AI Quick Summary

A utility interruption can affect several process safeguards at once. Map dependencies, define safe states and test backup response before the plant needs it.

Loss of power, cooling water, steam, instrument air, nitrogen or firewater can change several process conditions at once. A useful review identifies what each utility supports, what happens when it fails, and how the unit reaches or maintains a safe state. The right response depends on the process and the failure scenario; there is no universal “utility failure” shutdown sequence.

Start with the dependencies

Build a plant-specific map from current drawings, equipment lists, operating procedures and field verification. For each utility, identify the units and safety functions that rely on it. Include partial loss, low pressure or flow, contamination, delayed restoration and common-cause failures. Electrical supply can also support pumps, compressors, cooling, control systems and communications, so a single initiating event may affect more than one barrier.
For each credible loss, ask what continues to flow, heat, react, pressurise or drain. Check whether control valves fail to the intended position, whether rotating equipment stops safely, whether relief systems remain available and where material could discharge. Include off-site effects and escalation between connected units where the site assessment requires them. The UK Health and Safety Executive’s utility-reliability guidance calls for assessment of different scales of utility failure and the hazards that follow. It is technical guidance, not a South African legal rule.

Define the safe response

Document the expected process state and the operator actions for each failure mode. State the trigger, who declares the abnormal condition, which unit or equipment is affected, what must be isolated or kept running, and when the incident commander or emergency team takes control. A response should not depend on an operator guessing which backup has started or which alarms matter.
Where continued operation is unsafe, define the shutdown sequence and required backup supplies. Where a controlled hold is possible, set operating limits, monitoring, staffing and escalation points. Emergency power, UPS, redundant pumps or local inert-gas supplies only reduce risk when their capacity, independence and changeover arrangements match the hazards identified.
The site’s process hazard analysis should capture credible utility-failure scenarios and safeguards. Link actions to the safety-critical equipment register so each credited backup has an owner, inspection regime and performance evidence.

Prove the complete backup path

Testing a generator alone does not show that critical equipment receives power. Test the sequence end to end: failure detection, automatic start, switchgear, distribution, load acceptance, control indications and the supported safety function. Include manual changeover and recovery where the design relies on them. HSE explicitly says a generator test should also prove the automatic-start facility and distribution switchgear in its utility-reliability guidance.
Record the test conditions, defects, temporary restrictions, restoration and approving person. Exercises should also confirm that operators understand the consequences of utility loss and can carry out the response under realistic conditions. Update the analysis after plant changes, utility-network modifications, repeated failures or test findings.

Prepare before supply returns

Restoring a utility can create a second abnormal transition. Confirm pressure, quality, flow direction and equipment readiness before reconnecting loads. Make sure protective systems, alarms, interlocks and temporary isolations have been restored and verified. Use the site’s approved operating procedure, and apply a restart readiness review if the trip or work has affected plant integrity or safeguards.
MMRisk supports process hazard analysis, emergency planning and process-safety reviews for high-hazard facilities. Talk to our process safety team about a utility-failure review for your site.

FAQ

Does every utility failure require an emergency shutdown?
No single response fits every plant. The site risk assessment and approved procedures should define whether to maintain a safe hold, shut down a unit or initiate the emergency plan for each credible condition.
Is a generator test enough to prove backup power works?
No. The test should cover the designed chain from detection and start through switchgear and distribution to the critical load and its required function.

Sources and jurisdiction