Risk is risk
Software built extraordinary tools for driving down error rates. The industries where an error kills someone never got them. The reason was language — and language just stopped being the barrier.
What happens when you make a mistake in code?
A P1 takes the system down. A P2 costs a customer some functionality. A P3 inverts a logo colour. Software has spent twenty years building machinery to drive the rate and blast radius of those errors down, and it worked. The best engineering teams now fail on roughly one in twenty changes. The worst fail on nearly one in two. That gap is almost entirely about tooling.
The chemical and oil and gas industries run the same severity scale.
Their P1 is a multiple-fatality event. Their P2 is a fatality. Their P3 is an injury someone lives with for the rest of their life.
The fatal injury rate in mining, quarrying and oil and gas extraction is 13.8 per 100,000 workers, against 3.3 across all US industries — about four times. In twenty-seven years, the US Chemical Safety Board has investigated roughly 180 major chemical incidents: more than 200 people killed, more than 1,300 seriously injured. The hundred largest property losses in hydrocarbons total $43.2 billion.
These industries never got the tools.
The stakes are not abstract
It is easy to read "process safety" as a compliance category. It is worth making it concrete.
The world recovers about 85 million tonnes of sulfur a year, and roughly 92% of it comes out of petroleum refineries and gas processing plants. Piled up, that is about 41 million cubic metres — enough to bury the island of Manhattan knee-deep, every year.
Much of that sulfur passes through the plant as hydrogen sulfide. Here is what that means at human scale.
Seven grams. About a teaspoon, in a bedroom-sized room. That is not the lethal dose — it is NIOSH's threshold for immediate danger to life and health, the concentration at which you can no longer reliably get yourself out. Roughly ten times that, and collapse follows within one or two breaths.
People work around this every day. They do it safely, most of the time, because of an enormous apparatus of procedure and review. The question is not whether that apparatus works. It is whether it is running on the right tools.
Why the tools never arrived
Not because the problem is different. Risk is risk.
Because the artifact is different.
Code is machine-readable by construction. Git works because a diff is computable. Every layer of software's error-reduction stack — review, tests, continuous integration, static analysis — rests on that one property.
A plant's truth lives somewhere else entirely: in P&IDs, HAZOP worksheets, MOC packets, incident reports, operating procedures, inspection records. Written by different people, in different decades, under different conventions, in natural language. You cannot diff a PDF. You cannot run a test suite against a drawing.
So the industry did the only thing available to it. It hired people to read everything and remember, and it revalidated on a five-year cycle.
The result is exactly what you would predict. Mechanical integrity and process safety information are the two most-cited elements in OSHA process safety enforcement, and the recurring finding is a gap between the programme on paper and the programme in the field. Marsh's analysis of the industry's largest losses names the same failure mode from the insurance side: lessons get learned, then forgotten, and their relevance to the rest of the fleet is never recognised.
That constraint has now broken. Language models make unstructured engineering documentation machine-readable for the first time — not perfectly, and not without governance, but enough that the rest of the stack becomes possible.
What gets built on top
See the inconsistencies. Point at the corpus and surface every place the documentation disagrees with itself: the P&ID that no longer matches the HAZOP node, the MOC that never propagated to the operating procedure, the incident finding that never reached the equipment record. No integration, no workflow change. This is a scan, and it is a complete product on its own, because almost nobody has a global view of their own documentation today.
Clear the backlog. Propose the corrections; the engineer approves them. This is painful work and there is no point pretending otherwise. But it is the first time it has been visible and trackable, and this is where the efficiency gain is largest — it is the difference between a five-year revalidation cycle and a continuous one.
Hold the line. Now there is a single source of truth, and it has source control. The enforcement mechanism already exists in every operator: management of change. The rule is simply that a change does not get physically implemented until the documentation is in place. In software terms, that is a required status check on a protected branch.
This is also the answer to the obvious objection — that documents are only a model of the plant, and reality drifts away from them the moment someone welds in a bypass at two in the morning. The gate is what closes the drift. Nothing moves in the field until the record moves first.
Orchestrate the work. Once you are the workflow, you have the telemetry. Where is change throughput actually constrained — subject matter expert review, approval queues, or drafter hours for P&ID markup? Most operators do not know. When you can see a surge of changes coming, you contract for it in advance, with exact scopes, instead of discovering the bottleneck three weeks into a turnaround.
Generate. Once the model is controlled and connected, producing the drawing itself is the natural end state rather than a new business. Normalise, and it becomes connectable. Connect it, and it becomes controllable.
The compounding is inside the company
The obvious objection to any "GitHub for X" framing is that GitHub's magic was the public network, and operators will never share plant data with each other.
They won't, and they don't need to. GitHub Enterprise sells to organisations whose code never leaves the firewall, and the value is the same: shared substrate, enforced review, visible history.
A large operator runs dozens of facilities that have never structurally compared failure modes with one another. A pump that killed someone at one site, and the identical pump running unexamined at another — that is the entire argument, and it requires nothing to cross a corporate boundary.
Why this is worth more than safety
The safety argument is the reason to do this. The uptime argument is the reason it gets bought.
Offshore oil and gas facilities average more than 27 days of unplanned downtime a year — around $38 million in annual losses, with the worst performers above $88 million. A single percentage point of downtime is over $5 million. Across the world's 500 largest companies, Siemens puts total downtime cost near $1.4 trillion a year, up 62% since 2019 even as the number of incidents fell. Each stoppage is getting more expensive, because plants run leaner and the response is slower.
There is a precedent for the claim being made here, and it is nuclear.
In the early 1980s the typical American nuclear plant ran at a 63% capacity factor with seven unplanned shutdowns a year. After INPO — an industry-wide discipline of shared operating information, peer review, and standardised performance indicators — the typical plant runs above 91%, with none.
Nobody built a better reactor. They built better information discipline, and the performance came with it.
That is the whole thesis. Safety infrastructure is not a cost centre to be tolerated. It is the thing that unlocks the capacity factor.
Where this goes
The industries that keep the lights on and the crops fed have spent decades accepting a level of preventable error that software stopped accepting twenty years ago. Not out of negligence — out of a genuine technical constraint that has only just lifted.
The constraint is gone. The tools are buildable now.
That is what we are building.
*Figures cited: US Bureau of Labor Statistics, Census of Fatal Occupational Injuries 2024; US Chemical Safety Board; Marsh, 100 Largest Losses in the Hydrocarbon Industry; USGS Mineral Commodity Summaries 2025; NIOSH Immediately Dangerous to Life or Health documentation for hydrogen sulfide; Kimberlite; Siemens, True Cost of Downtime 2024; DORA State of DevOps; INPO testimony to the National Commission on the BP Deepwater Horizon Oil Spill, 2010.*
