Operating discipline, procedures, alarms and human factors

Good design and well-maintained equipment are not enough on their own. Process plants are run by people, and people make decisions under time pressure, with incomplete information, at night, after long shifts and during unusual operations. Operating discipline means doing every task the right way every time: following procedures, communicating clearly at shift handover, responding correctly to alarms and keeping the plant within its safe operating limits. This lesson covers the design of procedures, non-routine operations such as startup, shift handover, fatigue, alarm management and the main types of human error. Broader human factors topics such as workplace design and safety culture surveys are covered in other courses; here we focus on what matters most for process safety.

Why non-routine operations are dangerous

Startups, shutdowns, upsets and maintenance handovers make up a small fraction of operating time, but a large share of process safety incidents happen during them. Equipment is in transitional conditions, controls may be in manual, trips may be bypassed, and operators perform tasks they do only a few times a year. At Texas City in 2005, the raffinate splitter tower was being restarted after a turnaround when it was overfilled with liquid for hours, leading to the release. At Tesoro Anacortes in 2010 the rupture happened during a hazardous, non-routine startup step. Many companies now require extra controls for non-routine work: a written, step-by-step procedure, a pre-task briefing, extra supervision, and keeping non-essential people away from the unit.

Operating procedures

Written operating procedures tell operators how to carry out each phase of operation safely: initial startup, normal operation, temporary operation, emergency shutdown, emergency operation, normal shutdown and startup after a turnaround or emergency. They also state the safe operating limits for key variables, the consequences of going outside them and the steps to correct or avoid a deviation. Good procedures are accurate, current, easy to follow under stress, and written with the people who use them.

In Canada, CSA Z767 and the CSChE guide include operating procedures as part of their operations element, and provincial occupational health and safety laws require written safe work procedures for hazardous tasks. Some provinces' regulations for specific sectors, such as Alberta's upstream oil and gas requirements, add more specific rules.

Shift handover

Shift handover is a point where information can be lost. The incoming operator needs to know what is running, what is out of service, what is bypassed, what work permits are active, any abnormal conditions and what is planned. Investigations of Piper Alpha in 1988 and Texas City in 2005 both found that information was not passed on at shift change. Piper Alpha's night shift did not know that a pressure safety valve had been removed from a condensate pump on the day shift; when the standby pump was started, condensate leaked from the blind flange and ignited. Good handover uses a structured written log combined with a face-to-face conversation, ideally at the board or in the field, and covers a standard list of items.

Fatigue

Fatigue degrades vigilance, reaction time and decision making. Process plant operators often work 12-hour shifts, rotating between days and nights, and overtime during turnarounds can stretch working hours much further. The CSB found that the Texas City board operator had worked 12-hour shifts for 29 consecutive days. API RP 755, Fatigue Risk Management Systems for Personnel in the Refining and Petrochemical Industries, recommends hours-of-service limits, such as caps on consecutive shifts and work-set hours, along with fatigue training, incident investigation that considers fatigue and a process for exceptions.

Alarm management

Alarms tell operators that something needs their attention and response. But too many alarms, alarms with no clear response, and alarms that stay active for days all reduce the chance that an operator responds correctly to the alarm that matters. In 1994 at the Texaco refinery in Milford Haven, Wales, operators faced 275 alarms in the last 11 minutes before an explosion; the UK Health and Safety Executive concluded that they had too many alarms to respond to.

The standards ANSI/ISA-18.2 and IEC 62682 set out an alarm management life cycle: an alarm philosophy, identification and rationalization of every alarm, detailed design, implementation, operation, maintenance, monitoring and assessment, management of change and audit. In rationalization each alarm is checked against a simple test: does it indicate an abnormal condition, does it require a timely operator action, and is it the best indicator of that condition? Alarms that fail the test are removed or turned into events in the log.

# Alarm rate analysis for one operator console over a 12-hour shift (seeded data).
import random
random.seed(311)
intervals = 72                                   # 10-minute intervals in 12 hours
counts = [random.choice([0, 1, 1, 1, 2, 2, 3]) for _ in range(intervals)]
for i, extra in zip(range(40, 43), [28, 35, 17]):   # upset: cooling water pump trip
    counts[i] += extra
total = sum(counts)
flood = [i for i, c in enumerate(counts) if c > 10]
print(f"Total alarms: {total}, average {total / 12:.1f} per hour")
print(f"Flood intervals: {len(flood)} of {intervals} ({len(flood) / intervals:.0%} of shift)")
print(f"Alarms during floods: {sum(counts[i] for i in flood)} ({sum(counts[i] for i in flood) / total:.0%})")
calm = [c for i, c in enumerate(counts) if i not in flood]
print(f"Average rate outside floods: {sum(calm) / (len(calm) / 6):.1f} per hour")

Total alarms: 184, average 15.3 per hour
Flood intervals: 3 of 72 (4% of shift)
Alarms during floods: 85 (46%)
Average rate outside floods: 8.6 per hour

The analysis shows two problems. Even outside the upset, the rate of about 8.6 alarms per hour is above the benchmark of about 6, so the console needs rationalization. And a single upset produces a flood in which almost half of the shift's alarms arrive in 30 minutes, exactly when the operator most needs to think clearly. Measures such as state-based alarming, which suppresses alarms that are expected after a known trip, and grouping of consequential alarms help keep floods manageable. Alarm priority should reflect the consequence and the time available to respond, not the order in which alarms were configured.

Human error

Human error is a normal part of human performance, not a moral failing. Understanding the types of error helps choose the right control. A widely used scheme, based on James Reason's work, separates unintentional errors (slips, lapses and mistakes) from intentional deviations (violations).

Most violations are well-intentioned attempts to get the job done when the rule seems unworkable or the resources are insufficient. Punishing individuals without fixing the underlying conditions drives reporting underground. A just culture distinguishes honest errors, which are learned from, from reckless behaviour, which is not tolerated, and treats at-risk behaviour as a signal to fix the system (Lesson 12).