Interactions between process and utility systems

Interactions Between Processand Utility SystemsKatherine Pearson1

Rohm and Haas Texas, Inc., 6519 State Hwy 225, Deer Park, TX 77536; [email protected](for correspondence)

Published online 27 February 2007 in Wiley InterScience (www.interscience.wiley.com). DOI 10.1002/prs.10192

Utility systems have many connections to processes,both physical and electrical. This interconnectivityintroduces common mode failures and the potentialfor crosscontamination. This article uses ‘‘real-plant’’incidents to illustrate what can happen when thehazards of interactions between process and utilitysystems are not identified or understood. Some toolsto evaluate interactions between process and utilitysystems are discussed. The reactivity matrix tool,which can help evaluate crosscontamination issues, isintroduced. Individual types of utility systems andissues specific to them are discussed. � 2007 Ameri-can Institute of Chemical Engineers Process Saf Prog26: 101–107, 2007

Keywords: utility, failure, reactive, chemical, pro-cess safety, incident, prevention

INTRODUCTIONUtility systems are not very glamorous and are of-

ten overlooked in process hazard analyses (PHAs),operations, and maintenance; however, many inci-dents have been triggered by unanticipated interac-tions between processes and utility systems. Utilitysystems have many connections to processes, bothphysical and electrical. This interconnectivity resultsin the potential for crosscontamination as well ascommon mode failures.

Project design reviews, PHAs, and management ofchange (MOC) reviews give us an opportunity toanticipate and plan for these interactions. The intentof this article is to stimulate your thinking about util-ity systems in a different way, so you will ask theright questions in these reviews.

My first experience with a contaminated utility sys-tem came as a young engineer working in a unit withpneumatic instruments. One day, the instrument airsystem became contaminated with a very stinky andflammable material. The material made it back to thecontrol room. The material was difficult to clear from

all the instrument piping, and the control roomsmelled for weeks!

Thankfully, most of us do not have a lot of pneu-matic instruments these days. But we still have manyconnections between utility systems and processes.Common mode utility failures such as sudden poweroutages, loss of instrument air, or loss of refrigerationcan also result in incidents and near-misses.

Three incidents of increasing complexity will bereviewed in detail. The first incident involves unex-pected materials in a sewer. The second incident in-volves contamination of a cooling tower water systemwith an unexpected result. The third incident is acomplex incident, which resulted in damage to ascrubber during a power outage. Reactive chemistryplayed a part in each incident.

Evaluating utility system failures is covered in the lastpart of the article. The reactivity matrix tool and issuesto look for in individual utility systems are discussed.

INCIDENT NO. 1 - FLASHBACK TO ‘‘WASTE WATER’’ TANKThis first incident is a simple example of unexpected

contamination in a waste water tank and a chemicalsewer. Steam jet condensate from a barometric con-denser was collected in a waste water tank. The waterwas analyzed for several contaminants. If the wastewater did not contain the specified contaminants, it wasdrained to a chemical sewer trench.

One day, hot work was underway in the unit toinstall new safety equipment. The job had started af-ter the usual checks for flammability around the workpiece. At some point, the waste water tank wasdrained to the chemical sewer. Nothing happeneduntil the tank was almost empty. The investigationdetermined that an organic layer had built up on thesurface of the waste water in the tank. When the or-ganic layer flowed through the chemical sewer,vapors found the ignition source at the hot work andflashed back to the waste water tank.

The ignition lifted the tank off of its foundation,propelling it to an elevation above the control room� 2007 American Institute of Chemical Engineers

Process Safety Progress (Vol.26, No.2) June 2007 101

roof. The coils landed on the control room roof. InFigure 1, part of the coils can be seen on the roof(just to the left of the tank). The tank inverted andlanded back on its foundation.

Before the incident, the National Fire ProtectionAssociation (NFPA) diamond for the tank originallyshowed ‘‘0’’ in the flammability category. After theincident, the NFPA diamond for the sister tank wascorrected to show ‘‘4’’ in the flammability category,based on the potential presence of the organic layer.

This example highlights that barometric condens-ers form a direct connection between the processand the sewer system. Steam jet condensate usuallycontains some concentration of process material. Ifthe process system experiences an upset, the concen-tration of process material in the jet condensate canincrease dramatically.

There are several key learnings from this incident:

• Condensate from barometric condensers can con-tain process chemicals.

• Sewer systems should always be treated as if theycontain hazardous chemicals.

• Conditions can change during the job.

For hot work to be performed safely near a sewer,sewer openings have to be covered and conditionsmonitored during the job.

INCIDENT NO. 2 - FLASHBACK TO COOLERA catastrophic leak in an acid heat exchanger

resulted in acid contamination of the cooling towerwater system (Figure 2). On-line pH analyzer alarmsin the cooling tower went off-scale. Operators didnot realize the severity of the leak at first. The part ofthe system containing the leaking exchanger wasidentified and blocked off. The rest of the system wasneutralized.

The part of the system containing the leakyexchanger stayed contaminated with the acid-contain-ing material and sat stagnant. Several exchangers were

individually isolated, drained, and flushed; then theywere opened for inspection and repair. Five days afterbeing opened, a flashback occurred on one exchangerwhen a welder’s torch was placed near the tube sheet.Luckily, the welder was not severely injured.

The investigation team concluded that the mostlikely cause of the incident was hydrogen gas gener-ated by corrosion in the carbon steel cooling towerwater supply piping. There was liquid above theblocked valve used to isolate the cooler; the pipingwent up and over into the cooler, so there was about8 ft of piping holding liquid. The liquid containedacid, and the pH was 1.25. Calculations showed thatup to 10 m3 of hydrogen could have been generatedfrom corrosion of the pipe in contact with the liquidduring the 5-day period.

In addition, corrosion of the underground coolingtower water piping could have also contributed somehydrogen gas. This piping was concrete-lined carbonsteel, encased in concrete. The acid probably wouldhave eaten though the internal concrete lining in atleast some locations. Once the carbon steel wasexposed, corrosion would result in hydrogen gas.The cooling tower water supply piping was isolatedfrom the exchanger using two block valves, but thevent between the valves was not open. The valveswere not designed to be vapor tight. Gas pressurehad built up between the two valves; when the ventvalve was opened, witnesses heard the pipe de-pressurize. The upstream block valve was also notliquid tight; liquid followed the depressurization.

This system had originally been locked out foropening and inspection, and the plant proceduresdid allow for a single block. However, for hot work,the procedures specified blinding for process andcooling tower water connections. The process con-nections had been blinded, but the cooling towerwater connections were not blinded. In this case, theoperating personnel did not recognize that the newscope of work required a different lockout. They alsoknew that the cooling water system was contami-nated, but still treated it as ‘‘water.’’

This incident highlights several issues:

• Heat exchangers leak, and the leaks can result incrosscontamination.

• Utility systems should be treated as if they containthe materials in adjacent processing equipment.

• Hydrogen gas generation is a concern any timecorrosion is an issue.

• Appropriate permitting procedures are critical tosafe maintenance.

INCIDENT NO. 3 - PACKING DAMAGE IN OFF-GAS SCRUBBERIn an acid plant, an absorbing tower was used to

absorb SO3 gas and the off-gas was sent to an off-gasscrubber (Figure 3).

After a sudden power outage, the polyethylenepacking in an SO3 off-gas scrubber was damagedwhen gas containing a high concentration of SO3

went through the dry scrubber. The main unit blowerwas a steam turbine and remained running after thepower outage, because steam was not affected. Unit

Figure 1. Tank damage from flashback. [Color figurecan be viewed in the online issue, which is availableat www.interscience.wiley.com.]

102 June 2007 Published on behalf of the AIChE DOI 10.1002/prs Process Safety Progress (Vol.26, No.2)

personnel were not prepared for the main unit tur-bine blower to stay running, because in previouspower failures, the blower had always tripped.

Investigation of this incident revealed an interest-ing scenario. All the instrumentation had been con-verted to a distributed control system with a UPS(uninterruptible power supply) backup about 10years earlier, so why had the blower always tripped?It turned out that the system had been running onthe ‘‘backup’’ electric lube oil pumps for years. Whenthe system lost power, the blower lost its oil flow anda low pressure interlock (safety instrumented func-tion) shut the blower down. When the turbine-drivenlube oil pumps were repaired, the blower maintainedits oil supply and kept running.

Repairing the turbine-driven lube oil pumps waspart of an effort to improve reliability of the mainunit blower. For most other unit shut downs, theplant wanted the blower to keep running. With theblower running, off-gas was scrubbed in the off-gasscrubber and pollution was minimized. If the blowertripped, vacuum would be lost in several loosely

sealed parts of the process such as the furnace andboiler and process gas could be released at grade.

In several scenarios, however, keeping the blowerrunning was not the appropriate action. If circulationwas lost in the acid absorber, the high SO3 concentra-tion would overwhelm the off-gas scrubber and resultin a large environmental release. If circulation waslost in the off-gas scrubber, the scrubber would nolonger be effective and could also result in an envi-ronmental release.

The unit blower HAZOP (hazard and operabil-ity analysis) identified that the blower could ei-ther shutdown or keep running during a poweroutage depending on which lube oil pumps wereused. Unfortunately, the off-gas scrubber HAZOPassumed that the blower would always shutdown.

This incident was very interesting because it alsohad reactive chemical elements. While the reactionbetween SO3 and polyethylene was well known inother parts of the company, it was not known in thisbusiness. While the unit had a reactivity matrix (seethe discussion in the following Reactivity Matrix sec-tion), materials of construction were not listed.

A longer account of this incident appeared in anarticle written by Ness [1]; the original version of Fig-ure 3 appeared in that article.

Key learnings from this incident:

• PHAs should consider utility failures across theunit as a whole as well as in individual sections.

• If systems have both turbine and electric pumps,there should be a clear understanding of why twopower supplies are used, which is the ‘‘primary,’’and under what conditions and how long is it ac-ceptable to run on the ‘‘secondary.’’

• If a system has been broken for years, fixing itshould be considered a change and require anMOC review.

• Reactivity matrixes should include materials ofconstruction.

Figure 3. Schematic of acid tower and off-gas scrubber.

Figure 2. Schematic of cooler system.

Process Safety Progress (Vol.26, No.2) Published on behalf of the AIChE DOI 10.1002/prs June 2007 103

EVALUATING UTILITY FAILURESThe incidents described illustrate the result of

unanticipated interactions between process and utilitysystems. In the incidents described, there are severalcommon themes:

• Interactions between the process and utility sys-tems were overlooked.

• Change was not identified.• Reactive chemistry was not anticipated.

In this section, some tools to evaluate interactionsbetween process and utility systems are discussed. Thereactivity matrix tool is introduced in the Reactivity Ma-trix section. Reactivity matrices, coupled with projectdesign reviews, PHAs, and MOC reviews give us an op-portunity to anticipate and plan for these interactions.In Reactivity Matrix section, individual types of utilitysystems and issues specific to them are discussed.

Reactivity MatrixOne of our most powerful hazard recognition tools

is the reactivity matrix. An example containing someof the chemicals discussed in the example incidentsis shown in Table1.

Most of the example matrix was created using theNOAA Chemical Reactivity Worksheet [2]. The work-sheet, however, does not list most materials of con-struction. The inclusion of chemists and corrosionspecialists is critical to developing a complete andaccurate matrix.

Good descriptions of constructing and using areactivity matrix can be found in Refs. 3 and 4.

All of the following should be included in a proc-ess area matrix:

• All the chemicals (or families of chemicals) in theprocess area,

• All the chemicals (or families of chemicals) innearby process areas,

• Other chemicals that could conceivably make theirway into the process area (similar raw materialsfrom a manufacturer, other material in drums usedin the plant, etc.),

• Common contaminants such as air, oil, water, rust,• Water treatment chemicals (note which water sys-tems used specific chemicals),

• Key temperatures in the process such as steamtemperatures and tracing temperatures, and

• People.

The reactivity matrix is an excellent tool for use inPHAs and MOCs to evaluate possible effects of devia-tions such as: reverse flow where piping joins, un-loading the wrong material to a tank, and potentialreactions in the sewer.

Once the matrix identifies adverse reactions, a use-ful exercise is having a PHA team brainstorm scenar-ios, which could result in the specific chemical com-ing into contact. The temperatures at which materialsdegrade should be compared with key temperaturesin the unit.

Utility Failures by SystemUtilities failures can be evaluated in PHAs, project

design reviews, and MOC reviews. Our company’sprimary PHA tool is HAZOP, so this section has manyreferences to the HAZOP technique. A PHA databaseprogram (our company uses HazardReview Leader�

software) allows all intentions for a process to residein the same file, which makes it easy to switchbetween intentions to look for interactions. We try tomake sure that the boundaries of each intentionmatch up, so that the entire process area is covered.

In evaluating utility failures, start with individualequipment failures such as loss of heating or coolingin individual exchangers, leaks, etc. Most HAZOPs doan excellent job with the individual failures.

Consider common mode utility failures at the endof each intention (for example, consider loss of util-ities for a specific distillation column). If you areusing PHA database software, consider recording util-ity failures in a separate HAZOP intention. Then, aftereach process intention, go back to the commonmode failure intention. Then add or review the con-sequences from the most recent intention and look

Table 1. Example reactivity matrix.

H2SO4 SO3 NaOH (aq.)

ChemicalsSulfuric acid (H2SO4) 104, 107Sulfur trioxide (SO3) No reaction 104, 107, 108Caustic solution (NaOH aq.) B1, C1 B1, C1 –

Materials of constructionCarbon steel Highly corrosive*, rate

depends on acidconcentration

May react withwater and corrode

Slightly corrosive*

Polypropylene B1, C1, D4 B1, C1, D4 No reaction

Key to hazard codes: B1, may cause fire; C1, heat generation by chemical reaction, may cause pressurization;D4, innocuous and nonflammable gas generation, causes pressurization; 104, strong oxidizing agent; 107,water-reactive; 108, air-reactive.*Corrosion may generate hydrogen gas.


for interactions between the process areas. In thisway, the common mode failures are reviewed morethan once and with a different perspective each time.

The following utility systems should be consideredfor common mode failures.

• Cooling tower water, refrigerated water, and anyother heating or cooling fluids,

• Process water, distilled water, other water supply,• Steam and condensate,• Sewer systems,• Nitrogen or other inerting gas,• Instrument gas, and• Power failures (total and partial power failureswhere a single substation or motor control centeris lost).

The following sections summarize some of thecommon issues for these utility systems. The Hazard-Review Leader� software includes a Utility Failurestemplate, which lists common causes, consequences,and safeguards for each system.

Remember that any failure that results in low pres-sure in a utility system can also result in the opportu-nity for reverse flow through direct process connec-tions or leaking indirect connections.

Water SystemsWater used for heating or cooling (cooling tower

water, refrigerated or chilled water, and temperedwater) is usually connected to the process indirectlythrough a heat exchanger or jacket. Identifyingexchangers which would normally leak from theprocess into the water system can help determinewhat kind of monitoring is needed in the water sys-tem for leak detection. If an exchanger leaks, will theoperators identify the location of leak fast enough toprevent severe corrosion in the water piping andwater side of other exchangers? Will a leak into thecooling tower water result in reportable or hazardousemissions from the cooling tower?

If water leaks into the process, how severe is theconsequence? How much water is bad? How will theleak source be identified? What effect will the watertreatment chemicals have on the process or product?If water reactive chemicals are used in the process,using water as the heating or cooling media can havedisastrous results. The Napp Technologies fire andexplosion was initiated by a water leak into the proc-ess [5].

The consequences of an exchanger leaking in theabnormal direction (i.e., from the normally low-pres-sure side to the normally high-pressure side) shouldalso be discussed. Shutdown of a key pump or sys-tem may result in leaks in the ‘‘wrong’’ direction.

Many heat exchangers also have connections toallow them to use two different water supplies, forinstance, refrigerated water and cooling tower water.One frequent contamination issue is one water sys-tem flowing into the other. A wrong line-up is all ittakes. An exchanger that is lined up to cooling towerwater on the supply side and refrigerated water onthe return side can quickly overload a closed-loop

cooling system. If multiple processing areas are usingthe same refrigerated water system, operators need tobe able to quickly identify which exchanger is incor-rectly lined up.

The process area should be considered a whole tounderstand what would happen when an entire util-ity system is affected (loss of cooling tower or refri-gerated water or both). Are interlocks set up to tripthe system safely? Especially consider warm coolingwater scenarios. A process flare may be able to han-dle the increased emissions from one column, butwhat if multiple columns began sending increasedorganics to the flare?

Often the cooling water supply to refrigerationmachines is from the cooling tower system. If youlose cooling tower fans or water flow, the refrigera-tion machines may be overwhelmed or shut down.Refrigerated water systems often require their ownHAZOPs or failure mode and effect analyses to obtaina good understanding of what conditions can damageor shut down the machines or result in hot water orlow flow.

Process, distilled, or other water systems can alsohave many connections to the process. Look for con-nections for cleaning or pump seals. Contaminationand loss of flow should be considered. The leakissues described above apply to these water systemstoo.

Steam and CondensateBarometric condensers, as frequently used in

steam jet systems, are a special concern. Steam jetcondensate often contains some process materialunder normal conditions and can contain muchhigher concentrations under upset conditions.

Another potential hazard of vacuum system is deg-radation of a chemical in contact with the steam tem-perature in the jet or high temperatures in a vacuumpump. Vacuum is often used to reduce the processtemperature because higher temperatures favor unde-sired reactions or degrade one of the system materi-als. The PHA team should understand what chemicalscan reach the overhead system in normal and upsetconditions. Upset conditions should include a lot ofthe HAZOP guidewords—more/less reactant, more/less catalyst, too long, etc. Then, evaluate how thechemicals will react to the steam jet or vacuum pumptemperature. Especially look for the possibility thattoxic gasses like chlorine or H2S might be formed.

Especially in a large plant, it is important to con-sider whether a shutdown of the unit will affect theplant steam balance. If the steam header pressurestarts swinging, multiple units can be quickly af-fected. If another steam-producing unit shuts down,the problem can get worse. In our largest plant, wecompleted a HAZOP on the entire steam systembecause of all the interactions.

Sewer SystemsSimultaneous spills can result in mixing many

chemicals. Most of us in the industry have heard‘‘war-stories’’ about blowing the manhole covers off


sewer systems from acid/base reactions or deflagra-tion of flammable chemicals.

What materials can end up in your sewer system?Consider reactor overhead systems, condensate, spills,etc. Under what conditions (e.g., temperature, pH,etc.) could these materials degrade and form toxic orflammable materials? If any sulfur compounds areused, formation of H2S may be possible. In 2002,two workers were killed when H2S fumes wereformed in a chemical sewer at the Georgia-PacificNaheloa mill [6].

A lot of newer sewer systems are closed systemsthat drain to tanks. If materials react in the system, isthere enough relief? Could solid materials form whichcould plug lines or vents? If piping gets plugged,where will materials backup?

Inerting GasGases received by pipeline may be very reliable.

Inerting gases brought in by rail or truck and storedon-site are worth special consideration. How reliableis the supply? If several units are purging at the sametime, will the inerting gas system be able to keep upwith the demand?

Cryogenic liquids with vaporizing systems havespecial hazards. Are these systems owned and main-tained by the supplier or by the plant? How often arethey maintained?

Instrument GasPlants may have instruments driven by either air or

nitrogen. The first step is to look at the unit andunderstand whether all the instruments are using thesame instrument gas. If not, make sure the teamunderstands which instruments are using which sup-ply gas. Then, review the valve failure positions andreview how other instruments will react with loss ofgas. If you have some instruments on air and some onnitrogen, go through the exercise with each system.Make sure the valve utility-failure (shelf) positionsmake sense. (The ‘‘shelf’’ position is the position thevalve goes to when the instrument gas or instrumentpower is removed or the way it comes off the manu-facturer’s shelf. The utility-failure position does notimply the valve cannot fail while in service in anotherposition. During operation, valves can fail in any posi-tion, open, closed, or in-between.) If the process sys-tem will produce vapors, is it vented? Sometimes waterfeeds fail to open; can equipment flood?

Sometimes plants have systems where nitrogencan be used to supplement instrument air pressure.These systems are of special concern because nitro-gen is an asphyxiation hazard. Is instrument gas usedin enclosed areas such as shops or lab areas? Arethere gas-powered diaphragm pumps (one exampleis SANDPIPER� pumps) within the area? The dis-charges of such pumps could be hazardous if nitro-gen is used.

Power FailurePower is the hardest utility to evaluate, because

losing power is a common mode failure for the otherutility systems. Knowing which substations supply

power to key utility areas such as instrument air,refrigerated water, cooling tower water, and steam iscritical to a thorough evaluation. Individual substationoutages may present more challenges than a totalplant power outage because of unit interactions.

Before the introduction of UPSs, evaluating whatwould happen to control and shutoff valves on lossof power was relatively straightforward; all valveswould go to their utility-failure positions just as theywould on loss of instrument gas.

A UPS present many opportunities in making sys-tems safer, but evaluating electrical failures becomestrickier. With their power supplied by a UPS, controlvalve and safety shutoff valves will not go to theirutility-failure position during an outage until thebackup power runs out or the valve receives a sig-nal to close. Raw material, intermediates, and utilityfeeds not affected by the power outage can continueunless shut-off. Natural gas and steam frequentlyhave power supplies separate from process units.This can be advantageous if you want to keep natu-ral gas flowing to your flare, but not shutting offsteam feeds to your reactors or columns can be aproblem.

Let’s consider a distillation column with UPS powerto the controllers. If the pumps feeding the column areon the affected power system, they will shutdown andstop the feed. If the cooling water is affected, waterpumped to the condensers will be lost. If the steam tothe column is from a controller with a UPS backup, thesteam flow may continue. This is a recipe for a releasefrom a pressure relief valve, or worse, a potential col-umn overpressure. An interlock with a separate steamshutoff valve may be required.

What if the column feed pump is on a different(unaffected) power supply? Then the feed can con-tinue and fill up the column. Many columns are notdesigned to be liquid-filled. For many situations, youshould program distributed control and safety sys-tems to shut key valves on loss of power. But shut-ting the valves can result in other problems. Forexample, if the feed valve is programmed to close,you may end up with a pump running deadheadedagainst a blocked valve. Power or amp monitors canbe used to trip a deadheaded pump (power monitorsare preferred).

If steam is not affected by a power outage, steamturbine pumps and compressors can continue to runduring a power failure. Each turbine should be con-sidered individually to determine whether it shouldbe programmed to trip or not. A turbine pump thatsupplies oil to a compressor may be a good one toleave running. A compressor that supplies process airfeed to equipment that could become flammablewould be a good one to shutdown.

With a UPS, you do have the opportunity to keepkey valves from going to their failure positions. If theinstrument air supply is on the same substation as theprocess, critical valves may also need backup air bot-tles to prevent them from going to their utility-failureposition unnecessarily. Examples of situations thatcould benefit from backup air bottles include: a safetyvalve that dumps material from equipment, the natural


gas valve to a flare, or a reactor quench valve that willflood the equipment.

Control systems present special challenges too.What do the operators have to do to get back to theright part of a sequence? After a power outage, willthe control system recipe need to be reloaded? A fil-ter overpressure incident that occurred due to a batchrecipe overwriting a cleaning sequence is reviewed inRef. 1.

Particularly difficult to analyze are systems that canhave partial failures, such as: part, but not all, of anelectrical substation looses power, or one or twophases of the three-phase power are lost. The resultscan be sporadic and very confusing. A question toask is, ‘‘What if this device continues to operate whilemost other devices are tripped or shutdown?’’ If theconsequences are serious, then we may elect to tripthat device for specific detected utility or processconditions.

Normally, sudden power outages are short-lived,but what if the outage extends for 3 h or even days(e.g., posthurricane or postflood). Most plants haveemergency generators, but have you done a thoroughanalysis of what you need on emergency power?Does the operator know which devices are on emer-gency power? As systems change, emergency powerneeds also change. What systems will need to bepumped out? What equipment is critical to preventenvironmental releases?

SUMMARYIn summary, to prevent incidents, it is critical to

take a special look at utility systems and their poten-tial interactions with process systems. The intercon-nectivity between processes and utilities can result inincidents such as the ones presented here.

Reactivity matrices, coupled with project designreviews, PHAs, and MOC reviews, give us an oppor-tunity to anticipate and plan for these interactions. Ihope this article has you thinking about utility sys-tems in a different way.

LITERATURE CITED1. A. Ness, Unplanned Shutdown plus lack of knowl-

edge equals incidents, Paper presented at theCCPS International Conference Proceedings: 2004International Conference and Workshop Emer-gency Planning Preparedness, Prevention &Response, June 29–July 1, 2004, Orlando, FL; Cen-ter for Chemical Process Safety of the AmericanInstitute of Chemical Engineers.

2. Chemical Reactivity Worksheet, U.S. National Oce-anic and Atmospheric Administration, Available athttp:/response.restoration.noaa.gov/chemaids/react.html.

3. D.W. Mosley, A.I. Ness, and D.C. Hendershot,Screen reactive chemical hazards early in processdevelopment, Chem Eng Prog 96 (2000), 51–63.

4. R.W. Johnson, S.W. Rudy, and S.D. Unwin, Essen-tial Practices for Managing Chemical ReactivityHazards, Center for Chemical Process Safety of theAmerican Institute of Chemical Engineers, NewYork, 2003.

5. U.S. Chemical Safety and Hazard InvestigationBoard, Improving Reactive Hazard Management,Report No. 2001-01-H, U.S. Chemical Safety andHazard Investigation Board, Washington, DC,October 2002, 28.

6. U.S. Chemical Safety and Hazard InvestigationBoard, Georgia-Pacific Hydrogen Sulfide Release,January 16, 2002; U.S. Chemical Safety and HazardInvestigation Board Investigation Digest.


Documents

Interactions between process and utility systems