Shutdown safety
Shutdown Safety Plan: Hazards, Controls and Indicators
A shutdown safety plan covers the hazards that arise when plants open equipment, bring in many extra workers and run simultaneous jobs: isolation, confined space entry, hot work, shift changes, fatigue, and shutdown and startup transitions. Each hazard gets a named control, an owner and a measure that shows the control is working.
This guide uses public regulators and investigation boards only: OSHA, UK HSE and the US Chemical Safety Board.
How MaintWiz helps: Many shutdown hazards come from permits, isolations and overlapping work. The MaintWiz shutdown module shows permits and isolations from ePTW on each work order and blocks closing a package while a permit or isolation is open. See the module · Get the permit register
By Jai Balachandran · Published · Last reviewed
What MaintWiz adds:Permits and isolations from ePTWShown on each work orderPackage cannot close with an open permitApprovals by signed-in user
The risk
Why are shutdowns more dangerous than normal operation?
Shutdowns put intrusive work, many extra people and simultaneous jobs into a short window, and the sharpest risks appear at transitions such as shutting down and starting up. There is no published statistic comparing shutdown injury rates with normal operation, so this page does not give one.
Intrusive work
Opening equipment needs it emptied and isolated. HSE guidance says to plan intrusive maintenance for shutdown periods to minimize isolation requirements. 1
Many more people
OSHA's process safety standard has a contractor paragraph that applies to turnaround and repair work on or near a covered process. 2 HSE warns permit supervision thins out when one person controls many permits, and names shutdowns as an example. 3
Competing jobs
HSE lists competing demands between maintenance, contract work, operation and modifications among the pressures plans must manage. 1
For the plan itself, see risk assessment in shutdown planning and how to plan a plant shutdown.
Evidence
What do public investigations show?
US Chemical Safety Board reports on three refinery and chemical-plant events point to the same weak spots: fatigue, misleading safety measures, unprotected transitions and people in the wrong place at the wrong time. 5,6,7
BP Texas City, 2005
Explosions on 23 March 2005 killed 15 and injured 180 during the restart of an isomerization unit. The CSB found operators were likely fatigued: the day board operator had worked 12-hour shifts, seven days a week, for 29 consecutive days. It also found that BP's low personal injury rate gave a misleading picture of process safety. 4,5
Husky Superior, 2018
An explosion occurred during an FCC unit shutdown for a turnaround. The CSB found most of the safeguards that keep air and hydrocarbons apart during shutdown were not implemented or not effective, and that process knowledge and training were inadequate. 6
Kuraray, 2018
An ethylene release and fire injured 23 workers during reactor startup after a turnaround. Welding by nonessential contractors likely supplied the ignition source, and no formal exclusion zone had been set. 7
Three events are not a statistical sample. They show what investigators found in each case, not how often it happens.
Software
Can software help with shutdown safety?
Software can hold permits, risk records and checklists in one place and show the permit and isolation status of every job, but it does not replace the competent people who issue and check permits.
See the shutdown management software overview for permits and isolations.
About MaintWiz. MaintWiz is an industrial AI platform with IoT, SAP integration and predictive maintenance (PdM) capabilities. Its shutdown and turnaround module helps plants plan, schedule, execute and close out shutdown work.
Also: product data sheet.
What the shutdown module covers
As described on the MaintWiz shutdown maintenance product page.
- Shutdown calendar and critical-path scheduling, with work order sequencing and dependencies
- Asset prioritization, so the most critical equipment is scoped first
- Resource planning for people, spares, heavy equipment such as cranes, and outsourced vendors
- Electronic permits to work, risk management and contingency plans
- Real-time progress monitoring: schedule adherence, cost variance, quality metrics and risk factors
- Step-by-step checklists, pre-restart testing protocols and post-shutdown analysis
Proof
What MaintWiz customers report
Figures as published in MaintWiz case studies on maintwiz.com. They come from maintenance management projects, not shutdowns.
Hazard map
Which hazards should a shutdown safety plan cover?
A shutdown safety plan should cover opening equipment, confined space entry, hot work, simultaneous jobs, shift changes, shutdown and startup, and fatigue, each with a named control and an owner.
Terms such as SIMOPS, hot work and confined space are defined with sources in the shutdown turnaround glossary. HSE guidance on isolation is summarized in HSG253 safe isolation for shutdowns. For treatment plants see water and wastewater plant outages for entry and isolation. For boilers see annual boiler shutdown in India. Work at height depends on controlled access; see turnaround scaffolding planning.
SIMOPS, short for simultaneous operations, is the execution of two or more tasks by two or more functional groups in the same place at the same time. A 2016 paper on a petrochemical complex says it can create risks in addition to the hazards of each single task. 13
| Activity | Main hazard | Control in public guidance | Source |
|---|---|---|---|
| Opening equipment, breaking containment | Release of stored energy or hazardous contents | Isolation, with boundary spades or blinds for hazardous inventory; isolation certificates cross-referenced to the permit; lockout of energy sources | HSE HSG253, OSHA 1910.147 |
| Entering vessels, tanks and other confined spaces | Hazardous atmosphere, engulfment, no easy exit | Written entry permit documenting the required measures before entry is authorized | OSHA 1910.146 |
| Welding, cutting and other hot work | Ignition near flammable material | Hot work permit for work on or near a covered process, confirming fire protection measures are in place | OSHA 1910.119 |
| Many jobs in one area | One job disturbs another | Plan interfaces; permit supervisors with time to check sites; limit active permits or add resource at peaks | HSE HSG253, HSE HSG250 |
| Shift changes | Information lost between shifts; lockout continuity | Face-to-face, two-way handover; orderly transfer of lockout protection | HSE shift handover, OSHA 1910.147 |
| Shutting down and starting up | Hazards that do not exist in steady operation | Technology-specific safeguards, trained operators, accurate procedures, and keeping nonessential people out during startup | CSB Husky report, CSB Kuraray report |
| Long hours on turnaround schedules | Fatigue-impaired decisions | A written fatigue rule for the site (the CSB found 29 consecutive 12-hour days at Texas City; this page does not cite a numeric limit) | CSB Texas City report |
Permits and isolations in depth: permit to work during shutdown. Contractors: shutdown contractor management.
Measures
Which safety measures should you track?
Track both leading measures, which check that controls are working, and lagging measures, which show where they failed; HSE's HSG254 calls this dual assurance. 11
Injury rate alone is not enough. The CSB found that reliance on BP Texas City's low personal injury rate failed to give a true picture of process safety performance. 5 The standard formula multiplies recordable cases by 200,000 and divides by employee hours worked; for example 7 cases over 400,000 hours gives 3.5. 12 The full KPI set is in shutdown KPIs.
| Measure | Type | Basis |
|---|---|---|
| Share of permits issued where hazards, risks and control measures were adequately specified | Leading | Example indicator in HSG254, measured on a sample basis |
| Share of work carried out in line with permit conditions | Leading | Example indicator in HSG254, measured on a sample basis |
| Incidents where plant or equipment could be damaged through failure to control high-risk maintenance | Lagging | Example indicator in HSG254 |
| Recordable injury rate = cases x 200,000 / hours worked | Lagging | OSHA and BLS formula; useful, but not a process safety measure |
The plan
What goes into a shutdown safety plan?
A shutdown safety plan has six parts: a hazard review of the scope, isolation and permit arrangements, contractor preparation, shift and fatigue rules, protection for shutdown and startup transitions, and daily measures. OSHA requires employers to tell contract employers about known fire, explosion and toxic release hazards and the emergency action plan, and contract employers to train and document each worker. 2
The US rule map is in OSHA PSM turnaround rules; for UK rules see HSG253 safe isolation for shutdowns. The US rule map is OSHA PSM turnaround rules; the UK equivalent is HSG253 safe isolation guidance. A free Excel file for this page: permit register and isolation list (.xlsx).
- 1
Review the hazards of the scope
Walk the work list for intrusive jobs, hot work, confined spaces and simultaneous work before the scope is frozen.
Output: hazard review linked to the work list - 2
Plan isolations and permits
Decide the isolation method for each system, who issues permits, and how many permit issuers the peak days need.
Output: isolation plan and permit-desk roster - 3
Prepare contractors
Select on safety performance, tell them the hazards and emergency plan, and train and document each person.
Output: induction record per contractor - 4
Set shift and fatigue rules
Fix shift length, rest days and handover time; decide who can stop work.
Output: written site rule - 5
Protect transitions
Write and rehearse the shutdown and startup procedures; keep nonessential people out when hazardous materials are reintroduced.
Output: procedures, drills and exclusion zones - 6
Measure and review daily
Track a few leading measures every day and act on them at the morning meeting.
Output: daily safety review
Visuals
Save the safety charts
Both charts open full size when clicked, ready to print for a toolbox talk.
FAQ
Frequently asked questions
Why are shutdowns more dangerous than normal operation?
They put intrusive work, many extra people and simultaneous jobs into a short window, and the biggest risks arise at transitions such as shutdown and startup. There is no published statistic comparing the two. 1,6
What safety hazards are common during a shutdown?
Breaking containment, confined space entry, hot work, simultaneous jobs, shift changes, transient operation and fatigue. Each has a control in public guidance. 1,9,2
What did the CSB find about the BP Texas City explosion?
The explosions killed 15 and injured 180 during restart of an isomerization unit. The CSB found operators were likely fatigued after 12-hour shifts for 29 or more consecutive days, and that the low personal injury rate misled BP about process safety. 5
What is a leading safety indicator?
A routine check that a key control is working, for example the share of permits where hazards and controls were adequately specified. A lagging indicator reports a failure after it happens. HSE calls using both dual assurance. 11
How do you calculate the injury rate?
Recordable cases multiplied by 200,000, divided by employee hours worked. Seven cases over 400,000 hours gives 3.5 per 100 full-time workers. 12
What does OSHA require for contractors in covered processes?
The host employer must evaluate contractor safety performance, inform contractors of hazards and the emergency plan, control entry to process areas and keep an injury and illness log. Contract employers must train, instruct and document each worker. 2
Why keep nonessential workers out during startup?
In the Kuraray case the CSB found welding by nonessential contractors likely ignited an ethylene release during startup after a turnaround, and that no formal exclusion zone existed. 7
Is there a legal limit on shift length?
This page found no public numeric limit to cite. The CSB noted the Texas City operators' 12-hour, seven-day schedule; set a written site rule and check local law. 5
Sources
Sources
- UK Health and Safety Executive, The safe isolation of plant and equipment (HSG253, 2006)
- OSHA, 29 CFR 1910.119, Process safety management of highly hazardous chemicals
- UK Health and Safety Executive, Guidance on permit-to-work systems: a guide for the petroleum, chemical and allied industries (HSG250, 2005)
- U.S. Chemical Safety and Hazard Investigation Board, BP America (Texas City) refinery explosion
- US Chemical Safety and Hazard Investigation Board, Investigation Report: Refinery Explosion and Fire, BP Texas City (Report No. 2005-04-I-TX)
- US Chemical Safety and Hazard Investigation Board, FCC Unit Explosion and Asphalt Fire at Husky Superior Refinery (No. 2018-02-I-WI, 23 December 2022)
- US Chemical Safety and Hazard Investigation Board, Ethylene Release and Fire at Kuraray America, Inc. EVAL Plant, Pasadena, Texas (No. 2018-03-I-TX, 16 December 2022)
- OSHA, 29 CFR 1910.147, The control of hazardous energy (lockout/tagout)
- OSHA, 29 CFR 1910.146, Permit-required confined spaces
- UK Health and Safety Executive, Human factors: Shift handover
- UK Health and Safety Executive, Developing process safety indicators: a step-by-step guide for chemical and major hazard industries (HSG254, 2006)
- US Bureau of Labor Statistics, How to compute your firm's incidence rate for safety management
- Marucco, D., Simultaneous Operations Risk Assessment, Chemical Engineering Transactions, vol. 53 (2016)
Keep permits and isolations tied to the work
Book a demo and bring your permit process. We will show how ePTW permits and isolations appear on each work order.