Field operations for critical infrastructure, with offline-first sync
Distributed systems for energy operations · Cryptographically signed safety workflows and air-gapped synchronisation
A field operations app for energy crews inspecting oilfields, pipelines and high-voltage substations, which runs permit-to-work and lockout/tagout workflows offline and merges each device's records when a connection returns.
The challenge
Field engineering crews inspecting oilfields, pipelines, and high-voltage substations operate for days without cellular or satellite coverage. Hazardous permit-to-work (PTW) and lockout/tagout (LOTO) workflows must enforce strict cryptographic sign-off sequences and sensor bounds directly on the disconnected handheld.
When intermittent connectivity returns across high-latency links, concurrent edits made across isolated devices with drifting hardware clocks must merge deterministically into an identical state without central coordination locks, while preserving an immutable, tamper-evident audit ledger.
- Connectivity
- Air-gapped field operation across multi-day coverage blackouts
- Safety DAG
- Cryptographic Ed25519 sign-offs and sensor bounds enforced per step
- State convergence
- Conflict-free HLC and state-based CRDT merging across replicas
- Audit integrity
- Hash-chained SHA-256 local ledger detecting retroactive tampering
Architecture
Air-gapped offline-first execution
Engineered for inspection and maintenance crews across oilfields, pipelines, and high-voltage substations operating for days without cellular or satellite coverage. All operational state resides locally on the handheld terminal.
Deterministic CRDT state convergence
In-house hybrid logical clocks (HLC) order state-based last-write-wins and observed-remove conflict-free replicated data types (CRDTs) persisted in local write-ahead-logged storage, guaranteeing that all replicas converge to an identical state without coordination locks.
Disconnected field handhelds evaluate Permit-to-Work DAG safety interlocks, append Ed25519-signed actions to a local SHA-256 hash chain, and persist state-based CRDTs in a write-ahead log; when intermittent coverage returns, bit-packed HLC state deltas synchronise with the core replica cluster without conflict.
Hardware and protocols
Directed acyclic graph safety interlocks
Hazardous permit-to-work (PTW) and lockout/tagout (LOTO) procedures execute as a state machine over a directed acyclic graph. No maintenance step can advance until every prerequisite parent step carries a verified digital signature and valid sensor bounds.
Hash-chained cryptographic audit ledger
Every field action is appended to a local SHA-256 hash chain binding the previous record hash, hybrid logical timestamp, operator identifier, and canonical payload, then signed with an Ed25519 key—making retroactive database tampering immediately detectable.
Bit-packed delta synchronisation protocol
Upon reconnection, terminals exchange compact HLC state vectors and transmit only minimal state deltas inside bit-packed binary frames, completing synchronisation reliably over high-latency, low-bandwidth edge links.
Verification
An in-process coordinator simulates network partitions and clock drift. It starts several isolated virtual field nodes with up to ±300 s of clock skew, dropped packets and concurrent, conflicting changes to the same safety permits.
When a partition heals, every replica must reach the same state, and tampered hash-chain entries must be rejected.