Missing alarms

A missing alarm is an instance of an actual hazard which developed to an incidence, not preceded by an alarm.

Sources

Missing alarms are typical of system design in which either:

• Operator's limitation: the designer assumes that the operators will notice the hazard and will activate a suitable alarm. Such assumptions occasionally result in incidences.
• Missing alarming means: the design does not provide sensors to detect this kind of hazards, or indicators to notify the operators about them
• Reliability flaw: the sensors or indicators used to alert about the hazard  might fail
• Risky action: the operators might mute the alarm, or set wrong thresholds, or reduce the audio volume to minimum, to avoid nuisance, and forget to undo this action later.

Examples

Until September, 1977, it was the operator's task to notice situations of the PORV being stuck open in nuclear power plants manufactured by B&W. B&W manufactured and installed the several plants, including the Davis Besse and the TMI.

On September 24, 1977, following overheat due to loss of coolant, the PORV of the Davis Basse nuclear power plant opened several times, to release the high pressure. At the tenth instance the PORV stuck open due to a mechanical failure. The open valve permitted coolant water to escape from the primary system, and the pressure in the pressurizer reduced more than desired. Initially, the operators did not notice that the PORV was stuck open. Therefore, according to the procedures, they disconnected the backup pump of cooling water, which increased the overheating. After 10 minutes they realized that the PORV was still open, and they reactivated the back pump, thus preventing an accident.

Following investigation of this incidence, the B&W added a sensor to to its stations, to indicate the PORV state.

On March 28, 1979, following overheat due to loss of coolant, the PORV of the TMI reactor opened automatically, to release the high pressure, but was stuck open, due to a mechanical failure. Again, the open valve permitted coolant water to escape from the primary system, and the pressure in the pressurizer reduced more than desired.

At this stage, the operators were expected to notice the indication of the PORV state. Unfortunately, the indication was misleading. Due to a design mistake, it indicated that a control command was sent to PORV, but not the real state of the PORV. Therefore, according to the procedures, they disconnected the backup pump of cooling water, which increased the overheating. Unfortunately, in this case, the operators relied on the indication, and did not check the actual state of the PORV, ending up in the most celebrated nuclear incidence in the USA.   

Related topic

Updated on 13 Mar 2017.