WorkflowShutdown, Turnaround & Outage

Blind List Verification

Blind list verification for isolation coordinators: each boundary flooded on the current drawing, so a clean-looking blind list is tested before an operator walks it.

See the demo Book a demo

Follow one exchanger’s blind list, 46 days before oil out ↓

The problem

A list carried forward from the last turnaround, and a plant that moved since

About a year before oil out, operations and the turnaround team start from the last event’s blind list. Planners add blinds by job pack and coordinators mark up drawings with a highlighter. Someone reads the plant changes since the last event, if there is time. A row can stay true while the plant moves around it.

Plant changes close on their own forms. A change can update the drawing and train the operators and still raise nothing on the next turnaround’s list. A bypass held shut on a locked valve for one job is not written back. Two flanges a few feet apart read the same on a drawing, and a wrong rating or a flat blind for a ring joint is found on the day, by the crew on the flange.

Built forIsolation coordinatorsOperations shift leadsBlinding foremenProcess engineersInternal auditors

The Problem Today

Blind lists get carried forward from the last event, so a plant change can leave a live line behind a clean list.

342–570: hours to check 3,418 points by hand, at 6 to 10 minutes each our estimate
Each: opening of process piping needs a safe work practice published

Checked by hand today

Drawings
Changes
Job packs
Permits

Carried-forward listsA held-on-a-valve fix never reaches the next list
Flanges that look the sameTwo lines side by side read the same on a drawing

The Solution

Read today's drawingEach sheet and plant change since the list was rebuilt, open ones too
Flood the boundaryAgents pour out from the job; only a blind holds, never a closed valve
Flag look-alike flangesSame size and rating nearby: a foreman tags it, an operator confirms it
Count each blind outRestart holds until a foreman and an operator close each blind

Built-in controls

Two people on each decision, by role
Agents never edit the list or issue a permit
A drawing check is not a field check

What You Get

Coordinators fix paper gaps before a crew reaches a flange, then an operator walks every line.

Plant changes tied to blindsClosed changes that touch a boundary, found and shown
Size and rating checkedSize, rating, facing and gasket against the line class
A restart you can countEach blind in, matched to a blind out

One boundary, one stale list

Blind list verification on one exchanger, 46 days before oil out

The isolation coordinator owns 3,418 blind points for the coming turnaround. One reactor effluent exchanger is due a bundle pull, and its six-blind list was carried forward from the last job.

demoThe refinery, units, drawings, people and figures are sample data. The plant is a sample plant, and the flood runs on its drawing.

01Morning
47 of 640 boundaries do not hold on today’s drawing
Isolation coordinator
Each boundary is a dot by unit, coloured by what the flood found. 561 are sealed on paper, 40 escape, 7 rest only on a closed valve, 18 could not be tested and 14 could change because a plant change is still open. The page says it plainly: sealed means sealed on the drawing, and an operator still walks each line before it is opened.
02Morning
31 escapes came through plant changes closed on their own forms
Isolation coordinator
Of 604 plant changes since each list was rebuilt, 581 are closed and 23 open. Fifty-eight of the closed ones touch a boundary: 31 caused an escape and 27 moved a blind point. Each row names the boundary and what changed: a warm-up bypass, a new tie-in, a rerouted vent. Fourteen open changes sit near a boundary, so those cannot read as sealed.
03Morning
Last time it held on six blinds and one locked valve
Isolation coordinator
The flood pours outward from the exchanger on the sheet as it stood for the last job. It stops at every blind, and at one globe valve on a warm-up bypass that was locked closed under that job’s own permit. The lock was on the permit and not on the list. The list carried forward with six blinds and nothing on the bypass.
04Morning
Planned for Day 12, the flood runs into the live 150 psig steam header
Isolation coordinator
On the current drawing, as planned for Day 12, that valve is car-sealed open again. The flood runs out along the warm-up bypass added by a plant change before the last job and into the steam header, live all event at about 366 °F. Neither of the two steam-side blinds on the list closes it. The flood tester counts a closed valve as open; only a blind holds.
05Late morning
A seventh blind holds on paper; its twin, five feet away, carries sour gas
Isolation coordinator
He adds a 2-in. blind on the exchanger side of the valve, so nothing stands between the crew and the header but a blind. The chip reads held at 7 blinds if the proposed blind is accepted; nobody has checked it yet. The look-alike spotter stops him there: a flange five feet away on the same rack has the same size, rating and eight bolts, on sour off-gas live until Day 16.
06Late morning
The flange number shows only after the foreman enters the line he read
Blinding foreman
The tag request shows both flanges and says to follow the line by hand from the last valve he is sure of, not from a drawing or the agent. He types the line he read off the pipe. Only then does the screen say the read matches and which flange to tag. Next, the area operator traces it himself before anyone signs.
0715 days to the freeze
Cannot freeze yet, and not one blind point located by an operator
Operations shift lead
The sign-off page lists what stands before the freeze and who owns it: failing boundaries, sheets the agent could not read, open plant changes, moved blind points, specification errors, stale tags, permits, look-alike tags. The freeze stays shut until all of it is clear, and nobody can override it. Even then, a signature covers the drawing; an operator walks each line before it is opened.

Six blinds held last time on a locked valve, and an escape on Day 12

The same exchanger in three states. Only the last is what the crew will face on Day 12.

State	Warm-up bypass valve	What the flood does
After the plant change	Car-sealed open	No blind on the list closes it
Held for the last job	Locked closed under that job’s own permit	Contained at six blinds and one locked valve
As planned for Day 12	Car-sealed open again	Escapes into the live steam header
With the proposed seventh blind	Car-sealed open	Held on paper, if the blind is accepted

demoSample data, from the working solution.

Around the list

Blind list management beyond the flood: twins, line classes, permits, restart

The rest of the isolation team’s screens on the same list.

Look-alike flange pairs within ten feet: the one on the blind list beside its twin, size, rating, facing, bolts, line and service compared — **Flanges a crew could mistake**212 pairs inside ten feet with the same size, rating and bolts. A drawing cannot tell a crew which is which, so a person tags and photographs each pair.

Blind list lines checked against their line class: rating, size, facing and gasket mismatches and stale tags, each with a due date — **List lines against their line class**160 lines to look at: wrong size, rating, facing or gasket, or a line or tag gone from the current drawing. The list changes only when two people sign.

Turnaround isolation list permits: boundaries with no permit tied and broad permits without a hold point, each with a due date — **A permit for each boundary**Boundaries with no permit tied, and broad permits that cover many jobs with no hold point. Operations issues permits; agents do not.

Startup check for an early outage: blinds in, blinds out and two still in, with restart held until each is recorded out — **Blinds in against blinds out**One train’s early outage: 47 in, 45 out, 2 still in, one missing from the list. Restart is held, and whoever confirms a blind out cannot sign it.

demoSample data, from the working solution.

The coordinator proposes, the shift lead signs, the field proves

Two people on each decision, by role, and a person at the flange.

Isolation coordinator

Sees: The flood, plant changes and findings
Signs: Proposes blinds and fixes; sends boundaries for signature

Operations shift lead

Sees: The flood, the plant change and the field proof, opened before signing
Signs: Signs each boundary for operations; can return it with a reason

Blinding foreman

Sees: Tag requests with both flanges
Signs: Traces by hand, hangs the tag and records removals

Area operator

Sees: The same request, without the foreman’s word
Signs: Traces it himself, confirms at the flange and walks the locations

Process engineer

Sees: Sheets the agents could not read
Signs: Traces them by hand and settles disagreements

The agents

Eight agents flood, compare and count, and none signs a boundary safe

They read the drawing and the records. People prove the flange.

List reader

Reads the draft list and the job packs.

Never edits the list

Drawing reader

Reads current drawings into connected lines.

Never guesses a connection; an unreadable sheet goes to the process engineer

Plant change checker

Reads plant changes, open and closed.

An open change near a boundary blocks sealed

Flood tester

Floods each boundary from the work point.

A closed valve never counts as sealed
Never calls a boundary safe

Look-alike spotter

Finds same size and rating within the set distance.

Never clears a pair

Line spec checker

Checks size, rating, facing, gasket and stale tags against your line classes.

Never changes a row

Permit linker

Ties permits to boundaries and flags broad ones.

Never issues a permit

Close-out counter

Matches blinds in and out.

Never clears a blind on paper alone

What stays with people at the flange

The product checks the drawing. The plant is checked by people.

A drawing check is not a field checkSealed means sealed on the drawing. An operator walks every line before it is opened.

Look-alike flanges are proved by handThe foreman traces and tags, the operator traces again, and neither takes the other’s word.

A sheet nobody can read is not a passIt reads could not test, and a process engineer traces it by hand.

The freeze cannot be overriddenIt stays shut until every line before it is clear.

Restart waits for every blind outWhoever confirms a blind out cannot sign it.

What isolation coordinators ask about blind list verification

What is blind list verification?

Blind list verification tests a turnaround’s blind list against the current drawing and the plant changes since the list was built. This solution floods each isolation boundary from the work point, shows where it escapes or rests only on a valve, and sends look-alike flanges to the field for a foreman and an operator to prove.

How is positive isolation checked here?

The flood tester counts only blinds. A closed valve, locked or car-sealed, still leaks in the flood. A boundary reads sealed on paper only when each path from the work point ends at a blind.

Does it replace the field walk?

No. A signature covers the drawing. The area operator traces each look-alike line himself and walks the locations, and blinds in place are counted only when someone sees them.

How does blind list management handle plant changes?

The plant change checker reads changes since the list was rebuilt. A closed change that touches a boundary is flooded again on the current drawing, and an open change near a boundary keeps it from reading sealed.

Can it build the turnaround isolation list from scratch?

It reads the list you have and the job packs behind it, and proposes fixes for the coordinator to accept. The list itself is only changed by people, and each change needs a second person.

What about blinds left in after isolation planning for the turnaround?

The close-out counter matches each blind in to a blind out. Restart is held while any is still in or missing from the list, and the person confirming a blind out cannot sign it.

Shutdown, Turnaround & Outage