The misconception that risk stops when equipment stops

A shutdown maintenance period at a petrochemical plant—a turnaround—is when production equipment is deliberately stopped for inspection, cleaning, replacement, repair, and modification. Equipment that is normally difficult to access is opened to restore its integrity. Yet stopping a process does not by itself put equipment in an energy-free, material-free state. Lines can retain pressure and residue, drains and vents can be blocked, and connected systems can remain in operation. Maintenance also introduces new energy, such as nitrogen purging, steam blowing, cleaning, welding, lifting, and scaffold installation.

Accordingly, the title's phrase "accidents concentrate" must not be read as an assertion of a specific incidence rate. Work scope and aggregation criteria differ by site, and public statistics alone make it difficult to generalize the accident frequency of every maintenance period into one figure. This article considers CSB's Safety Digest: Incidents During Startups and Shutdowns and the structural conditions repeatedly shown by individual accident investigations. During maintenance, abnormal states, many workers, temporary configurations, multiple permitted tasks, and time-pressured decisions overlap in the same time and space. Risk grows not from the number of tasks alone, but from their interactions.

A transient state in which normal operating safeguards disappear

In normal operation, flow, pressure, temperature, and liquid level stay within defined ranges, and automatic control, alarms, and operators' experience are built around that condition. During shutdown and restart, valve lineups keep changing, some instruments are bypassed or under maintenance, and lines are emptied and filled again. The direction of liquid and gas flow can also differ from normal. This is called a transient state or an abnormal operating state. Management must cover not one point at which equipment is fully stopped, but the entire transition from normal operation to shutdown, from shutdown to maintenance, and from maintenance to restart.

The U.S. OSHA's Process Safety Management standard, 29 CFR 1910.119 requires operating procedures to address initial startup, normal operations, temporary operations, emergency shutdown, normal shutdown, and restart after a turnaround separately. This means that the hazards and allowable conditions of the same equipment differ by state. Unless instruments changed during shutdown, temporary hoses, removed blinds, locked valves, and defeated interlocks are reflected in current drawings and procedures, the restart team operates today's plant using yesterday's drawings. The end of maintenance should not be treated only as a task-completion list, but as a handover that confirms the design state and field state once again agree.

Simultaneous operations are not the sum of several permits

During a turnaround, hot work, line opening, confined-space entry, work at height, lifting, radiographic testing, electrical work, and cleaning proceed simultaneously in nearby locations. Even when each task independently meets its permit conditions, it can undermine another task's conditions. Sparks from welding above can fall into an open line below, a cleaning agent can create an unexpected vapor, and a mobile crane can block an evacuation route. One team's ventilation fan can also move another team's gas cloud toward workers.

CSB's Wacker Polysilicon accident-investigation release noted that, while bolts were being tightened on piping containing hazardous material, another contractor crew was performing thermal-insulation work on the same structure, but the simultaneous-operations hazard had not been assessed. The lesson is that checking fitness permit by permit is insufficient. Tasks with overlapping space, time, energy, and release paths must be viewed on one map; if they conflict, their sequence must change or the areas must be separated.

In practice, it is useful to place work permits on a process-area map in a SIMOPS coordination meeting before every shift. Mark together the wind direction and impact radius for line-opening work, hot-work locations, confined-space entries, lifting radii, emergency evacuation routes, and the availability of gas detectors and fire-protection equipment. What matters is not the number of people at the meeting, but who has the authority to delay or stop work when a conflict is found.

Line opening begins with the first identification, not the last bolt

Opening a flange, manway, drain, or instrument connection is a boundary at which residual material can meet people directly. But risk control begins when the work target is identified, not just before a bolt is loosened. Lines of the same elevation and color may run side by side, tags may be hidden by railings or insulation, and drawing numbers may differ from field markings, allowing even an experienced worker to select the wrong equipment. Reliance on an indirect clue such as "the flange near the lockout device" creates the possibility of misidentification.

The CSB final investigation report on the 2024 PEMEX Deer Park refinery hydrogen sulfide release concluded that a contractor worker opened an active line slightly away from the intended flange by mistake. A broad work permit combined tasks with different hazards, and stop points and operator-witness conditions were not clearly implemented. The report also noted that the risk of many workers in an adjacent unit under maintenance being in the release path was not adequately assessed.

Before opening a line, therefore, the current P&ID must be compared with the field piping, and operations and maintenance must conduct a joint field verification in which both point to the exact work point. Tag number, fluid name, flow direction, upstream and downstream isolation points, and blind location must be checked using two or more independent means. Rather than grouping work broadly as "removal of several blinds in this area," the permit must distinguish opening tasks with different hazards and stop points. A hold point such as operator reconfirmation before loosening some bolts must be designed not as one line of text but as an action involving signature, field witnessing, and approval to resume work.

Isolation is not closing a valve; it is proving zero energy

Closing an isolation valve and applying a lock does not complete isolation. A valve seat can leak, and a common header or bypass, instrument tubing, thermal expansion, gravity, residual pressure, and heat of reaction can reintroduce energy. Not only electricity, but also pressure, temperature, chemical reaction, rotation, and potential energy must be checked. Where equipment hazards and work consequences are significant, higher-reliability methods such as double block and bleed, blind insertion, or physical separation should be selected according to the risk assessment.

OSHA's Control of Hazardous Energy Inspection Procedures describe how, in maintenance of complex process equipment, operators isolate, depressurize, and clean a system, then review energy control with the maintenance team, while workers participate in individual or group lockout arrangements. They also present an approach in which line opening is managed under a special work permit issued by operations and monitored by an operator. The point is not to hand isolation responsibility only to operations or only to maintenance. Operations knows the process state, while maintenance knows the work point where people are actually exposed. Those two kinds of knowledge must meet in the field.

An isolation checklist should include not only "valve closed," but also confirmation of residual-pressure release, an open drain path, completed purging, the substance to be detected, the method of proving zero energy, blind numbers and installation direction, lockbox participants, and shift handover. When work scope changes or an adjacent system's state differs, do not simply extend the existing permit; review the isolation boundary again.

More contractor personnel requires designed information transfer

A turnaround brings in large numbers of specialized trades and short-term personnel. They may be skilled in welding, scaffolding, cleaning, or inspection, but they do not automatically know the plant's pipe layout, alarm sounds, wind paths, evacuation assembly points, or adjacent systems that remain in operation. A general induction does not by itself mean that the hazards of the equipment assigned today have been communicated. When workers move to another unit or work scope changes, the new process hazards and safeguards must be explained again.

In the PEMEX accident as well, workers were suddenly reassigned from a turnaround unit that had been isolated and emptied to an adjacent unit still partly operating, but they were not sufficiently informed of the changed conditions. The OSHA PSM standard also addresses contractors performing turnaround, maintenance, and specialist work separately, requiring the host employer to provide information on known fire, explosion, and toxic-release hazards and emergency actions and to evaluate contractor performance. Contractors, in turn, must ensure that their workers understand and follow site safety rules.

A good handover is demonstrated by checking questions rather than a signature list. Workers should be able, in their own words, to explain what they will open, what material may remain, which valves and blinds protect them, and in which direction they will evacuate if an alarm sounds. Drawings, photographs, and color markings that account for language and literacy levels are also needed, but a single color must not be the only means of identification.

How schedule pressure thins protective layers

Because every day of turnaround shutdown affects production and contractual schedules, pressure to make progress is intense. The schedule itself is not an accident cause, but when only the cost of delay is visible and the cost of risk disappears from the decision table, protective layers thin one by one. Joint field verification is replaced with telephone approval; work requiring separate permits is combined into a broad permit; the next trade is brought in before inspection results arrive; and a past gas reading that was favorable substitutes for current measurement. Night extensions and shift changes can blur who is responsible for which isolation.

Schedule management should not be a separate system opposed to safety, but an input to process safety. A work plan should first reserve the time needed for installation and verification of isolation, gas removal, cooling, sample results, management of change, and pre-startup safety review. When simultaneous work is added to recover a delayed schedule, the SIMOPS risk assessment must be performed again. Teams exercising stop-work authority and supervisors reporting delay should not be penalized, and minimum hold points that production and safety managers cannot release should be set. Managing leading indicators such as the number of permit reissues, discovered isolation errors, and improvement after work stoppage alongside "on-time completion" can make schedule pressure less likely to remain hidden.

Gas measurement is not a permit stamp; it monitors change

Gas measurement before opening is an important protective layer for confirming what remains in equipment. But one normal reading does not guarantee all work that follows. The atmosphere can change again when a blocked drain opens, a valve leaks, sludge is disturbed, or purge and ventilation conditions change. The instrument must have a sensor and range capable of detecting the expected substance, and its bump test and calibration status and the transport time through the pump and hose must be checked before use. Measurement locations must also reflect not one point at an opening but upper, middle, and lower levels, dead zones, workers' breathing zones, and anticipated release paths.

The Korea Occupational Safety and Health Agency's Technical Guide on Inspection, Maintenance, and Modification of Atmospheric Storage Tanks, C-C-6-2025 calls for confirming fire, explosion, asphyxiation, and poisoning hazards before tank inspection or maintenance; performing work after a safe-work permit and required measures; and measuring gas and oxygen concentrations before internal inspection or maintenance begins. Specific allowable values must be determined according to the substance, task, law, and site criteria, so this article does not apply one concentration value to every task.

Measurement records must include the gas name, location, time, equipment state, ventilation conditions, and measurer. For work in which a change of state can be fatal, such as hot work, confined-space work, or opening toxic substances, set continuous-monitoring or remeasurement criteria matched to the rate of hazard change. When an alarm sounds, the first procedure must not be to approach and look for the cause; it must be to stop work immediately, evacuate, and control the area, after which authorized personnel confirm the state remotely or by protected means.

Restart is not the end of maintenance, but another high-risk task

When maintenance ends, removed blinds are restored, valves are returned to operating position, and interlocks and alarms are brought back into service. At this point, incomplete work, temporary repairs, incorrectly installed parts, tools and debris, reversely connected instruments, and drains that are not closed may be hidden. If operators do not understand the modified equipment, incorrect responses can follow before the process enters its normal range.

OSHA's PSM Appendix C implementation guidance explains that a change during a turnaround that is not replacement in kind is handled through management of change, with drawings and operating procedures updated and needed training and pre-startup review performed. A pre-startup safety review is not a meeting to close a checklist quickly. It is a gate for proving in the field that the installation matches the design, safety, operating, maintenance, and emergency procedures are in place, management-of-change actions are complete, training is completed, and safeguards are restored. During restart, keep only essential personnel in the hazard area, separate nonessential maintenance and hot work, and determine in advance the conditions and accountable person for stopping when abnormal signs appear.

Eight operating questions that break the accident structure

The level of control over shutdown maintenance can be checked not by the number of documents, but by whether the following questions can be answered.

  1. Is today's process state fully shut down, partly operating, purging, testing, or restarting, and how is it displayed in the field?

  2. Who identifies simultaneous operations that affect one another before each shift, and which work is stopped when they conflict?

  3. Have two parties independently verified the equipment to be opened against the drawings and in the field?

  4. By what method have all energy sources and ingress paths been isolated and the absence of residual pressure and material demonstrated?

  5. When workers are reassigned or scope changes, have process hazards, evacuation, and safeguards been communicated again?

  6. Do the target, location, timing, remeasurement conditions, and post-alarm action for gas measurement match the hazard scenario?

  7. When the schedule slips, are non-omissible hold points and stop-work authority assured?

  8. Before restart, who gives final confirmation of changes, temporary measures, blinds, valves, instruments, interlocks, and incomplete work?

The eight questions are not separate checklists but one interconnected network. Even accurate line identification is hazardous if isolation is wrong, and even correct isolation changes conditions when adjacent hot work begins. Even appropriate measurement leaves the next team working on an outdated premise if equipment state is omitted during shift handover. The core management unit of a turnaround is therefore not an individual task but the process state and interfaces between tasks.

Conclusion: manage interfaces, not maintenance volume

Risk during shutdown maintenance cannot be explained in one sentence as "because there are many people" or "because a worker made a mistake." With the stable conditions of normal operation gone, multiple trades overlap, piping and energy boundaries keep changing, and unfamiliar contractor personnel move under schedule pressure. Even where individual permits and training exist, broken connections between them can turn incorrect equipment opening, residual-material exposure, ignition, and delayed evacuation into one accident pathway.

The starting point for prevention is not approving every task faster, but making the state visible. Align the current operating state, isolation boundary, simultaneous-work conflicts, gas conditions, responsible person, and stop points on one screen and in one field language. Then review permits again whenever scope, personnel, wind, or process state changes. A turnaround is not an event for stopping equipment; it is a period of operating a temporary plant in which the composition of risk changes rapidly. Only from that perspective can maintenance completion and safe restart be managed as the same goal.

References

Cover photo

Original photo on Pexels