Safety, permits and simultaneous operations during shutdowns

On day nine, at the morning permit meeting, Imran Qureshi puts a plot plan of Unit 22 on the screen with every open permit drawn on it as a coloured patch. Around C-410 the patches overlap like a stack of playing cards: a hot work permit on deck 3, a line break on the reflux return, the vessel entry permit for the trays, and scaffold crews on two levels. "This is what a turnaround looks like from the safety office," he says. "Every crew is doing its own job safely, and together they can still hurt each other." This lesson covers why shutdowns are dangerous, how the permit system controls the work, how simultaneous operations are managed, and the other hazards of a turnaround: dropped objects, heat and cold, fatigue, congestion and the start-up itself.

Why shutdowns are dangerous

A turnaround concentrates risk. The plant is in an abnormal state, with equipment open, blinds and temporary connections in place, and hazards such as residual hydrocarbon, iron sulphide, toxic gases and stored energy present in places they normally are not. There are far more people than usual, many of them new to the site, working close together and often above or below each other. Heavy lifts, hot work, confined space entry, work at height and high-pressure water jetting all happen at once. And the pressure of the schedule pushes everyone to go faster.

Investigations of serious incidents in refineries and chemical plants have found that a large share happen during shutdowns, start-ups and maintenance. Common themes recur: hot work near equipment that had not been freed of gas, equipment opened with an isolation missing, confusion at shift change, temporary equipment left in place, and start-up with work unfinished or a blind still in. The safety systems of a turnaround are built to stop exactly those failures.

The permit to work system

Every job on a turnaround is done under a permit to work, issued by operations, which controls the plant. The permit names the equipment, the work, the hazards, the isolations, the precautions, the gas test results, the people and the time it is valid. Different kinds of permit cover different hazards: a general or cold work permit for most work, a hot work permit for anything that can ignite a flammable atmosphere, a confined space entry permit, a line break or equipment opening permit, and permits for excavation, radiography and work near energized electrical equipment. A job may need several.

The permit system works only if everyone uses it the same way. The permit issuer inspects the job site with the receiver, the lead hand of the crew doing the work, and both sign. The permit is displayed at the job. The receiver explains it to the crew at the job, and every crew member signs that they understand it. At the end of the shift, the permit is handed back or suspended, and at the next shift it is reissued only after the job site has been checked again. If conditions change, such as a gas alarm or a change of scope, work stops and the permit is revalidated or reissued.

Hot work on a turnaround

Hot work is any work that produces flames, sparks or heat that can ignite a flammable atmosphere: welding, cutting, grinding, gouging and some kinds of drilling. On a turnaround it is the commonest cause of fires. A hot work permit is issued only after the area within a set distance has been gas tested and found free of flammable gas, combustible materials have been removed or covered, drains and sewers have been sealed, and a trained fire watch with an extinguisher is in place. Northgate allows hot work only at a reading of zero on the flammable gas detector, with continuous monitoring for hot work near process equipment, and requires the fire watch to stay for an hour after the work ends, followed by a final check.

On a turnaround the nearby equipment matters as much as the job. Hot work near a vessel that is still being gas freed, a flange that is being broken or a sewer that has not been sealed can ignite gas that drifts from the other job. That is why hot work permits are checked against every other permit in the area, which is the core of simultaneous operations planning.

Simultaneous operations

Simultaneous operations, often shortened to SIMOPS, means activities that happen at the same time and place and could affect each other. On a turnaround, some combinations are dangerous: hot work near a line break, gas freeing or a vessel entry; a crane lift over a job where people are working; high-pressure water jetting near other crews; radiography near anyone. The permit system controls each job, but SIMOPS planning looks at the jobs together.

Most plants manage SIMOPS through a daily permit meeting and a map. All the permits for the next shift are plotted on a plot plan or in a database, and the combinations are checked against a matrix of activities that must not overlap, that need extra precautions or that can proceed together. Conflicts are resolved by changing times, moving barriers, adding precautions such as continuous gas monitoring or fire blankets, or, if necessary, telling one job to wait.

# Simultaneous operations check: permits in the same area at overlapping times
permits = [
    ("HW-118", "hot work", "C-410 deck 3", 7, 19),
    ("LB-203", "line break", "C-410 deck 3", 9, 12),
    ("VE-077", "vessel entry", "C-410", 7, 19),
    ("HW-121", "hot work", "E-2201 bay", 8, 18),
    ("GF-015", "gas freeing", "V-2204", 6, 14),
    ("HW-124", "hot work", "V-2204", 13, 19),
    ("SC-301", "scaffold", "E-2201 bay", 7, 10),
]   # (permit, type, area, start hour, end hour)
CONFLICT = {("hot work", "line break"), ("hot work", "gas freeing"), ("hot work", "vessel entry")}
issues = 0
for i, a in enumerate(permits):
    for b in permits[i + 1:]:
        same_area = a[2] == b[2]
        overlap = a[3] < b[4] and b[3] < a[4]
        pair = tuple(sorted((a[1], b[1])))
        if same_area and overlap and (pair in CONFLICT or tuple(reversed(pair)) in CONFLICT):
            issues += 1
            print(f"CONFLICT: {a[0]} ({a[1]}) and {b[0]} ({b[1]}) in area {a[2]}, {max(a[3], b[3]):02d}:00-{min(a[4], b[4]):02d}:00")
print(f"{len(permits)} permits checked, {issues} conflict(s) to resolve at the permit meeting")

CONFLICT: HW-118 (hot work) and LB-203 (line break) in area C-410 deck 3, 09:00-12:00
CONFLICT: GF-015 (gas freeing) and HW-124 (hot work) in area V-2204, 13:00-14:00
7 permits checked, 2 conflict(s) to resolve at the permit meeting

The program found two conflicts, but it missed a third. The hot work and the vessel entry on C-410 overlap all day, and the program treated them as different areas because one was entered as C-410 deck 3 and the other as C-410. In fact the entry permit covers the whole column, including deck 3, where the hot work is. Imran points this out at the meeting: the matrix is only as good as the areas in it. The solution for deck 3 is to move the line break to the night shift, when no hot work is planned there, and to have the entry permit list the hot work on deck 3 as a precaution, with continuous gas monitoring inside the column. HW-124 on V-2204 is moved to start at 14:00, after the gas freeing permit closes and a clean gas test is recorded.

Dropped objects, congestion and the crowd

With crews working at many levels, dropped objects are a constant hazard. A small tool falling from height can kill. Controls include tethering tools and parts, toe boards and netting on scaffolds, covers over openings, barricaded drop zones below overhead work, and a rule that nobody walks through a barricade without permission from the crew working above. Turnarounds often run dropped object surveys, walking each area to look for loose items at height.

Congestion brings its own risks. Cranes, forklifts, man lifts, buses and people share narrow roads and pipe racks. Laydown areas fill up. Emergency routes can be blocked. Good turnaround planning sets traffic routes, keeps emergency routes and muster points clear, assigns laydown space and limits the number of people in each area. Every crew must know its muster point and the evacuation alarm, and should practice reaching the muster point at least once early in the turnaround.

People: fatigue, weather, health and new workers

Turnarounds run on long shifts for weeks at a time, and tired people make mistakes. Owners and contractors set limits on hours and consecutive shifts, and supervisors watch for signs of fatigue: slowed reactions, lapses of attention, irritability. Night shifts are especially hard in the early hours of the morning. Lead hands should plan the most hazardous tasks for times when the crew is fresh, and should be ready to stop work if someone is too tired to do it safely.

Weather matters too. Northgate's fall turnaround can run from warm afternoons into snow and cold by the end of October, and summer outages at other plants can bring heat stress, especially for crews in protective suits inside vessels. Heat stress plans, cold weather plans, warming or cooling shelters and adjusted work-rest cycles are part of the safety plan. Health hazards such as asbestos and refractory dust in old equipment, benzene in some services and noise from jetting and grinding are controlled as in the safety course.

Many workers on a turnaround are new to the site, and some are new to the trade. Every worker attends the site orientation; many plants also require an area orientation for each unit. New workers are often identified with a coloured hard hat or sticker and assigned a mentor. Kiera's first-year apprentice gets a green sticker on his hard hat, and she pairs him with Tessa for his first week.

Start-up: the most dangerous days

The last days of a turnaround are among the most dangerous. Equipment is being boxed up, tested and handed back while other work is still finishing. Hydrocarbons are reintroduced while crews may still be in the unit. Every blind must be out, every flange made up, every drain and vent closed, every safety device returned to service and every person accounted for. A start-up with an open drain, a blind still in or a crew still working in the area can cause a release or fire.

Owners control start-up with checklists, the blind and gag lists, pre-start-up safety reviews for changed equipment and a formal handback of each area before hydrocarbons are introduced. Work permits in an area are closed before start-up begins, and the area is swept for people. After start-up, crews watch the equipment they worked on for leaks as it heats up, ready to report and, where safe, to retighten joints under a hot bolting procedure if one is approved.