Shutdown, isolation and handover to maintenance

At six in the morning on the first day of the turnaround, Unit 22 is still hot. Operations shut the feed in overnight, and the board operators are bringing the column and exchangers down in the order the shutdown procedure sets out: cool, drain, depressure, steam, wash, cool again. Kiera's crew spends its first shift not on the tools but in the blinding team, following an operator named Colleen Marsh from flange to flange with a blind list, a torque wrench and a bag of tags. "Nobody touches anything until it's isolated, and nobody isolates anything without me," Colleen tells them at the first flange. "Every blind you put in, you'll take out at the end, and I'll check every one." This lesson covers how a unit is shut down and freed of hazards, how equipment is isolated with blinds, valves and locks, how the blind list works, and how equipment is handed over to maintenance and back again.

Shutting the unit down

A process unit cannot simply be switched off. It contains hydrocarbons, often hot and sometimes toxic, under pressure, and the equipment has to be brought from operating conditions to a safe, cool, empty and clean state in an order that does not overpressure, overheat or damage anything. Operations follow a written shutdown procedure. Typically the feed is cut, the unit is cooled while circulating, liquids are pumped out to storage or slop, equipment is depressured to the flare, and then the equipment is purged with steam or nitrogen to remove the remaining hydrocarbon. Many units are also water washed or chemically cleaned to remove deposits that could give off toxic gas or catch fire when exposed to air.

Some deposits are especially dangerous. Iron sulfide, formed in sour service, can heat up and glow when it dries in air, and has started fires in opened columns and exchangers. Units with this hazard are often treated with chemicals during the shutdown and kept wet until inspected. Coke and heavy residues can trap hydrocarbon that is released when they are disturbed. Benzene, hydrogen sulfide and other toxic gases may be released when equipment is opened. Boilermakers must know which hazards the unit has, because they will be the first people inside.

Isolation: valves are not enough

Before anyone opens equipment or enters it, it must be isolated from every source of process fluid, steam, nitrogen, water and energy. A closed valve is not a reliable isolation for opening or entry. Valves leak through, they can be opened by mistake, and their actuators can move them. For equipment that will be opened or entered, the normal standard is positive isolation: a physical break in the line or a solid blind between the equipment and the source.

There are three common levels of isolation. A single closed valve, locked and tagged, may be acceptable for some low-hazard work. A double block and bleed, two closed valves with an open bleed between them, gives better protection, because any leak through the first valve escapes through the bleed instead of reaching the work, and the bleed shows whether the first valve is leaking. Positive isolation, with a blind installed in a flange or a spool removed and the open ends blanked, is the standard for vessel entry and for most line breaking in hazardous service. The plant's isolation standard says which level each job needs.

Blinds must be rated for the pressure and temperature of the line, made of a suitable material, and of the right thickness. Each blind has a handle, often called a tail or paddle, that sticks out of the flange so that anyone can see it is there. The tail is stamped or tagged with the blind number, the size and the rating. Installing a blind means breaking the flange, so the line must first be isolated with valves, drained, depressured and checked; the first break is made carefully, with the bolts on the far side loosened first so that any trapped pressure is released away from the person.

Locks, tags and energy

Process isolation is only part of the job. Pumps, agitators, fans, motor-operated valves, electric heaters and any other equipment connected to the work must be isolated from electrical, mechanical, hydraulic and pneumatic energy, and anything that can move under gravity or spring force must be secured. The plant's lockout program sets out how: each energy source is isolated at its point of control, locked with personal and group locks, tagged and then tested to show that it is truly dead.

In the United States, OSHA's rule on the control of hazardous energy requires an energy control program, locks and tags, and verification before work begins. On a turnaround, the number of isolations is so large that most plants use a group lockout: operations isolate the equipment, lock each isolation with a set of plant locks, and place the keys in a lockbox. Each worker then places a personal lock on the lockbox, so that the isolations cannot be removed until every person has removed their lock. A worker who leaves the job without removing a lock stops the job for everyone, which is why the lock and its owner must be traceable.

Kiera checks her crew's first lockbox with Colleen. Every person on the crew puts a personal lock on it, signs the sheet and confirms, by looking at the isolation list, which equipment it covers. Colleen shows them the try step: an electrician has tried to start the E-2201A circulating pump from the field station after locking it out, to show that the lock has worked. "You never take somebody else's word that a thing is dead," she says.

The blind list

Every blind installed for the turnaround goes on a blind list, also called a blind register. Each entry gives the blind number, the line or nozzle, the flange size and rating, the reason for the blind, who installed it and when, who verified it, and later who removed it and who verified its removal. The list is controlled by operations, and changes to it are made only by people authorized to do so. At the end of the turnaround every blind must be removed and its removal verified before the unit can start up. A blind left in a line can stop flow, damage equipment or cause overpressure; a blind removed too early can let process fluid into a vessel where people are working.

# Blind list tracker: every blind installed for the turnaround must be removed before start-up
blinds = [
    ("B-101", "E-2201A shell inlet", "NPS 10", "Class 300", True, True, True),
    ("B-102", "E-2201A shell outlet", "NPS 10", "Class 300", True, True, True),
    ("B-103", "E-2201A tube inlet", "NPS 8", "Class 150", True, True, False),
    ("B-104", "E-2201A tube outlet", "NPS 8", "Class 150", True, False, False),
    ("B-105", "C-410 reflux return", "NPS 6", "Class 300", True, False, False),
    ("B-106", "C-410 bottoms", "NPS 12", "Class 300", True, True, True),
    ("B-107", "V-2204 vent to flare", "NPS 4", "Class 150", False, False, False),
]   # (tag, line, size, rating, installed, removed, verified by operations)
open_items = []
for tag, line, size, rating, inst, rem, ver in blinds:
    if inst and not rem:
        state = "IN PLACE"
        open_items.append(tag)
    elif rem and not ver:
        state = "removed, not verified"
        open_items.append(tag)
    elif rem and ver:
        state = "closed"
    else:
        state = "not yet installed"
    print(f"{tag}  {line:22} {size:>6} {rating:>9}  {state}")
print(f"{len(blinds)} blinds on the list; {len(open_items)} still open: {', '.join(open_items) if open_items else 'none'}")
print("Start-up allowed" if not open_items else "Start-up NOT allowed until every blind is closed out")

B-101  E-2201A shell inlet    NPS 10 Class 300  closed
B-102  E-2201A shell outlet   NPS 10 Class 300  closed
B-103  E-2201A tube inlet      NPS 8 Class 150  removed, not verified
B-104  E-2201A tube outlet     NPS 8 Class 150  IN PLACE
B-105  C-410 reflux return     NPS 6 Class 300  IN PLACE
B-106  C-410 bottoms          NPS 12 Class 300  closed
B-107  V-2204 vent to flare    NPS 4 Class 150  not yet installed
7 blinds on the list; 3 still open: B-103, B-104, B-105
Start-up NOT allowed until every blind is closed out

B-107 is a reminder that the list itself must be kept accurate. The vent blind on V-2204 was planned but never needed, because the vent was isolated another way. It must be marked as canceled by operations, not left as an open line on the list, or someone will spend time at the end of the turnaround looking for a blind that does not exist.

Handover to maintenance

When a piece of equipment is isolated, drained, cleaned and gas tested, operations hand it over to maintenance. The handover is formal. At Northgate it is done with a handover certificate for each equipment item, signed by the operations shift supervisor and the maintenance area coordinator, listing the isolations, the cleaning done, the hazards that remain and the permits under which work may begin. Only after the handover can the work permits for opening and entry be issued.

Handover is often staged. Equipment is handed over in groups as it becomes ready, and the schedule depends on the order. Kiera's E-2201A is handed over on the second day, after its blinds are in and its tubes have been steamed. C-410 takes longer, because the column must be steamed, washed and cooled before the manways can be opened and ventilation started. The first manway is opened on day three, and entry for tray work does not begin until day four, after gas testing shows the column is safe.

Handing back

The reverse process happens at the end. When maintenance has finished the work on a piece of equipment, it is boxed up, pressure tested if required, and the blinds are removed in a controlled order. Operations check that the equipment is complete, that every blind has been removed and every flange has its correct gasket and bolts, and that all tools, rags and temporary materials are out of the equipment. Many owners require a final internal inspection, sometimes called a closing inspection, before the last manway is closed, so that nobody leaves a tool or a person inside.

For equipment that has been changed, rather than restored, a pre-start-up safety review is needed before the unit restarts. In the United States OSHA's process safety management rule requires a pre-start-up safety review for new or modified equipment, under a management of change procedure. The review confirms that the equipment was built to the design, that procedures and training have been updated and that the hazards have been reviewed. Boilermakers are often asked to show their completed inspection and test records to the review team.