(86c) Examination of Events That Occur during an Alarm Flood - Their Impact on Safety and Proper Corrective Action

Examination of Events that Occur During an Alarm Flood - their Impact on Safety and Proper Corrective Action

Alarm floods remain a significant safety issue for many process plants. During set up of modern systems, it is much cheaper to design an alarm than going through the process of deciding if it is needed or not. Therefore, many unnecessary alarms are configured.

Many plants have tried to address alarm floods through static alarm rationalization - some more than once. The results however, typically show improvements in average rates but a large majority fall short of any real improvement in alarm floods. In fact, static rationalization can make alarm flooding worse because alarms are set up for the full run condition. When an upset or other process mode change occurs, even more alarms will annunciate which can create an alarm flood out of a collection of nuisance alarms that are established in the control system for a full run condition.

Some plants, as a part of their LOPA or other safety reviews, have claimed credit for operator response to alarms as a valid protection to prevent a scenario from occurring. If alarm floods occur, the claimed credit may no longer be valid.

Alarm floods can cause an operator to miss a critical alarm. This is particularly important when the priority of the alarm is critical and the time for operator response is relatively short or the risk is high. Depending on the number of alarms in the flood, the operator may never know there was a critical alarm because that alarm scrolled off the summary screen while it was being populated with meaningless nuisance alarms. In other cases, the operator can become so busy acknowledging and diagnosing alarms that they are not able to perform their duties in a timely manner. It does not matter which of these events occur, the operator is in a no win situation and is forced to play catch up and possibly experience more missed alarms. As this scenario repeats itself, the opportunity for a critical alarm to be missed increases as does the chance for operator error. Likewise, the opportunity for loss of containment events, damage to equipment and personal injury or worse can also increase. Capital spending on many projects may be rooted in an event that was the direct result of an alarm flood. Competent operators have been dismissed because they alloweda piece of equipment to suffer damage in the middle of an alarm flood.

OSHA now considers ISA 18.2 Management of Alarm Systems for the Process Industriesto be RAGAGEP. This standard defines an alarm flood to be more than 10 alarms in a 10 minute period per board operator. OSHA has now included alarm performance questions into their base question set for their interviews with operators and discussion during site visits. Plants should be able to prove they comply with the Target Metrics in ISA 18.2. Splitting the high priority alarms into a separate list or annunciating with a unique sound does not relieve management of the responsibility to meet OSHA directives and have the ability to prove it over time.