Operator Response to Alarm Is an IPL, Now What?

Claiming operator response to an alarm as an independent protection layer (IPL) is a relatively common practice. But, is enough emphasis given to ensuring that this IPL really has a 90% chance of success? There are a number of factors that may reduce the efficacy of an alarm coupled with operator response. This presentation will focus on several issues that can result in a potential failure of the IPL, and basic practices to address them. It’s important to remember that for operator response to an alarm to be an effective protection layer, the instrument must be in good working order, the alarm itself must annunciate (e.g., not be disabled, shelved or suppressed), and the human operator must know what to do and respond correctly. Sometimes, two human operators may be involved, both of whom must respond correctly. A potential failure of one or more of the above can impact the efficacy of the entire IPL.

Proper alarm rationalization, along with application of dynamic (state-based) alarming to reduce alarm floods, along with solid training, testing and maintenance programs are a must. The operator must know that he or she is essentially part of the safety system and must be trained on recognition of the IPL and proper response.

Proper practices to maintain the integrity of IPLs will ensure that the overall probability of undesired safety events remains within acceptable levels and improves overall plant safety.