Shutdowns, turnarounds and maintenance work

Most plants stop production from time to time to do work that cannot be done while running: major inspections, equipment replacement, cleaning, tie-ins of new equipment and repairs. Small plants may stop a line for a weekend; refineries, pulp mills and large food plants may run a turnaround for weeks with hundreds of extra contractor workers on site. Shutdowns compress a year's worth of high-risk work into a short time, with unfamiliar people, many simultaneous jobs, equipment in unusual states and intense schedule pressure. Many serious incidents happen during shutdowns, start-ups and the maintenance work around them. This lesson covers how plants plan and run shutdowns safely.

Why shutdowns are high risk

Planning a shutdown

Safe shutdowns start months before the first day. Planners define the scope of work, freeze it at an agreed date so last-minute additions do not overwhelm the plan, sequence jobs to avoid conflicts, prepare isolation plans and permits in advance, select and prequalify contractors, plan lifts and confined space entries, and arrange extra resources such as safety staff, rescue teams, first aid and washrooms. A good shutdown plan treats safety as part of the schedule, not a separate document: the time needed to isolate, purge, test and inspect is in the plan, so nobody is forced to choose between safety and the schedule.

# Estimate the peak contractor workforce and orientation load for a shutdown (illustrative plan).
jobs = {  # job: (start day, duration days, crew size)
    "boiler inspection":      (1, 6, 18),
    "heat exchanger cleaning": (2, 5, 24),
    "conveyor replacement":   (1, 9, 30),
    "tank internal coating":  (3, 8, 16),
    "electrical tie-ins":     (5, 6, 12),
    "piping replacement":     (2, 10, 40),
}
days = 14
profile = [0] * (days + 1)
for start, dur, crew in jobs.values():
    for d in range(start, start + dur):
        profile[d] += crew
peak = max(profile); peak_day = profile.index(peak)
print("Day:  " + " ".join(f"{d:>3}" for d in range(1, days + 1)))
print("Crew: " + " ".join(f"{profile[d]:>3}" for d in range(1, days + 1)))
print(f"Peak {peak} workers on day {peak_day}; all must be oriented before they start")
print(f"At 25 people per orientation session, that is {-(-peak // 25)} sessions before day 1")

Day:    1   2   3   4   5   6   7   8   9  10  11  12  13  14
Crew:  48 112 128 128 140 140  98  98  98  68  40   0   0   0
Peak 140 workers on day 5; all must be oriented before they start
At 25 people per orientation session, that is 6 sessions before day 1

Scope control and the critical path

Shutdown schedules are usually built with the critical path method (CON-210). The critical path is the longest chain of dependent jobs, and it sets the shutdown length. Delays on the critical path delay start-up, which creates pressure; delays elsewhere can absorb some slack. Safety planning uses the schedule too: it shows when the most people are on site, when the most hazardous jobs overlap, and where extra supervision and rescue cover are needed. Late additions to scope, often called scope creep, are a classic cause of trouble because they arrive without planned isolations, permits or resources.

Isolation for shutdown work

During a shutdown, many pieces of equipment must be isolated at once, and some isolations protect several jobs. Plants use group lockout or an isolation register to manage this. In group lockout, an authorized person isolates the equipment and locks the isolation points, placing the keys in a lockbox; each worker or crew then applies a personal lock to the box, so the isolation cannot be removed until every worker has removed their lock. The isolation register lists every isolation point, its position, the lock number, the permits it supports and its verification. HSE-210 covers lockout in detail.

# Can this isolation be removed? Check the register against open permits (illustrative).
register = {
    "V-101 (steam inlet)":  ["HW-210", "CS-031"],
    "MCC-4 breaker 12":     ["GW-118"],
    "Blind B-7 (solvent)":  ["LB-052", "HW-210"],
}
open_permits = {"CS-031", "LB-052"}
for point, permits in register.items():
    still_open = [p for p in permits if p in open_permits]
    if still_open:
        print(f"{point:<22} KEEP - supports open permit(s) {', '.join(still_open)}")
    else:
        print(f"{point:<22} may be removed (all supported permits closed)")

V-101 (steam inlet)    KEEP - supports open permit(s) CS-031
MCC-4 breaker 12       may be removed (all supported permits closed)
Blind B-7 (solvent)    KEEP - supports open permit(s) LB-052

Contractor surge and fatigue

Shutdowns can double or triple the number of people on site in a few days. Every one of them needs orientation, and many need specific training for confined space, hot work or fall protection. Plants plan orientation sessions in advance, check training records at the gate, issue site-specific identification and pair new workers with experienced ones. Supervisors from contractor firms must know the plant permit system and stay with their crews. Long shifts and many consecutive days cause fatigue, which slows reactions and impairs judgment. Good shutdown planning limits hours and consecutive days, schedules the most hazardous work when people are fresh, and monitors fatigue.

Shutting down and starting up

The transitions at the start and end of a shutdown are among the most hazardous phases of plant operation. Shutting down involves draining, purging, cooling and depressurizing equipment, and isolating it from live parts of the plant. Starting up involves the reverse, often with equipment that has been modified, with temporary blinds that must all be removed, with instruments recalibrated, and with operators who do this only once a year. Many major accidents, including the 2005 Texas City explosion, happened during start-up. Plants use written start-up procedures, checklists, pre-start-up safety reviews for changed equipment, and extra supervision during these phases.

Routine maintenance outside shutdowns

Not all maintenance happens during shutdowns. Plants do preventive maintenance, breakdown repairs and cleaning every day, often on equipment next to running lines. The same principles apply on a smaller scale: plan the job, identify energy sources, use permits where needed, isolate and verify, protect people from neighboring hazards, and hand back equipment carefully. Breakdown maintenance is the riskiest, because it is unplanned and production is waiting. Plants that do more planned preventive maintenance have fewer breakdowns and fewer of the rushed repairs that hurt people.

Daily shutdown meetings

During a shutdown, most plants hold short coordination meetings at the start of each shift. Supervisors from operations, maintenance and each contractor review the day's jobs, the permits needed, simultaneous operations conflicts, lifts and confined space entries, weather, and any incidents or near misses from the previous shift. The meeting is also the moment to stop and reset if things are going wrong: rising near misses, permit errors or fatigue. Some plants appoint a shutdown safety lead with the authority to pause work across the site.

Learning after the shutdown

When a shutdown ends, the pressure to restart and move on is strong, but a short review pays off. Which jobs ran late and why? Were there scope additions, permit errors, isolation problems or incidents? Did contractors perform as expected? Which lessons should change the next plan? Recording these findings, and feeding them into contractor evaluations, scope planning and procedures, is how plants make each shutdown safer than the last.

# Shutdown review: near misses per 10,000 hours by week (illustrative).
weeks = {"week 1": (9, 28_000), "week 2": (6, 36_000), "week 3": (2, 14_000)}
for w, (nm, hrs) in weeks.items():
    print(f"{w}: {nm} near misses in {hrs:,} h -> {nm * 10_000 / hrs:.1f} per 10,000 h")

week 1: 9 near misses in 28,000 h -> 3.2 per 10,000 h
week 2: 6 near misses in 36,000 h -> 1.7 per 10,000 h
week 3: 2 near misses in 14,000 h -> 1.4 per 10,000 h