combine into the real test: an evacuation is exactly the scenario in which power and network may be unavailable. A headcount that depends on either is unavailable when it is needed. Ask for a demonstration with the connection cut.
Wellheads, pumping stations and remote facilities have intermittent connectivity as a permanent condition rather than an occasional fault. The system must be designed for it:
The second point is a policy decision that must be made before it is needed: at a remote site with no connection, is entry permitted on cached authorisation or held? The answer varies by site sensitivity, and it belongs in writing rather than in a guard's judgement at two in the morning.
See cloud vs on-premise for Saudi facilities for how hosting affects this.
Haseen handles contractors and visitors on one platform: contractor companies enrol their own crews with documents attached, expiry and induction status act as entry conditions automatically, permits carry their own approval chains and scope access to a zone and window, and gate terminals continue recording through connectivity loss. Access revocation follows contract and event end rather than a manual clean-up.
See Haseen for oil and gas and the capability checklist in contractor management software: buyer's checklist.
Five things beyond a standard system: throughput at turnaround scale without weakening verification, permit workflows for high-risk work with separate area and safety approval, access controlled per classified zone rather than per site, a headcount reliable enough for evacuation, and gate operation that survives connectivity loss at remote locations. Regulatory scrutiny means records are examined rather than merely kept.
By moving the work before the event: bulk onboarding ahead of arrival, contractor companies enrolling their own crews with documents attached, batch induction recorded with expiry, temporarily scaled gate lanes, and awareness that arrivals cluster sharply at shift change. Equally important is rapid demobilisation — automatic revocation on event or contract end, so a turnaround does not leave thousands of live permissions behind it.
From live entry and exit records, presented as a list of everyone on site by name, company and last known zone — produced in seconds, available on a mobile device at the muster point, segmented by assembly area, and updated as people are marked accounted for. Critically it must work without network or mains power, since an evacuation is exactly when those may be unavailable.
The software controls access to classified zones; whether a physical device may be taken into one is a separate question governed by area classification and your own equipment standards. What the system provides is zone-based authorisation approved by the area authority, entry conditions attached to the zone, and equipment restrictions per zone — including prohibitions on phones or cameras that do not apply elsewhere on site.
Terminals must record entries and exits from cached data and sync on reconnection, with a local headcount available at the site itself rather than only centrally. The decision to make in advance is what happens to checks requiring central verification: at a disconnected remote site, is entry permitted on cached authorisation or held? That answer varies by site sensitivity and belongs in writing.
It has to, since turnaround workforces are layered — a main contractor bringing several subcontractors, each with their own crews. The workable pattern is that each contractor registers their own subcontractors within their contract scope, so the chain remains visible to you without your team administering thousands of individual registrations.
Ask how long it would take today to produce a named list of everyone on site, segmented by assembly area. If the answer is measured in minutes, that is the gap a turnaround will expose.
Contractor-led bulk onboarding, zone permits with their own approval chains, and a headcount that works offline.