A Safe Shutdown Must Survive the Utility Failure That Demands It

Why the hazard can remain hidden

Utilities connect many items that appear independent on a process diagram. A site power failure can stop pumps, ventilation and cooling while also affecting instrument power, communications and emergency systems. Loss of instrument air may move some valves to their designed failure positions, but it can also leave other valves in place, reduce actuator force or disable the ability to make a second move. Loss of cooling can allow temperature and pressure to keep rising after feed has stopped.

The first question is therefore not simply whether an individual valve is fail-open or fail-closed. The team must understand the overall process state created by the failure: which flows continue, what inventory remains connected, which heat sources persist, where relief discharges go, and which measurements and communications remain available. A safe state must be both reached and maintained for the credible duration of the event.

A practical operating scenario

Hypothetical example: An offshore compression train loses main electrical power. The driver stops and the inlet shutdown valve begins closing, but lube-oil support, ventilation and several transmitters are also affected. Upstream pressure continues to act on the system while the operator has fewer indications than normal. Treating “compressor stopped” as “system safe” would overlook the continuing inventory and the dependencies needed to isolate, depressurise and monitor it.

Critical controls

Understand the dependency. Map every dependency. For each major-accident scenario, identify the electrical, pneumatic, hydraulic, cooling, communications and fire-protection utilities needed to detect the event, trip the process, isolate inventory, depressurise safely and monitor the final condition.

Verify the barrier. Verify the failure response. Confirm valve failure positions, stored-energy capacity, UPS and emergency-power endurance, backup supply changeover, alarm availability and the effect of a common utility header. Testing should demonstrate the complete function rather than only individual components.

Control the operation. Define the operating response. Procedures should state the safe state, decision points, local actions, communication method and restart restrictions for total and partial utility loss. Personnel should practise the response with realistic information loss and competing demands.

What strong leadership looks like

Leaders should treat overdue UPS maintenance, unreliable emergency generators, weak batteries and recurring instrument-air problems as barrier impairments. The appropriate question is not whether production can continue, but whether the documented risk assessment still demonstrates a safe shutdown and a stable condition.

Supervisors should make the current barrier status visible at handover, connect related defects and deviations, and ensure that temporary operating arrangements have clear limits and escalation triggers. Where required evidence is missing, the conservative response is to stabilise the process and seek competent support rather than allow schedule pressure to decide.

Actions for today

• Choose one relevant safety-critical function and trace it from process hazard to final protective action.
• Check the latest inspection, test or operating evidence—not only the design intention or status label.
• Resolve any discrepancy through the approved defect, risk-assessment and escalation process.

Team discussion question

Which utility loss could disable the greatest number of safeguards on our installation, and what recent evidence proves that the complete shutdown path will still work?