Getting a food plant to the outage with the scope already closed

The window is set by the crop, the season or the customer, not by maintenance

Ask a plant manager in a beet sugar factory when the outage is and the answer is fixed by agronomy: the campaign runs from harvest until the beet is processed, and everything mechanical happens in the intercampaign period. A vegetable cannery might run eight to fourteen weeks at full rate and be effectively idle the rest of the year. A dairy or a brewery has no seasonal idle period at all and must find its window inside demand troughs and contractual supply commitments. In none of these cases does a maintenance planner get to pick a convenient date.

That single fact reorganises the entire scheduling problem. In a plant where the window can move, planning optimises duration and cost. In a plant where the window cannot move, planning optimises readiness: the objective is that on the morning the line stops, every crew is badged, every scaffold is standing, every isolation is agreed and every consumable is approved. Work that is not ready on day one is not late, it is cancelled, because there is no mechanism to extend into a period when the plant must be running.

This is why the useful scheduling primitive in food and beverage is the fixed-end window with backward scheduling from a hard restart date, not a forward-planned task list with a target finish. The module has to express that restart is immovable, that every task carries prerequisites with their own lead times, and that float belongs to discovery work rather than to the base scope. A system that only supports forward planning will produce a plan that looks credible in week one and is untrue by week six.

Ammonia refrigeration is the integrity programme and it owns the critical path

In most refrigerated food plants the largest single body of mechanical integrity work sits in the closed-circuit ammonia refrigeration system. IIAR 6 sets out inspection, testing and maintenance tasks for vessels, piping, relief devices, controls and machinery with assigned intervals. Where the ammonia inventory exceeds the process safety threshold quantity, OSHA 29 CFR 1910.119 applies and the mechanical integrity element at 1910.119(j) requires that inspection and testing follow recognised and generally accepted good engineering practice, which for this equipment is IIAR 6 alongside ASME Section VIII Division 1 and B31.5 for the piping.

The scheduling implication is that the refrigeration system is a sequence, not a task. Any internal inspection of a vessel requires pump-down and ammonia recovery, isolation with a defined blind list, purging to a gas-free state, and confined space entry controls. Recovery of the charge from a large vessel is measured in hours to days depending on the plant's recovery capacity, and it cannot be compressed by adding people. Reversing the sequence at the end takes comparable time, and the system then has to be recharged and stabilised before it can pull load.

Planning teams that model this correctly build the outage around the refrigeration sequence and slot everything else into the space it leaves. Planning teams that do not, discover on day two that the inspection crew booked for Monday morning could not enter until Wednesday afternoon, that the crew was on standby rates throughout, and that the vessel work now overruns the restart. The scheduling module's contribution is making the dependency chain explicit at plan time — pump-down, recovery, isolation, purge, entry, inspect, reinstate, evacuate, charge — so the impossible sequence is visible in week one rather than discovered in the window.

The mechanical window and the production window are not the same number

Take a plausible four-day cold-store outage. Pump-down and ammonia recovery from the affected circuit takes most of the first day. Insulation removal at the marked corrosion-under-insulation points and scaffold erection runs into day two. Inspection — thickness surveys, weld examination, relief device work — occupies day two and part of day three. Reinstatement of insulation with a sound vapour barrier, leak checking and recharge fills the rest of day three and day four. Mechanical completion is declared, on schedule, in ninety-six hours.

Then the real cost appears. Any work performed near or above product zones triggers clean-down and sanitation verification before production may resume. The cold store, having sat above its holding temperature for four days, must be pulled back down, and pull-down of a large freezer to holding temperature is measured in days, not hours, because the thermal mass of the structure and racking has to be removed as well as the air. In practice the four-day mechanical window has consumed roughly seven days of production availability.

That gap has a governance consequence as much as a planning one. Maintenance reports on schedule; operations reports a three-day shortfall; both are telling the truth about different measurements. The fix is not better arguments, it is a schedule that carries two distinct completion states — mechanical complete and production available — with the sanitation and pull-down tail modelled as scheduled work with owners and durations. Once that tail is visible during planning, the argument about whether to combine two shorter outages into one longer one becomes a calculation rather than a dispute.

Inspection is a contamination event before it is an inspection

This is the constraint that most genuinely separates food and beverage from every other process industry. A couplant film on an ultrasonic scan, a penetrant and developer residue on a weld examination, magnetic particle suspension overspray, grinding dust from surface preparation, scaffold boot traffic across a production floor — every one of those is a foreign material or microbiological risk in a zone governed by the plant's food safety plan under 21 CFR Part 117 and by sanitary design conventions reflected in 3-A Sanitary Standards. The inspection creates the hazard it is not there to find.

The practical answer is that NDT consumables must be treated as controlled chemicals and approved before the outage, not carried in on the day. The plant's chemical control list, allergen assessment and, where applicable, kosher or halal constraints all apply. In a dry-regime plant handling powders, chocolate or bakery product, introducing water or an aqueous couplant to the floor is a recognised microbiological risk event and may be prohibited outright, which forces a different method selection — a decision that has to be made at scope definition because it changes the crew, the equipment and the duration.

The tail matters just as much as the approval. After work in a production zone, the area is cleaned, sanitised and verified — visual inspection, surface residue checks, and the environmental monitoring the plant's programme requires — before product runs. Those steps take time, sit on the critical path to restart, and are almost never on the maintenance schedule because they are performed by sanitation and quality rather than by maintenance. Putting them on the same schedule, owned by the departments that do them, is one of the cheapest improvements a food plant can make to outage predictability.

Dates you do not control, and dates you cannot fail

A food plant's inspection calendar contains several dates set by someone outside the company. High-pressure boilers and many pressure vessels are subject to jurisdictional inspection, with in-service intervals and requirements framed by the National Board Inspection Code NB-23 and enforced by a state or provincial inspector or an authorised insurance inspector whose availability is not yours to schedule. Relief device testing intervals are similarly fixed. Where the plant is above the process safety threshold, the mechanical integrity programme has to demonstrate that inspections were performed at their assigned intervals, and an overdue item is a compliance finding rather than a backlog entry.

The scheduling module should distinguish these hard-anchored dates from condition-based ones and plan the rest of the outage around them. If the jurisdictional inspector can attend during a specific week, that week defines the internal access work, the vessel preparation and the crew booking. Treating it as one due date among many is how a plant ends up preparing a vessel twice — once for its own inspection and again a month later for the jurisdictional visit, at the cost of a second pump-down and a second entry.

The same logic applies to the plant's own audit calendar. Customer audits, third-party certification audits and regulatory inspections all ask, in various forms, to see that mechanical integrity and food safety programmes ran on schedule with records to support them. Producing that evidence is trivial when inspection records, technician qualifications, calibration records and completion dates live against the asset. It is a two-week scramble when they live in email attachments and a shared drive organised by contractor name.

Scope freeze is the only gate that reliably protects a fixed window

Every experienced turnaround planner knows the failure mode: the scope keeps growing until the day work starts. In an industry where the window can extend, that failure costs money. In a seasonal food plant it costs the work itself, because the added scope displaces planned scope and the displaced scope waits a full year. Scope freeze is therefore not an administrative preference; it is the mechanism that makes crew sizing, scaffold quantities, insulation materials and isolation planning possible at all.

A workable freeze has a definition, not just a date. At freeze, every item must have an identified asset, a method, an access requirement, an estimated duration and an owner. Items that fail that test go to a discovery allowance rather than into the base plan. A sensible allowance is in the region of ten to fifteen per cent of window hours held explicitly as float, funded and crewed, so that the inevitable findings during entry have somewhere to go. Without a named allowance, discovery work is absorbed by deleting scheduled inspection, which is precisely the work that would have prevented next year's discovery.

The module supports this by making the freeze enforceable rather than aspirational. After the freeze date, additions require an approval that shows what they displace and how much of the discovery allowance remains. That single behaviour changes the conversation from whether an item is important — everything proposed is important — to what it costs in the only currency the window has. Plants that adopt it typically find that half the post-freeze additions withdraw themselves once the displacement is stated in writing.

How to evaluate a scheduling module for a fixed-end outage

Start by asking the vendor to model a window that cannot move. Can the schedule be anchored to a hard restart date and planned backwards, with lateness surfacing as scope at risk rather than as a later finish? If the tool only pushes the end date out when work is added, it is modelling a different industry. Then ask whether prerequisites are first-class objects: scaffold erected, insulation removed, isolation complete, gas-free certificate issued, permit active. If those are checkboxes on a task rather than scheduled predecessors with their own durations and owners, the plan will look feasible and behave otherwise.

Next, test the two-completion-state question. Can the schedule distinguish mechanical completion from production availability and carry sanitation, verification and pull-down as scheduled work owned by quality and operations? Can it hold contractor qualification, technician certification level, medical and fit-test status and process safety contractor evaluation as gating conditions on assignment, so an unqualified crew cannot be scheduled into the engine room? Can consumables carry an approval status that blocks scheduling into a production zone?

Finally, ask what happens in the window. Real outages change hourly. The useful question is whether a supervisor can see, at seven in the morning, which crews are blocked, which prerequisites are outstanding, how much discovery allowance remains and which scope items are now at risk of deletion. A planning tool that is excellent at producing the pre-outage plan and useless during execution will be abandoned on day two, and the plant will be back on a whiteboard and a printed spreadsheet by day three.

What Atlantis configures for food and beverage plants

We configure the inspection management platform around the fixed-end window: a hard restart anchor, backward scheduling, readiness gates with defined criteria, and prerequisite chains for isolation, insulation removal, scaffolding and entry. The refrigeration sequence is modelled explicitly, so pump-down, recovery, purge, entry, reinstatement and recharge appear as durations rather than assumptions. Discovery allowance is held as a named pool, and post-freeze additions show what they displace.

On the compliance side, IIAR 6 task intervals, ASME Section VIII and B31.5 examination requirements, relief device testing, jurisdictional inspection dates and technician certification records to SNT-TC-1A all sit against the assets and crews they belong to. Inspection results, thickness histories, corrosion-under-insulation findings and repair records build a continuous record that answers a mechanical integrity audit from the system rather than from a document search.

Because the platform is built on Odoo, the outage plan sits next to purchasing for long-lead insulation and scaffold materials, contractor qualification records, and the maintenance history for the same assets. It is affordable, accessible and fully customisable to how a specific plant runs its season. If you would like to see a fixed-window plan built against your own outage and asset list, request a demonstration or a scoped consultation at info@atlantisndt.com.

Request a consultation