Night Shift Alarm Flood After a Sensor Drift
At 02:40 on the third consecutive night shift, the unit is at 92% power. A feedwater flow transmitter has been drifting for two weeks, and maintenance deferred recalibration because the spare was on backorder. Over 14 minutes the operator at the console receives 63 alarms, 41 of them first-out or repeat process alarms on the same feedwater loop; the rest are consequential level and pressure deviations. The operator acknowledges alarms rapidly to quiet the horn and reports to the supervisor that 'everything looks fine.' The supervisor notices the alarm list scrolling faster than it can be read and that the operator has stopped verbalizing actions. A shift relief is due in 40 minutes. The plant has no alarm rationalization study completed for this system, and the operating procedure says only to 'investigate abnormal indications.'
1. Identify the human-performance failure mechanisms most likely at play and explain how the alarm design contributed to them.
Read the worked answer
The dominant mechanism is alarm flood-induced attentional narrowing combined with a normalization-of-deviance pattern. With 63 alarms in 14 minutes (about 4.5 per minute), the operator cannot process each annunciator semantically, so behavior collapses to a stimulus-response loop: acknowledge to silence the horn. This is classic goal displacement-the operative goal becomes 'quiet the panel' rather than 'diagnose the feedwater loop.' The 41 repeat alarms on one loop are a design defect: without rationalization, a single drifting transmitter generates cascading first-out and consequential alarms that obscure the initiating event. The operator's 'everything looks fine' statement is normalization of deviance reinforced by two weeks of tolerated drift. The supervisor's observation that verbalization stopped is a reliable cue that workload has exceeded the operator's capacity to maintain explicit monitoring. Contributing factors: chronic unresolved equipment degradation, a procedure that gives no diagnostic guidance, and end-of-shift fatigue lowering vigilance. The failure is systemic, not a personal shortcoming.
2. Recommend immediate and longer-term actions, distinguishing what the supervisor should do now from what engineering and management must fix.
Read the worked answer
Immediate (next 40 minutes): the supervisor should take the console alongside the operator rather than critique from behind, freeze the alarm acknowledgment cycle, and direct a deliberate diagnostic check of the feedwater loop-compare redundant indications, trend the transmitter against independent level and pressure signals, and confirm whether the drift is instrument-only or process-real. Verbalize each step aloud to re-engage explicit processing. Consider a controlled power reduction or placing the affected loop in manual with clear ownership. Delay the relief handover until the situation is understood, or conduct a structured handover that explicitly flags the unresolved drift. Longer-term: complete an alarm rationalization study for the feedwater system, applying prioritization, deadbanding, and first-out suppression so one failed transmitter cannot generate 41 alarms. Replace or recalibrate the transmitter and close the deferral with a formal risk assessment. Revise the procedure to include diagnostic decision points. Add a fatigue and workload review for third consecutive nights. Finally, investigate why the drift was tolerated for two weeks-this is a safety-culture signal about deferral norms, not just a maintenance backlog.