3,712 alarms in 12 hours: what the BP-Husky fire teaches about alarm flooding and process safety

The number behind the overload

Between 6:50 a.m. and 6:49 p.m. on September 20, 2022, BP-Husky Toledo refinery board operators received 3,712 alarms. A simple average is about 310 per hour, or just over five per minute. That arithmetic describes scale, not the peaks, simultaneity or distribution across operating positions.

Ignition occurred at 6:46 p.m., three minutes before the recorded interval ended. The total must therefore not be described as a count completed precisely before the fire. The headline summarises nearly 12 hours of alarm flooding.

An alarm can protect people only if its meaning is recognised and the required action can be completed in time. A display competing for attention with hundreds of other messages can become another demand on the operator rather than a guide to recovery.

The CSB announced its new safety video on September 30, 2026; its video catalogue dates the page October 1. This article draws on the final 2024 investigation and focuses on safeguards and working conditions, without treating two fatalities as evidence of individual blame.

What happened at BP-Husky

At about 3:20 a.m., a process upset in the naphtha hydrotreater resulted in loss of containment. The hydrotreater treats a light petroleum fraction. Its shutdown affected other refinery units and led to abnormal operating configurations.

Crude Unit 1 performs the initial separation of crude oil. The Coker Gas Plant handles gas streams associated with coking. In the abnormal configuration, its bypass formed part of the route carrying liquid naphtha into the Fuel Gas Mix Drum, a pressurised vessel in the fuel gas network that normally contained vapour.

The drum filled and overflowed towards piping feeding furnaces and boilers. Liquid entering a system meant to deliver gas creates a separate fire or explosion threat. During an afternoon meeting, leadership and process engineers discussed shutting down Crude 1 or placing it in circulation; neither option was implemented then.

A summary email was not sent, and the CSB found no evidence that the decisions were adequately passed to the next shift. Workers were directed to drain the vessel quickly. Investigators concluded that they may have believed it contained an amine-water solution rather than flammable naphtha. This is a qualified finding, not certainty about each person’s thoughts.

Liquid released to the ground vaporised. At 6:46 p.m., the flammable cloud reached a Crude Unit 1 furnace and ignited in a flash fire. Two people died. The CSB reported more than 23,000 lb of naphtha released and approximately US$597 million in damage, including loss of use.

Fuel Gas Mix Drum: vapour service, unexpected liquid

A fuel gas network supplies gaseous fuel to equipment such as furnaces and boilers. A drum can provide mixing and separation functions according to its design. Our educational drawing omits the real piping, instruments and protections and is not BP-Husky’s P&ID.

The investigated hazard involved liquid entering and accumulating in a system intended for vapour. A pressure-relief valve must not be assumed to protect against every overflow scenario: pressure control and liquid inventory require distinct assessment.

Review credible liquid pathways during normal operation, startup, shutdown, bypass and process upsets. Effective protection should interrupt the hazardous mechanism before it leaves people facing an urgent, poorly informed choice.

What is alarm flooding?

Alarm flooding occurs when arriving alarms exceed the team’s practical capacity to distinguish conditions and respond. Acknowledging or silencing a notification does not mean diagnosing its cause or restoring stability.

Consequential alarms follow an initiating disturbance. Duplicate alarms repeat a problem. Nuisance alarms repeatedly draw attention without sufficient value; stale alarms remain active for long periods. Together, these conditions can obscure an important change while available decision time shrinks.

Evaluate actual histories, process trends, timestamps, actions and operating configuration. Simply removing messages is not improvement if essential information disappears with them.

Alarm, event, trip and SIS: different functions

An event may only record a state change. An alarm requires operator response. A trip or interlock initiates an automatic action. A Safety Instrumented System (SIS) implements safety instrumented functions (SIFs) with requirements established through risk assessment.

An HMI may display indications from both basic control and a SIS. Displaying a warning does not itself create an independent safety function. Ask what detects, decides and acts, and which failures can defeat multiple protections.

3,712 alarms are not 3,712 independent hazards

One upset can affect pressure, flow, temperature and level across many pieces of equipment. The resulting cascade may contain many consequences of one initiating problem. Counting them as independent risks is misleading; ignoring them as mere repetition can conceal escalation.

Distinguish initiating indications, expected consequences and signals of a new threat. Monthly averages can hide severe episodes. Analyse each flood’s duration, alarm count, peak, critical signals and the feasibility of the required responses.

This article does not prescribe a universal acceptable alarm rate. Performance depends on the process, operating position, context and applicable engineering references. Restore meaning instead of chasing an attractive dashboard number.

When everything is urgent, priority disappears

Alarm rationalisation means justifying each alarm. Record the detected condition, plausible cause, consequence of inaction, expected response and available time. Derive priority from these factors rather than a supplier’s default setting.

Ask what the operator will actually do. If acknowledgement is the entire response, the indication might be an event. If two alarms demand the same response, assess redundancy. If the response cannot be completed in time, an additional alarm does not solve the protection gap.

Shelving temporarily suspends an alarm under controlled rules. State-based suppression can remove indications inappropriate to a particular operating mode. Both need authorisation, reasons, records and review; hiding dangerous conditions without governance reduces risk visibility.

Checked October 7, 2026: ISA’s public catalogue lists ANSI/ISA-18.2-2016, IEC lists IEC 62682:2022 edition 2.0, and EEMUA lists Publication 191 fourth edition. These are international engineering references. Proprietary tables and numerical limits are not reproduced here.

Abnormal situations require a different operating approach

Abnormal situation management addresses disturbances beyond the basic control system’s ability to maintain stability. When units stop, routes change and vessels collect unexpected material, normal procedures may no longer describe actual conditions.

Define escalation triggers, responsible people, resources and criteria for shutdown, circulation or another safe state. Shutdown itself can create hazards if badly sequenced; the safe condition and route to it must be studied before an emergency.

As an educational example, a level rising despite planned responses while its source remains uncertain calls for reassessment of feed and containment through authorised procedures. Improvised draining can transfer the hazard from the equipment to people and the environment.

Handover: a decision must reach the next shift

Shift handover is a risk control. An unsent summary and unconfirmed decisions leave the incoming team with an incomplete picture. The CSB documented this at BP-Husky; the preventive lesson is communication designed to survive overload.

An abnormal-condition handover should cover the current configuration, stopped units, bypasses, unavailable equipment, suppressed alarms, concerning trends, pending decisions and escalation criteria. The receiving team should confirm understanding and know who owns the next action.

Recording a critical change is necessary, but receipt and understanding also need confirmation. Safety should not depend on somebody discovering an email while responding to dozens of alarms.

Stop work authority must work under pressure

Stop work authority enables employees to pause a task perceived as unsafe until the concern is resolved. It needs a route to leadership, protection for exposed workers, risk assessment and a controlled restart. A policy mentioned only at induction offers little practical support in an emergency.

The CSB recommended procedures and regular training, especially for abnormal situations and alarm floods. People exercising the authority need listening and support even when production recovery is urgent.

Stopping a field task and bringing a process unit to a safe state are related but different decisions. The first responds to a perceived threat; the second requires the appropriate operating sequence. Escalation must be available before an irreversible action.

Alarms cannot be the only safeguard for a severe event

Human response depends on detection, interface, understanding, staffing and time. For severe consequences, examine whether protection has become dependent on a single sequence of perception and reaction.

Inherently safer design, overflow prevention, level instruments, basic control, interlocks, SIS, relief, containment, safe drainage and emergency response serve different purposes. Their selection and configuration require process-specific risk assessment, rather than a universal list to install.

Do not automatically count each box in a diagram as an independent protection layer (IPL). Independence, specificity, reliability, auditability and common-cause vulnerabilities must be demonstrated. Two indications using the same sensor may share the same failure.

The 2019 warning: learning must change safeguards

A refinery upset in 2019 had already allowed naphtha into the Fuel Gas Mix Drum. The CSB found that the internal investigation identified catastrophic warning signs but did not produce sufficient action to prevent recurrence.

Ask whether recommendations addressed the physical failure pathway, had an owner and deadline, were implemented and were tested for effectiveness. Closing an administrative action does not necessarily remove the hazardous scenario.

Near misses should inform scenario reviews, procedures and protection design. Tests, inspections and exercises can establish whether the intervention changed system response. The learning loop ends with evidence of reduced risk, not a completed report.

What changed: the seven recommendation statuses

The table records the CSB register checked October 7, 2026. Four recommendations were issued to Ohio Refining Company, two to API and one to ISA. Three were closed and four remained open. The final investigation report was issued June 24, 2024; an open recommendation does not mean an unfinished investigation.

An acceptable response indicates a suitable planned action still awaiting completion. Acceptable action indicates Board closure; acceptable alternative action indicates closure through an alternative solution. These classifications do not certify the safety of the entire facility.

Official recommendation register →

What occupational safety professionals can learn

Personal injury indicators and process safety indicators answer different questions. Few everyday injuries do not prove that containment-loss pathways are controlled.

Operations, automation, maintenance, engineering and occupational safety should review barriers together. Handover quality, alarm load, bypasses and overdue actions can reveal protection weaknesses.

• Assess response capacity in degraded conditions, not only stable operation.
• Include escalation and safe-state decisions in studies and exercises.
• Treat human factors as conditions of the work system.
• Ask why an urgent decision became the remaining line of protection.
• Verify the implementation and effectiveness of corrective actions.

Applying the lessons in Brazil

US regulations do not automatically apply to Brazilian installations. The engineering lessons can nevertheless inform flammable-material operations through risk analysis, procedures, training, management of change and emergency planning.

Brazil’s NR-20 provides the relevant occupational safety framework for flammables and combustibles where applicable. Occupational risk management and the PGR should connect with specialised process studies. A generic hazard register cannot replace assessment of overflow pathways, control failures and loss of containment.

ISA-18.2, IEC 62682 and EEMUA 191 are international technical references. Apply them with the appropriate edition and context, while reviewing safeguards and operating practices alongside alarm philosophy.

A practical alarm-management checklist

Use these questions in a joint operations and engineering review. Answers without evidence should become investigation actions with owners and deadlines.

• Does every alarm require a clear operator action?
• Does priority reflect consequences and available response time?
• Are duplicate, stale and nuisance alarms identified and addressed?
• Is upset performance assessed as well as monthly averages?
• Is each flood reviewed for duration, count and peak?
• Do shelving and suppression have authorisation, reasons, expiry and audit records?
• Does the team know the safe state and how to reach it?
• Does handover include bypasses, suppressed alarms and emerging threats?
• Are escalation, shutdown and circulation criteria clear?
• Is stop work authority practised and supported?
• Do near misses result in implemented, effectiveness-checked actions?
• Do required safeguards reduce reliance on one human response?

A system that helps people recognise what matters

The lesson of 3,712 alarms is not simply fewer alarms. It is meaningful, actionable signals, adequate protection for critical risks, planned abnormal-condition decisions and learning that changes the system.

Alarms are a language between the process and its operators. When that language becomes noise, the organisation needs to redesign the system and response conditions. Asking for more attention cannot restore missing time, information or safeguards.