Shutdown planning: the checklist, the scope freeze and the schedule that holds

Shutdown, turnaround, outage

The names change by industry and the event does not. A planned stop of a continuous operation to do the work that cannot be done while it runs: relines, liner and screen changes, belt splices, vessel inspections, tie-ins for projects, and the statutory and assurance work that needs the plant cold. Mining says shutdown, oil and gas says turnaround, power says outage.

What makes it different from routine maintenance is concentration. Work that would take a crew a year is done by several crews in a week, in the same space, under the same permits, on the same critical path. That concentration is why planning has to run on gates, with each phase ending in a decision that is evidenced rather than assumed.

The timeline, and the gates on it

A major event runs on a timeline of nine to twelve months, and each phase ends at a gate. The gate is a decision with evidence behind it: the event is approved, the scope has been challenged, the scope is frozen, the plan is complete, the site is ready, the plant is handed back, the event is closed. Shorter events compress the timeline but keep the gates.

The windows below suit a quarterly or annual processing plant shutdown. The point is the order, and the discipline of not opening the next phase until the gate behind it is closed. A site that starts detailed planning before the scope is frozen plans twice.

Where scope comes from, and the challenge

Scope comes from evidence. The maintenance strategy says which tasks fall due in the window. Wear measurements on liners, screen media, idlers and wet ends say which are actually at the end of their life. Inspection and condition monitoring findings say what has deteriorated. Projects say what needs a tie-in. The deferral log from the last event says what was promised. Everything else, and there is always everything else, is a candidate until it has a justification.

The scope challenge is the meeting where each candidate is asked three questions. Can it be done online, between events, so it does not need the window at all? Can it wait for the next event without a consequence worth the cost of doing it now? If it must be done now, what happens if it is not? The answers are recorded on the scope register beside the item, and the items that fail the challenge are deferred with a reason rather than quietly kept.

This is the step that most reduces an event's cost, and the one most often skipped. A scope register that was never challenged is a wish list with a budget, and the challenge cannot happen without the wear data and the strategy behind it, which is why fixed plant maintenance between events matters so much to the event itself.

• One register, one owner, with a source and a justification against every line.
• Measure wear parts before the challenge, not before the freeze. The measurement is the evidence.
• Separate must-do, should-do and could-do, and plan the could-do as contingency scope that goes ahead only if the critical path allows.
• Give project tie-ins the same challenge as maintenance work. A project's window is not a reason by itself.

The scope freeze

The scope freeze is a signed decision that the register is now the scope, and that anything added after it is an addition. It is set by the longest lead time in the scope, because long lead materials and contract packages have to be ordered and tendered against a fixed list, and for a major event that puts the freeze four to six months out. Everything that follows, from job packs to the schedule to the kitting, is built against the frozen list.

Freezing does not mean nothing changes. It means every change goes through one approval path, is judged on consequence and on what it does to the critical path, and is counted. The addition process is defined at the freeze, with a named approver and a form of evidence, so when a discovery during the work or a request from a manager arrives, there is a path and a record rather than an argument.

Scope growth after the freeze, as a share of the frozen scope, is the measure that tells a site whether its planning is improving across events. Reported honestly, it is usually the most uncomfortable number in the close-out report and the most useful.

From a line on the register to a job that can be done

Every item on the frozen scope becomes a work order with a job pack: the steps, the trades and durations, the materials, the permits and isolations, the access and lifting, and the drawings and procedures the crew will work from. On a shutdown the pack also carries what the routine week does not: the sequence against other jobs in the same area, the scaffold and crane it depends on, and the test it has to pass before the item is closed.

The isolation plan comes from the packs. Isolations are grouped so one set of locks serves many jobs, long isolations are pre-approved, and the order in which systems come down and go back up is agreed with operations. Access is designed the same way: a scaffold plan, crane and lift studies, lay down areas and a traffic plan, each booked and each on the schedule as a task in its own right.

Pre-shutdown work is the last step of planning and the first of execution. Scaffold erected while the plant runs, components pre-assembled, lay down areas set and the first shifts' permits written take hours off the critical path that would otherwise be spent on the most expensive days of the year.

The schedule, the critical path and the people

The schedule is built from the job packs, not the other way round. Each pack supplies durations, trades and dependencies, the scheduler levels the work against the shift pattern and the crews, and the critical path falls out: the chain of jobs that sets the duration of the event. On most processing plant shutdowns it runs through the mill reline, the largest vessel inspection or a structural repair, and it is known months in advance.

Contingency is held deliberately, as time on the schedule and money in the budget, with a rule for who can spend it. A schedule with no float is a forecast of overrun. One with hidden float in every task is a forecast of waste. The contingency sits at the end of the critical path and is spent by decision.

The daily rhythm is set before the event and rehearsed. One meeting a shift, short, with progress by work order against the baseline, the critical path status, the additions requested and decided, and the next shift's priorities. The people who will run it practise on the plan before they run it on the plant.

• Build the schedule from job packs, with every pack's dependencies and access needs in it.
• Know the critical path and protect it. Anything that touches it is approved at a higher level.
• Level resources honestly against the shift pattern, including the hours lost to permits, travel and handover.
• Hold contingency as a visible block, and spend it by decision.
• Plan start-up and recommissioning as part of the event, not as what happens after it.

Readiness: proven at gates, not by percentages

Readiness is the question of whether the site can execute the plan from the first shift. It is answered by evidence against each line of the checklist, not by a percentage complete on a tracker. Materials are either received, inspected and kitted by work order, or they are not. Contractors are either inducted and competent on the site's isolation system, or they are not. Permits for the first shifts are either written, or they are not.

The checklist below is the one that runs through this guide. Each line says what has to be true and what proves it, and each phase ends at its gate. The workbook carries the same lines with an owner, a due date and a status against each, plus a scope register and an addition log laid out to match.

Execution: holding the plan while the plant is open

Execution is where the plan meets what the plant was actually hiding. Discovered scope is normal, and the discipline is in how it is handled: each finding is logged, assessed for now, later or never, and either added through the approval path or recorded for the next event. The discovery log is as important as the schedule, because it is the evidence behind the next scope register.

Progress is measured by work order against the baseline every shift, and the critical path is reviewed every shift. When it slips, recovery is decided in the meeting, by moving crews, extending a shift or spending contingency, rather than hoped for. Jobs are closed on a signed test or inspection, not on a verbal, and the hand-back to operations follows the start-up plan written months earlier.

The software a site runs this on matters less than the rhythm, but it matters. A shutdown coordination platform that holds the scope, the bookings, the labour and the progress in one place removes the hunt for information that eats the first hour of every meeting.

Close-out is where the next event starts

The event is not over when the plant restarts. The punch list is cleared or converted to work orders with owners. Every work order gets its history: hours, findings, measurements and as-found condition, in the CMMS, so the next planner has data rather than memory. Wear life achieved on liners, media and idlers goes back into the intervals, which is the loop that makes the next scope register smaller and more accurate.

The close-out report puts the event's numbers against its plan: duration, cost, scope growth, schedule adherence by shift, safety, start-up time and losses after hand-back, and rework. Lessons are captured while people remember them, and the first lines of the next event's scope register are opened the same month. A site that does this consistently sees scope growth fall and duration converge on plan across three or four events.

• Duration against baseline, and where the critical path slipped.
• Cost against estimate, split between the frozen scope and additions.
• Scope growth as a share of the frozen scope, by source.
• Schedule adherence by shift, and the recovery decisions taken.
• Safety performance, including the near misses.
• Start-up time and production losses after hand-back.
• Rework, and what caused it.

Common mistakes

• A scope register nobody challenged, so the event does work the plant did not need.
• A freeze set by the calendar rather than by the longest lead time, so planning runs against a moving target.
• Long lead parts ordered from the scope list instead of from measured wear, and arriving after the window.
• Job packs that stop at the task description, with access, isolations and tests discovered on the day.
• A schedule with no visible critical path, so nobody knows which slip matters.
• Readiness reported as a percentage, with the missing twelve per cent on the critical path.
• Additions by conversation, uncounted, so scope growth is a feeling rather than a number.
• No close-out, so the next event starts from a blank workbook and repeats the last one's lessons.

Common questions

Key terms

Plain-language definitions from our glossary for the concepts this article leans on.

Standards and further reading

• Best practices, metrics and guidelines for maintenance and reliability (SMRP)
• Recommended practices for planning, scheduling and cost engineering (AACE International)
• ISO 55001:2024 Asset management system requirements (ISO)
• ISO 14224:2016 Collection and exchange of reliability and maintenance data for equipment (ISO)
• Guide for major hazard facilities, safety management systems (Safe Work Australia)
• Operations and maintenance best practices guide (US DOE Federal Energy Management Program)
• Guidelines library for mining technology and interoperability (Global Mining Guidelines Group)

Related case studies and tools

• Shutdown coordination platform (case study)
• Work management and scheduling uplift (case study)
• Cost of Downtime Calculator (tool)

Related reading