Where do autonomous operations already run?
- ENEOS Materials, Yokkaichi, Japan. Yokogawa’s FKDPP reinforcement learning algorithm was formally adopted on 30 March 2023 for direct control of a distillation column (Yokogawa).
- ENEOS Kawasaki refinery, Japan. An AI system developed with Preferred Networks has run an atmospheric crude distillation unit autonomously since January 2024, adjusting 13 valves at the same time (Preferred Networks, 24 May 2024).
- Aramco Fadhili gas plant, Saudi Arabia. Since 29 October 2025, several AI agents built on FKDPP “directly and autonomously control” the acid gas removal unit through the CENTUM VP control system (Yokogawa).
- Borouge, United Arab Emirates. Honeywell’s Experion Cognition agents act “on behalf of the operator” on anomalies in the control room (Honeywell, 9 June 2026).
- Drilling. Closed-loop control on an Equinor well in Norway on 26 February 2025 (Halliburton) and on an Eni deepwater well offshore Indonesia on 9 July 2026 (World Oil).
What are the levels of autonomous operation?
XO Autonomous Operations uses the XO levels of autonomy, its own version of the six levels from 0, fully manual, to 5, full autonomy. They are based on the levels of driving automation used for cars, as adapted for the process industries by ARC Advisory Group and by WIB and NAMUR. Each unit is rated on its own, and each level states where people sit.
- Level 0, fully manual. People run and maintain the unit.
- Level 1, assisted operation. AI advises or prepares actions; people check, decide and carry out every action.
- Level 2, partial automation. Control loops hold set points, and automated systems can carry out actions a person has approved.
- Level 3, conditional autonomy. The unit runs itself in defined conditions; people stay in the loop, approve its significant actions and step in outside those conditions.
- Level 4, high autonomy. The unit runs and maintains itself; a person stays in the loop for every high-risk intervention.
- Level 5, full autonomy. The unit runs and maintains itself fully; people are out of the decision loop but can stop it and take back control.
At every level people keep oversight, governance, accountability and the means to take back control, and maintenance and inspection become continuous instead of waiting for planned shutdowns. The WIB/NAMUR authors also state that compromises on safety “are neither acceptable nor necessary”.
Does every site need to reach level 5?
No. Each operator moves from level 0 towards its own end point, which may never be level 4 or 5, and may differ from one unit to the next. What matters is that at each step up, governance and the management system are adapted to the new level, before the change is made. Regulators are already looking at this: see what Havtil and HSE expect below and are your automation and AI changes ready for a regulatory audit?
What changes in the safety management system at each level?
In my reading, the main changes by level are these. Moving up a level is a change in its own right, and each stage gate needs its own management of change review.
| Level | Management of change | Operating limits | Operator competence | Alarms and barriers |
|---|---|---|---|---|
| 1: AI advises or prepares actions | The model, its data feeds and each retraining go through MOC | Recommendations and prepared actions stay inside the safe limits | Operators question the model, check what it prepares and know its valid range | An advisory that supports a barrier needs an owner and a performance standard |
| 2: automated systems carry out approved actions | Each type of action the system may carry out after approval is reviewed under MOC | Approved actions stay inside written limits, and the system cannot act outside them | Approvers understand what they approve and can override at any time | Every action on a barrier needs approval by a named role |
| 3: the unit runs itself in defined conditions | Making a unit semi-autonomous is a process change; each update is reviewed | Limits and integrity operating windows are hard constraints, alarmed and tracked; the defined operating conditions are written down | Operators can run the unit by hand, recognise when it leaves its defined conditions, and have the authority to stop the model | The model is a cause in the HAZOP and is not credited as an independent protection layer without proof |
| 4: the unit runs and maintains itself, a person in the loop for high-risk interventions | Organisational MOC as tasks, including maintenance and inspection planning, move from people to AI agents and automation | The unit’s scope and limits are written down and checked; the high-risk interventions that need a person, including changes to maintenance and inspection frequencies, are listed | Manual skills are practised, since the routine work no longer keeps them | Alarm handling by AI falls under the alarm philosophy; loss of the model has a defined fallback |
| 5: full autonomy, people out of the decision loop | The organisation itself is redesigned under MOC, including remote supervision | Limits are owned and reviewed even though no one adjusts them day to day | Competence shifts to oversight, recovery and taking back control | Barrier performance is demonstrated, and people can stop the unit and take back control at any time |
The detail is on AI management of change, AI and operating limits, operator competence when AI runs the plant, AI in process control and the DCS and AI and HAZOP.
How does XO Autonomous Operations help?
Moving a unit up a level of autonomy? Your management of change, operating limits, competence and alarms have to move with it.
Every high-hazard operator is somewhere on the autonomous operations maturity scale, from conventional automation to AI, often at different levels unit by unit. Regulators such as Havtil and the UK HSE already expect the management system to keep pace: Havtil’s 2026 audits found non-conformities in technology qualification, and HSE states that health and safety law requires a risk assessment for uses of AI.
XO Autonomous Operations helps you determine where each unit stands, assesses your management system against your current and target level, and gives you a workplan to close the gaps, with interim steps where you need them. We assess the management system, not the technology, and we sell no automation. The work is led and conducted personally by Carl Goodwin, who has run major hazard sites, built operating organisations and delivered over 50 management system audits and improvement plans in over 20 countries worldwide.
What do regulators expect?
Havtil ordered Vår Energi in February 2026 to set criteria for automated drilling before the systems are taken into use. HSE stated on 12 June 2026 that health and safety law already requires a risk assessment for uses of AI. The Machinery Regulation applies from 20 January 2027, and a site that adds an AI function to a machine can become its manufacturer through a substantial modification. See after a regulator letter or order on AI and the EU AI Act and Machinery Regulation dates.
Is this only for oil and gas?
No. The first public cases are in refining, gas processing, petrochemicals and drilling, but any site that manages major accident risk faces the same changes when AI starts to act on the process. Examples by asset type, including chemical plants and mines, are in AI by asset.
To see what a move towards autonomous operations changes on your own site, start with an autonomous operations briefing.
Questions
What are autonomous operations in oil and gas?
Autonomous operations means AI and automation that run part of a plant or a well, with people supervising instead of making each move. Since 2023 AI has taken direct control of distillation columns, a crude unit and a gas plant's acid gas removal unit in Japan and Saudi Arabia, and closed-loop drilling has run on wells in Norway and Indonesia.
What are the levels of autonomous operation in the process industry?
XO Autonomous Operations uses the XO levels of autonomy, rated unit by unit: 0 fully manual; 1 AI advises or prepares actions, and people decide and act; 2 control loops hold set points and automated systems carry out actions a person has approved; 3 the unit runs itself in defined conditions; 4 the unit runs and maintains itself, with a person in the loop for every high-risk intervention; 5 full autonomy, with people out of the decision loop but able to stop it and take back control. They build on the scale of ARC Advisory Group and WIB/NAMUR. Many units will stop below level 4 or 5.
Do autonomous operations need management of change?
Yes. Each step that gives a model more reach into the process, from one maturity level to the next, is a change to the process and the organisation, and each model update or retraining is a change in its own right.