Shutdown Plan

This plan covers the boundary and sequencing of a planned outage from freeze to restart. Using it for the capital project that installs new equipment, or the safety case behind that project, produces a record that answers the wrong question when read back.

ISO 55001 governs how the outage is planned and controlled; the safety-plan fields sit inside that same operational control but usually also feed a site's ISO 45001 audit trail, since a shutdown is exactly where hazards from different trades overlap.

A shutdown plan's operational-control requirements come from ISO 55001, but the isolation and restoration work inside it answers to whichever hazardous-energy law governs the site, and that law is where the real enforcement teeth are.

Filling in the readiness checklist is mechanical. Deciding whether 'partly ready' is acceptable, and whether the isolation plan actually closes the loop back to normal running, decides whether the shutdown starts on time and finishes safely.

The findings that recur at audit are rarely a blank field — they're a readiness field marked Yes ahead of time that nobody re-checked closer to the actual start date.

A maintenance manager set a scope freeze date three weeks ahead of a shutdown, with Late Additions Process Defined marked Yes and forty-two work orders locked in. Over the following fortnight, production identified six more small jobs, each waved through informally because the formal process felt like unnecessary friction. None were logged as late additions; they were simply added to the work order list.

The shutdown ran close to plan on the jobs everyone had planned for. But Plan Adherence Percent, calculated against the frozen forty-two, came back at ninety-four, while the actual delivered scope had been forty-eight all along. The six unlogged jobs had eaten into contingency without showing up as a deduction, and the last crew worked two hours into an unplanned extension. The fix wasn't tighter enforcement of the freeze date — it was routing every addition, however small, through the formal process as a logged decision.

The form is the easy part. Keeping the scope freeze honest, chasing readiness marked Yes too early, and holding the isolation-to-restart chain together is the work that actually slips.

KnowMaintain

Holds the shutdown register against its work orders and assets, tracks readiness up to the start date rather than only when first marked Yes, and keeps the isolation plan linked to its restoration plan.

KnowSafe

Watches the safety-plan fields for a Partly answer on simultaneous operations or emergency arrangements never resolved to Yes before work started.

KnowOps

Tracks production's side of the plan — stock build, customer commitments, line clearance — so readiness isn't judged on maintenance fields alone.

Ella

Coordinates maintenance, production and safety on one plan, rolls late additions and outstanding readiness into a single view, and holds every write for your approval first.

Scope freeze

The point, marked by Scope Frozen Date, after which no work order can be added without a formal late-additions decision, protecting the contingency the plan was built with.

Critical path

The sequence of dependent jobs whose combined duration sets the minimum possible length of the shutdown, distinct from total labour hours, most of which run in parallel.

Kitting

Gathering the parts, tools and consumables needed for a specific job into one set before the shutdown starts, so a technician isn't searching stores mid-outage for something already needed.

Lockout/tagout (isolation)

The documented procedure for isolating equipment from its energy sources before work begins and safely restoring it afterwards, treated in most jurisdictions as a distinct legal requirement.

Simultaneous operations (SIMOPS)

Two or more work activities running in the same area or time window whose combined hazards are greater than either presents alone, such as hot work above a confined space entry.