Degraded alarms still require attention
During a scheduled maintenance turnaround at a petrochemical facility, a critical level transmitter on a hydrocarbon knock-out drum was isolated for calibration. To prevent nuisance alarms in the control room, the operator placed the specific alarm loop into “Maintenance Bypass” mode. However, due to a lack of visual representation on the main Distributed Control System (DCS) screen, subsequent shifts were unaware the bypass was active. During a process upset later that night, liquid hydrocarbon carried over into the flare header, causing a massive thermal shock and a pipe flange rupture.
Contact us for more details on our Alarm management/ Alarm study process.
Key Learnings:
- Visualizing the Hidden: Any safety interlock or alarm bypass must have a prominent, persistent visual indicator on the primary DCS overview screen, not hidden in sub-menus.
- Shift Handover Rigor: Bypassed safety systems must be treated as critical items during shift handovers, requiring physical verification and sign-off by both incoming and outgoing shift supervisors.
- Alternative Protection: Operating in a degraded mode (with a bypassed safety device) requires implementing temporary, documented administrative controls, such as manual local logging, until the primary system is restored.
Labels: Incidents, Operations, Managing Change
