Start-up and shutdown — the hours when plants break

A plant spends almost all of its life running steadily, and a small fraction of it starting up or shutting down. A disproportionate share of serious incidents happens in that small fraction.

Why transitions are the dangerous part

Steady operation is the condition everything was designed for. Every control loop is tuned for it, every protection is set around it, every operator knows what the screens should look like.

Purging and inerting

Before hydrocarbon enters equipment that has been open, the air has to come out.

The reason is the flammable range. A vessel full of air, filled with hydrocarbon, passes through the range between too lean to burn and too rich to burn — and it spends that passage as an ignitable mixture inside a closed vessel.

A temporary nitrogen purge set-up during commissioning: a bank of nitrogen cylinders on a wheeled trolley frame connected through a manifold and regulator to a braided flexible hose, running to a temporary spool piece flanged into process pipework. — Temporary, wheeled, and connected by a hose somebody made up that morning. The gas going down it gives no warning of any kind, which is why the purge is measured rather than assumed.

Warming, cooling and the rate of change

Equipment tolerates temperature; it does not always tolerate changing temperature quickly.

Differential expansion between a thick flange and a thin pipe, between tube and shell in an exchanger, or between refractory and steel in a fired heater produces stresses that steady operation never imposes. Procedures therefore specify heating and cooling rates, not just target temperatures.

Fired heaters have their own constraints — refractory dry-out on a new heater takes days, and a cold-start ramp is specified in degrees per hour. See fired heaters.

Controlled shutdown versus a trip

They are not the same event and should not be treated as interchangeable.

A trip is the safety system doing its job: removing energy and feed as quickly as possible because something has gone outside a safe limit. It is fast and it is blunt.

A controlled shutdown reaches the same end state in an order that equipment can tolerate — reducing rates, letting machines run down through their sequences, cooling at a controlled ramp, depressuring deliberately.

The first start-up after a turnaround

Of all the transitions a plant makes, this is the one that concentrates the risk.

Everything that was opened is being proved at once

During a turnaround, systems are opened, vessels entered, exchangers pulled, valves overhauled, instruments removed, lines blinded and modifications installed. All of it is reinstated on paper.

On start-up it is pressurised and heated for the first time, and everything that was done wrong surfaces in the same few hours:

Blinds left in, or removed where they should have stayed
Valves in the wrong position — a closed valve on a relief path is the serious one
Gaskets wrong material, wrong size, or missing entirely
Instruments returned uncalibrated or reconnected to the wrong tapping
Lines not reinstated, temporary strainers still fitted, drains left open
Overrides applied during the outage and never removed

The defence is the reinstatement register and the walkdown, done by somebody prepared to be unpopular about it.

A diagram of the permit to work lifecycle, showing the stages from request and hazard assessment through issue, display at the worksite, suspension and handback to cancellation. — The handback step is where a turnaround becomes a start-up. What was isolated, blinded or overridden has to come back deliberately, item by item.

Cleaning out what construction left behind

New or rebuilt pipework contains what was left in it during fabrication: welding rod stubs, grinding dust, mill scale, rags, and occasionally gloves and hand tools.

Air blowing, steam blowing, water flushing or chemical cleaning removes it before the system is commissioned, with temporary strainers left in the suction of every machine for the first period of running.

Where this connects

Transitions are where alarm floods happen, where overrides are applied, and where relief systems see their most unusual cases. They are also where the greatest share of what incident investigation examines takes place.

What to take away

Transitions carry the risk, because conditions are abnormal, controls are manual, protections may be bypassed and people are under pressure.
Purge before admitting hydrocarbon, and before admitting air. The flammable range is crossed in both directions.
Rate of change matters, not just the target. Differential expansion is a transition-only stress.
Warm steam lines slowly with drains open. Water hammer splits pipework.
A trip protects people; a controlled shutdown protects the plant too. Use the planned route where there is a choice.
The first start-up after a turnaround is the highest-risk shift — every reinstatement error surfaces at once.
Clean out construction debris, and actually inspect the temporary strainers before removing them.