Module 02 · Operations

Planned Shutdown

A controlled, step-by-step procedure to safely extinguish a fired heater, purge hydrocarbons, and prepare the unit for inspection or maintenance. The goal is a cold, gas-free firebox with all energy sources isolated.

ℹ

Planned vs emergency shutdown

This page covers planned shutdowns — where you control the pace. Emergency shutdowns (ESD) follow a different sequence driven by the BMS and are covered separately. The core difference: here you manage the cool-down rate. In an ESD, the BMS acts immediately and you respond after the fact.

Shutdown phases

A planned heater shutdown progresses through five distinct phases. Each has a different primary risk — understanding the risk in each phase helps you recognise when something is going wrong.

Pre-shutdown coordination

Confirm with operations, process, and maintenance that all parties are ready. Check permit status, identify which isolation valves will be used, and confirm steam-out / purge gas availability. Rushing this phase causes problems in every subsequent one.

Derating — controlled load reduction

Reduce firing rate in steps, matching the rate at which process flow is reduced. The primary risk here is low flow / high temperature — reducing firing faster than flow, or flow faster than firing, both create conditions for tube overheating or coking. Monitor outlet temperature and tube metal temperatures throughout.

Burner extinguishment & fuel isolation

Extinguish burners in sequence per the BMS procedure. Isolate all fuel supply valves — both the automated SDVs and manual isolation valves. Confirm zero fuel pressure at the burner header before declaring fuel isolated. This is the most safety-critical phase.

Firebox purge

Natural draft continues to purge the firebox after burners are out. Forced purge using air or steam may be required if access is needed sooner. Confirm firebox atmosphere is clear before any personnel entry — LEL readings should be zero at multiple sampling points.

Cool-down, deinventory & isolation

Allow the heater structure to cool at a controlled rate. Drain and/or steam-out the process coil if maintenance access is required. Install blinds at all isolation points, lock out energy sources, and hand over to maintenance with a completed permit package.

Cool-down rates — why they matter

Refractory and tube support structures expand and contract at different rates. Cooling too fast causes differential thermal stress — cracking refractory, distorting tube hangers, and in severe cases, cracking welds at tube supports. Your site procedure will specify exact limits; the general guidance below reflects common industry practice.

Firebox cool-down — normal

≤ 50°C/hr

Maximum cool-down rate for refractory protection during normal planned shutdown.

Process coil cool-down

≤ 30°C/hr

Slower rate applies to high-alloy tubes (Cr-Mo grades) to prevent reheat cracking risk.

Minimum process flow during derating

> 30%

Do not reduce flow below minimum flow threshold while any burners remain lit. Check site datasheet for your heater's actual minimum.

Ambient temp before entry

≤ 40°C

Internal firebox temperature acceptable for personnel entry in full PPE. Verify with calibrated thermometer at entry point — not from external skin temp.

⚠

Refractory dry-out requirement after wet shutdown

If the firebox has been steam-purged or exposed to water ingress, the refractory must be dried out per the manufacturer's heat-up curve before the next startup. Skipping this step causes steam spalling — refractory can fracture violently when moisture flashes to steam on rapid heat-up.

Procedure

Phase 2 — Controlled derating

Type: Planned Shutdown Steps: 8

Notify the control room and confirm shutdown authority

Log the start time. Confirm the shutdown is authorised and all downstream units are aware. Process flow to the heater coil should be at or above minimum design flow before any firing rate reduction begins.

Begin reducing firing rate — one burner group at a time

Reduce firing by turning down fuel supply to the lowest-heat-release burners first. Do not extinguish individual burners at this stage — reduce all burners proportionally. Outlet temperature should begin declining at a rate ≤ 30°C/hr.

⚠ Critical — monitor tube metal temperatures continuously

During derating, TMTs can rise temporarily before outlet temperature falls, due to reduced flow velocity. If any TMT exceeds its high alarm, pause firing reduction until temperatures stabilise. Do not attempt to cool the tube faster by reducing flow — this worsens the situation.

Reduce process flow in coordination with firing rate

Once outlet temperature is declining steadily, flow can be reduced incrementally. Maintain the ratio between heat input and flow. Never allow outlet temperature to rise while reducing flow — this indicates insufficient derating of the burners.

Shut off pilot burners last — maintain draft throughout

Pilots provide a visual indication of firebox atmosphere and support stable combustion at low firing rates. Keep them lit until main burners are confirmed extinguished. Do not close stack damper or dampen draft during this phase.

Confirm minimum flow is maintained when last burners are extinguished

Process flow through the coil should remain at or above minimum design flow until all burners are out. Coil temperature will continue to drop passively. Confirm last flame is out visually and via burner header pressure gauge.

⚠ Critical — isolate all fuel at header and at manual valves

Close all automated SDVs first. Then physically close all manual fuel isolation valves — both on the fuel gas header and on any fuel oil lines. Verify zero pressure on the burner header using a local gauge. Do not rely on automated valve position indication alone.

Log outlet temperature, firebox temperature and fuel isolation status

Record time, temperatures at all coil outlets, bridgewall temperature, and confirm fuel isolation in the unit logbook. This is the completion record for Phase 2 and 3. Notify control room that burners are extinguished and fuel isolated.

Phase 4 & 5 — Firebox purge, cool-down & isolation

Type: Planned Shutdown Steps: 7

Allow natural draft purge — minimum 15 minutes post-extinguishment

With all burners out and fuel isolated, keep all air registers open and the stack damper fully open. Natural convection draws fresh air through the firebox, purging any residual combustibles. Minimum 15 minutes is a common baseline — your site procedure may specify a full air-change calculation. Do not close the damper during this period.

Steam-purge the process coil if deinventory is required

If maintenance requires the coil to be open, admit steam at the inlet and allow it to flow through to the outlet to the flare. Continue until condensate sample runs clear and no hydrocarbon is detected. Monitor coil pressure during this operation — do not exceed design pressure.

⚠ Critical — verify gas-free atmosphere before any firebox entry

LEL readings must be 0% at all sampling points (bottom, mid-height, top of firebox) using a calibrated gas detector. O₂ must be ≥ 19.5%. Readings taken only from the peephole or top opening are not sufficient — sample the full volume. A confined space entry permit is required for personnel entry.

Allow firebox to cool to ≤ 40°C before personnel entry

Measure internal temperature at the entry point directly, not from skin thermocouples. Refractory retains heat for many hours. In hot climates, natural cooling to ambient may take 24–48 hours for a large heater. Forced ventilation can accelerate this if the atmosphere is confirmed clear.

Install spectacle blinds at all process connections

Blinds should be installed at all feed inlet and product outlet flanges, all utility connections (steam, blowdown), and at any interconnecting piping that could re-introduce hydrocarbons. Record each blind in the blind register — this document must be reconciled at startup.

Lock out all energy sources — LOTO

Lock out fuel gas supply valves, fuel oil supply valves, all electrical supplies to the BMS, FD/ID fans, and fuel control valves. Apply tags per site LOTO procedure. The permit holder signs each lockout before maintenance entry is authorised.

Complete handover to maintenance — issue work permit

Issue a confined space entry permit and a hot work permit (if applicable). Confirm gas tests are current (test validity is typically 30 minutes before work and repeated hourly during work). Handover documentation should include: blind register, last process readings, abnormalities noted during shutdown, and outstanding inspection items.

Isolation verification — minimum requirements

The table below summarises the isolation actions required before the heater is handed to maintenance. Site-specific isolation philosophy may require double-block-and-bleed valving in addition to spectacle blinds.

Isolation Checklist — Planned Shutdown Handover

System	Isolation Required	Verification Method	Permit Required
Fuel gas supply	SDV closed + manual valve closed + blinded if entry to fuel header	Zero pressure on local gauge; LOTO applied	LOTO certificate
Fuel oil supply	SDV closed + manual valve closed + drain cleared	Zero pressure; drain confirmed clear	LOTO certificate
Process coil inlet	Spectacle blind inserted at flanged connection	Blind register signed; tag in place	Blind register entry
Process coil outlet	Spectacle blind inserted at flanged connection	Blind register signed; tag in place	Blind register entry
Steam / purge connections	Closed and blinded or capped	Physical check	Blind register entry
BMS / control power	Electrical isolation at MCC	Voltage test at terminal; LOTO lock applied	LOTO certificate + electrical permit
FD / ID fans	Electrical isolation + mechanical lock on damper	LOTO lock applied; damper tagged	LOTO certificate
Firebox atmosphere	Gas-free confirmed (LEL = 0%, O₂ ≥ 19.5%)	Calibrated gas detector — multiple sample points	Confined space entry permit

Common shutdown errors

Reducing flow before firing rate

The single most common cause of tube overheating during shutdown. Always reduce firing first, then flow. If in doubt, hold flow constant and reduce firing only until temperatures stabilise, then step down together.

Relying on SDV position indication for fuel isolation

Automated shut-down valves can fail to seat fully. The manual isolation valve must be physically closed and confirmed with a local pressure gauge. Zero gauge pressure — not a closed valve light — is the confirmation standard.

Skipping the post-extinguishment purge

Residual fuel gas in the firebox after extinguishment can accumulate to explosive concentrations within minutes, particularly in low-draft conditions. The natural draft purge is not optional and the 15-minute minimum must be observed even if entry feels urgent.

Cooling too quickly after steam purge

Steam introduces moisture into the refractory. If the firebox is then cooled rapidly by forced ventilation while the refractory is still hot, differential contraction stress is severe. Let temperature drop naturally before applying forced ventilation.

Incomplete blind register

Every blind must be recorded. Blinds left in place during startup cause loss of flow and immediate overheating — this has been the initiating event in multiple fired heater incidents. The register must be closed out before startup authority is given.

Entering firebox before temperature confirmed

Refractory surfaces above eye level retain heat long after floor-level areas have cooled. Take temperature readings at high points — not just at the entry hatch — before authorising entry. Heat stress is a real risk in large refinery heaters.

← Normal Operations Online / Offline Decoking →