The Night Shift Alarm Flood at Ammonia Storage
At a fertiliser plant, the anhydrous ammonia storage area has a tank with a high-level alarm and a high-high level trip to the transfer pump. Over three weeks the control room logged 412 high-level alarms, of which operators acknowledged most within 30 seconds without leaving their seats; the high-high trip has not operated in 14 months. The shift supervisor says the level transmitter 'drifts a bit' and operators have learned to ignore it until the roving operator reports the sight glass. Last month a relief valve on an adjacent tank lifted during a hot afternoon. The site's process safety lead is asked whether this is a reportable near miss.
1. Assess whether the alarm and trip performance here represents a process safety concern, and identify the leadership failures that allowed it to develop.
Read the worked answer
This is a classic alarm-rationalisation failure with a suppressed safety layer. Key reasoning:
- Alarm rate and operator response: 412 alarms over ~21 days is roughly 20/day in one area, and acknowledging within 30 seconds without investigating indicates the alarm has become background noise. An alarm that is routinely ignored provides no protection.
- Trip as an independent layer: The high-high trip is the last engineered barrier before overfill. It has not operated in 14 months, which could mean it is healthy but untested, or that the level never reaches it because operators act early - or that the trip is defeated/isolated. This must be verified by proof-test records, not assumed.
- Reliance on a human barrier: Using the roving operator's sight glass as the real control means the safety case now depends on a periodic manual check with unknown frequency, not the instrumented system.
- Leadership failures: tolerating a known drifting transmitter without a management-of-change or maintenance action; no alarm rationalisation or performance monitoring; no investigation of why the trip never operates; normalisation of deviation reinforced by supervisors.
The near miss (relief valve lifting) should be investigated as a loss-of-containment precursor, and the alarm system should be reviewed against a documented alarm philosophy with target alarm rates and response times.
2. Recommend the immediate and longer-term actions you would take, and explain how you would prioritise them.
Read the worked answer
Prioritise by risk reduction and reversibility:
Immediate (within days)
- Verify the high-high trip is functional and not bypassed; if proof-test evidence is absent, proof-test it now and record the result.
- Repair or replace the drifting level transmitter; until then, define a documented manual level check with a frequency justified by fill rate and available ullage.
- Confirm the relief valve that lifted is reseated and the cause of lifting is understood (overpressure, thermal expansion, or downstream restriction).
- Brief the shift team that the alarm is not to be acknowledged without a response action.
Short term (weeks)
- Run an alarm rationalisation against an alarm philosophy: define cause, consequence, operator action, and response time for each alarm; suppress or redesign nuisance alarms.
- Review trip proof-test intervals and results; investigate the 14-month gap.
- Add alarm performance indicators (alarms per hour per operator, standing alarms, chattering alarms) to the weekly process safety review.
Longer term
- Independent protection layer review (e.g. LOPA) to confirm the overfill scenario has adequate layers given actual performance.
- Management-of-change discipline for instrument deviations and any temporary measures.
Rationale: restore the engineered barrier first, then remove the human-reliability problem, then fix the management system that allowed it.