Alarmed about abnormal situations

Basic guideline put forward by the EEUMA and Abnormal Situation Management consortium.

Each alarm is initiated by a field device or combination of signals, all of which require calibration and maintenance. If the field device is improperly maintained, the associated alarm will be unreliable and can result in inaccurate alarms. The question then becomes one of managing and maintaining sensitive/accurate hazard warnings versus the tradeoffs of false alarms.

The practice of maintaining this balance is the science of Abnormal Situation Management. The EEUMA 191 (http://www.eemua.org) standard forms the basis for alarm and abnormal situation management best practices. The EEUMA definition of the purpose of an alarm system is to direct the operator's attention towards plant conditions requiring timely assessment or action.

The most basic guideline from the EEUMA and Abnormal Situation Management consortium (http://www.asmconsortium.net/Pages/default.aspx) in determining if you have an alarming problem is if the rate of alarms in first 10 minutes following upset is more than 10/10 minutes while average alarm rate during normal operations as per figure below should be less than one low priority alarm every 10 minutes.

Because DCS alarm problems take various forms, additional work on alarm management and control system configuration is being done by two ISA (www.isa.org) Standards committees: ISA S.18.02 "Alarm Management for the Process Industries" and ISA-106 "Procedural Automation for Continuous Process Operations."

Some of the most prevalent alarm problems found on a DCS include the following.

• Alarm floods. An operator gets hundreds of alarms within a few minutes of a minor upset, and consequently misses detecting critical alarms
• High, continuous alarm rates. Rates are often far above an operator's ability to handle. In this case, hundreds to thousands of alarms are ignored each week with no guarantee that the "right" ones are ignored
• Improperly suppressed alarms, without records or notifications a risk to operations.
• Chattering and similar nuisance alarms make detection of valid alarms more difficult and therefore more likely to be missed. This can make an upset condition worse and/or last longer
• Stale or long-standing alarms that result from situations like these clutter an operator's view of the overall situation to make it more difficult to quickly and easily identify the root cause of the problem or identify any new alarms.

Timely detection, assessment, and response to an alarm are critical to success in keeping a platform up and running.

Abnormal situations that impact production vary from minor upsets to full shutdowns. They can be caused by a number of factors, including equipment failure, human error, and severe weather conditions. These situations then impact profitability through reduced product quality, diminished job satisfaction, lower product throughput, increased equipment damage, higher personal injury rates, and greater risk of loss of life. The result on production alone from unexpected events typically costs a facility 3 – 8% of capacity.

Production platforms and processing facilities are dynamic, wtih multiple operating states requiring different alarm settings. Control systems alarms are inherently designed to support a single operating state and, therefore, become useless outside the normal steady state. For optimum performance, alarm systems should be altered in real time under certain defined, controlled conditions to support each operating state. The need is expressed in three related functions:

• Alarm shelving – Inactivating an alarm for a period of time but in such a way that you are reminded that it is not operational
• State-based alarming – Changing of alarm set points based on the operating status of the facility such as start-up, shutdown, etc.
• Alarm flood suppression – Designing the alarm system so that if one alarm is activated none of the related subsidiary alarms annunciate. For example a pump failure alarm will suppress an associated resulting low pressure alarm.

One example of an offshore platform typical alarm flood candidate is the building air pressure monitor. Air conditioning maintains pressurization in inhabited areas. This is an inherently noisy signal, and it is complicated by doors opening and closing and wind direction changes. If the alarm is not configured properly to differentiate these from a true alarm (resulting from a sustained drop in pressure), many spurious alarms will result. When something does happen, the alarm will be ignored. An alarm management system will classify such an alarm as a "bad actor" and flag it for follow-up.

Compounding the alarm problem are false alarms such as the just described air conditioning situation or false signals from flame or gas detectors which pose dangers to workers and can be expensive in production losses.

False alarms add their own brand of safety issues. Workers can be injured as they respond to the false alarms. Conversely, if workers hear enough false alarms, their response time might decrease. In addition, false alarms cost time and money: lost production dollars, lost work time for crews, and, of course, overtime pay for the folks who get pulled from sleep at 3 a.m. to address the false-alarm call.

We will never eliminate abnormal situations, but that does not mean we cannot make an effort to manage them. The tools and practices, as well as the incentive to do so, are certainly there – all it takes is the will power to do so.

The author