Alarm Management and Operator Graphics: Peter Andow Honeywell Process Solutions

Alarm Management and
Operator Graphics
Peter Andow
Honeywell Process Solutions
for
Institution of Chemical Engineers

Southampton, May 2005
Agenda
• Alarm Management
- Awareness: “The Alarm Management Problem”
- Progress to Date
- What Next?
• Operator Graphics
- Experience
- ASM Guidance
- Applications
• Summary
2 © 2005 HONEYWELL PROCESS SOLUTIONS Alarm Man Op Graphics

Problem Awareness …

More recently …

ASM Consortium
•• Charter:
Charter:
-- Research
Researchthe
thecauses
causesof
ofabnormal
abnormal
situations
situationsand
andcreate
create
technologies
technologies toaddress
to addressthis
this
problem
problem
•• Deliverables:
Deliverables:
-- Technology,
Technology,best
bestpractices,
practices,
application
applicationknowledge,
knowledge,
prototypes, metrics
prototypes, metrics
•• History:
History:
-- Started
Startedin
in1994
1994
-- Co-funded
Co-fundedby byUS
USGovt
Govt(NIST)
(NIST)
-- Budget:
Budget:+$16M
+$16MUSD
USD
•• Current
CurrentStatus:
Status:
-- Honeywell
Honeywellleadership
leadership
-- Expanding
Expandingmembership
membership
Customer Driven Solution Drives 3-8% Additional Capacity

Experience from Projects
No plant-wide philosophy Minor operating Documentation

and guidelines for alarms upsets generate and graphics
significant numbers support varies
of alarms widely
Major operating upsets
generate alarm “floods”
Some alarms When nothing is

“stand” for long wrong, there are
periods of time active alarms
Alarm configuration
management is poor
Alarm activations
occur without need
Alarm Prioritization is inconsistent
for operator action

Agenda
- Progress to Date
- What Next?
- Experience
- ASM Guidance
- Applications
• Summary

Forces Driving Honeywell Alarm Solutions
• ASM Consortium
- “Effective Alarm Management Practices” document
• Honeywell Customers
- Shell ESP
! “We know our limits and we operate within those limits all the time.”
- ExxonMobil
! Mutual Development Funding
- Others…
• EEMUA 191
- “The de facto standard”
• Standards
- IEC 61508/61511
- UK HSE Document
- OSHA 1910.119
- Etc.

EEMUA … “the de-facto standard”
The ASMC is very

much concerned
with Alarm
Systems

EEMUA 191
• A huge step forward!

• Heavy focus on redesign (“rationalisation”):
- Removal of meaningless “alarms”
- Better use of priorities (e.g. for use during floods):
! ~ 5% URGENT
! ~ 10% HIGH
! ~ 85% LOW
- Wider limits – “alarms” not useful for minor deviations
- More effective use of existing alarm configuration
parameters
• Targets for activation frequency
• EEMUA also calls for other improvements which are

often neglected (MOC, alarm suppression etc.)

The Three Common Problems
Problem Type Solution Approach Target

(e.g. from EEMUA)
(one operator)
Standing alarms Mode-based alarming. < 10
Shelving.
Background alarms Alarm rationalisation (just < 10 per hour

“Bad Actors” ?)
Alarm floods Full alarm rationalisation. < 10 in first 10

Enhanced processing. minutes of upset

ASM Consortium
Alarm System Performance
Metrics Benchmarking
Project
Alarms/10 mins (ASM ® Consortium Data)
Very Likely
10.0
9.0 Unacceptable
8.0
7.0
6.0
5.0
EEMUA
4.0 Rating
3.0
2.0
1.0
0.0 Very Likely
Low – Average – High Alarm Rate for 40 Consoles Acceptable
• Average alarm rates (the “background” rate) have improved

• Sites can meet and sustain the EEMUA targets (“Manageable” or
“Very Likely Acceptable”)
ASM is a registered US trademark of Honeywell Inc.

Peak Alarm Rates (ASM Consortium Data)
Consoles
100.00
Without
Frequent
10.00
Flooding
1.00
0.10
0.01
Consoles With
0.00
Frequent
Degree of Rationalisation for 40 Consoles Flooding
• The peak alarm rate is not closely correlated with the degree
of rationalization
• Peak alarm rates exceeding 100 alarms per 10 minute window
were experienced at least once by 60% of the consoles

Three Problems Summary
Tools and
Problem Type progress
Solution Approach Target
(e.g. from EEMUA)
(one operator)
Standing alarms Mode-based alarming. < 10
Shelving.
Considerable
Background alarms
progress
Alarm rationalisation (just < 10 per hour
“Bad Actors” ?)
Alarm floods Full alarm rationalisation. < 10 in first 10

Enhanced processing. minutes of upset
The most difficult
problem

Safety-Related Alarms
• As noted in the EEMUA Guide:

• Most process plant alarms are DCS-based and are
covered by the International Standard IEC 61508.
• Many countries expect compliance with IEC 61508.
• According to the standard, an alarm system is
safety-related if:
- It is a claimed part of the facilities for reducing risks from
hazards to people to a tolerable level
- AND … the claimed reduction in risk provided by the alarm
system is “significant”
• “Significant” means a claimed Average Probability
of Failure on Demand of less than 0.1/demand
• Terminology!!!

Safety-Related Alarms
• If an alarm system is considered as a safety-related

system then:
- It should be designed, operated and maintained in
accordance with IEC 61508.
- It should be independent and separate from the process
control system (unless the process control system is itself
safety-related and conforms to IEC 61508).
• Many plants use (or claim to use!) a separate, high-
reliability system for safety-related alarms.
• The traditional DCS (including Honeywell ones) are
NOT engineered to IEC 61508 specifications and
should NOT be used for safety-related alarms.

IEC 61511
… generally reinforces the generic

requirements of IEC 61508 as far as
process industry alarms are
concerned
IEC 61511
• “It should be noted that a risk reduction of up to a

factor of 10 might be claimed without the need to
comply with IEC 61511. Where such claims are
made, the human factor issues will need to be
carefully considered”
• “Any claims for risk reduction from an alarm should
be supported by a documented description of the
necessary response for the alarm and that there is
sufficient time for the operator to take the corrective
action and assurance that the operator will be
trained to take the preventive actions”

IEC 61511
• An alarm system can be used as a method of risk

reduction by reducing the demand rate on the SIS
providing:
- the sensor used for the alarm system is not used for control
purposes where loss of control would lead to a demand on
the SIF.
- the sensor used for the alarm system is not used as part of
the SIS.
- limitations have been taken into account with respect to risk
reduction that can be claimed for the BPCS and common
cause issues.
• Some plants seem to be unaware of the IEC

61508/61511 guidance or mistakenly believe that
they are following it

Agenda
- Progress to Date
- What Next?
- Experience
- ASM Guidance
- Applications
• Summary

More Work Required?
• So … some incidents have raised awareness and

EEMUA has given us a framework to move forward
• A lot of work has been done …
• … but significant problems remain:
- Many plants have considerably improved their performance
… but large variations between the best and the worst (even
within the same site and/or company)
- The ASMC study (and anecdotal evidence) has shown that
alarm floods are still a major problem
- Rationalisation can be time-consuming and expensive …
lots of interest in better techniques/tools
- Safety-Related alarms are a source of real concern
• Need for effective tools (not just analysis tools) and

the work-process

Shell ESP Program
Operations Management Pro is the Productization of Shell ESP
• Ensure Safe Production is a Shell Global Solutions initiative
to establish work processes to…
- Establish Limits for plant operations -- based on equipment,
health, safety, and environmental concerns/regulations
! assure consistency across application disciplines
- Validate daily operating targets against these limits
- Monitor and control deviations
! monitor and report deviations
! common approaches for notifying appropriate plant personnel
- Learn and Improve -- assess plant performance
! common end of shift logs
! drill-down plant level access
! deviation and alarm system metrics
• Joint Shell / Honeywell development
• Currently being installed at the 9 US Shell refineries
Major
Major commitment
commitment by
by Shell
Shell -- $11M
$11M
Safe Operating Boundaries
• Operating within safe operating boundaries is key to

safety. Many major incidents have been attributed to
operations unknowingly or knowingly running
outside safe operating boundary
• Boundaries are often not well documented and
maintained today
Source of Limits
Location of Limits
Users of Limits
Corrosion
Safety Environmental PVHH Alarm Limit
Manager UserAlert Hi-Hi Alert Limit
Design PVHI Alarm Limit

Reliability Environmental Engr. UserAlert Limit
APC Limit
xxx Process
Operational Target Limit
yyy
Joe Operator UserAlert Limit
PVLO Alarm Limit

Boundary Management
Equipment Operating
Constraints Boundaries Application Limits
Range High
PVHH Alarm Limit

Design Critical High
Safety Manager UserAlert Hi-Hi Alert Limit
Corrosion Standard High PVHI Alarm Limit
Proces Target High
Environmental Engr. UserAlert Limit
Reliability
Environmental APC Limit
Operational Target Limit
Target Low
Joe Operator UserAlert Limit
Standard Low
PVLO Alarm Limit
Critical Low
Range Low
• Consistent reference point based on facts,

facts documented and available
to the entire operating team and other applications
• Thorough PHA, HAZOP, and alarm system design with cross
functional team
- Clear definition of safe upper and lower limits (OSHA 1910.119)
- Identify what to monitor (alarms, alerts, production targets)
- Capture and make available knowledge from PHA, HAZOP, AOA,
other processes
Experion Enterprise Model
• What is the Enterprise Model? Precipitation
- Allows organization of Experion platform to Thickeners

reflect structure of the plant including assets
and boundaries Thickener1
- Will become the basis for other models/views Thickener2

that reflect other aspects of the enterprise
Train1
Precipitator1
• Applications organized around the
hierarchical asset model Agitator
- Existing area-based mechanisms enhanced to Cyclone

work with more richly structured asset model
Precipitator2
- More effective integration since application
…
parameters are based on the same core
enterprise model Train2
Precipitator1
…
Define Equipment Define Constraints
Map Constraints To Tags

Map Boundaries to Alarm & Alerts
Management of Change
(MOC) for all changes –
intended for offline use Manage multiple types
• Design
• Environmental
• Safe operating limits
• Environmental
• Corrosion
• (etc.)
Equipment
Boundary Reference
constraints
Documentation Link
Variable
boundaries
Applications use boundaries

• Production monitoring
• Process monitoring (alarm
& alerts)
• Exposed via OPC

Boundary Information Availability
• ACM Information exposed:

- Boundary Values and Alarm Limits (operating mode aware)
- Alarm Help
- Alarm Documentation
• Uses:
- GUS & HMI Web Displays
- OI/OM Integration
- UserAlert – boundary alerts
- APC – model constraints
- Etc

Common Database for Managing Limits
Common configuration management
• Cross-checking
• Audit tracking
• Enforcement
• Mode change management
Operating
Operating limits established Boundaries
by Operating Instructions Range High
Critical High
Process alarm trip-points
Standard High
Target High
Target Low
Operating limits used by Standard Low

Critical Low UserAlert limits
Operations Monitoring Range Low

Agenda
- Progress to Date
- What Next?
- Experience
- ASM Guidance
- Applications
• Summary

An “effective” graphic?
Pick out the
alarms in
T200 FRAC OVRHD
FI226 this display.
400.312
CSR MSCFD FLARE
PC105 PI115 FI204

TI202 15% 18.70 10.77 000.00
281.53 PSIG PSIG MSCFD
E209
DEGF TI203 E210
200.09 FUEL
PC106
CWS DEGF GAS
15.73
LI224
TI201 PSIG
PI201 280.03 95
18.71 %
F
PSI FC201 85%
T203
4608.23 0%
BPD FC234
LI214
65% 13.29
D200 85
KBPD
%
T200 TEMPS TI223

1-281.53 DEGF T200 440.06
2-280.03 DEGF F
3-271.89 DEGF VRU
4-266.00 DEGF
5-255.44 DEGF TI213
6-254.99 DEGF 89.03
7-266.92 DEGF AI241
F
LC204 C205 320.78
25 AMPS
%
SOUR
FC214
WTR
1308.29
50% BPD
NAPHTHA
SLOP
100%
P209 P211
P210 P212

An “effective” graphic?
T200 FRAC OVRHD

FI226
400.312
CSR MSCFD FLARE
PC105 PI115 FI204

TI202 15% 18.70 10.77 000.00
281.53 PSIG PSIG MSCFD
E209
DEGF TI203 E210
200.09 FUEL
PC106
CWS DEGF GAS
15.73
LI224
TI201 PSIG
PI201 280.03 95
18.71 %
F
PSI FC201 85%
T203
4608.23 0%
BPD FC234
LI214
65% 13.29
D200 85
KBPD
%
T200 TEMPS TI223

1-281.53 DEGF T200 440.06
2-280.03 DEGF F
3-271.89 DEGF VRU
4-266.00 DEGF
5-255.44 DEGF TI213
6-254.99 DEGF 89.03
7-266.92 DEGF AI241
F
LC204 C205 320.78
25 AMPS
%
SOUR
FC214
WTR
1308.29
50% BPD
NAPHTHA
SLOP
100%
P209 P211
P210 P212

Agenda
- Progress to Date
- What Next?
- Experience
- ASM Guidance
- Applications
• Summary

ASM Consortium Guidelines
“Effective Operator Display
Design”
(Version 4.00 19/June/2002)
ASM Guidance
• The detailed guidance is only available to ASM

Consortium members
• Honeywell project teams can also use the guidance

on non-ASM Consortium projects
• But some parts derive from public-domain

information …

Level 1: Process Area Overview Displays
• Level 1 graphics show the broadest available view of

the facilities under the operator’s control.
• Primary purpose is to provide situational awareness
of the operators entire span of control
• Summarized on a limited number of displays.
• Contains multiple units, with the process values or
safety signals being read-only from a control
perspective.
• The operator is not allowed to execute any control
from this display.
• Simplified process flow diagrams of a whole plant
area.
• Often a combination of KPI values, trends and alarms

Level 2: Process Unit Overview Displays
• Main control interface for performing routine

operational tasks
• One for every major process unit
• Enough information to control plant under normal
conditions
• Allows operators to perform common tasks without
changing graphics
• Used to provide information regarding key elements
of the process unit

Level 3: Detailed Displays
• Exhaustive in their detail and contain all available

information of smaller pieces of the process unit.
• All control loops (?) and indicators are shown on the
Level 3 displays.
• Used for detailed investigations and interventions
that are not time-critical.
• May also be used to show detailed alarm
information (e.g. PVLL)

Agenda
- Progress to Date
- What Next?
- Experience
- ASM Guidance
- Applications
• Summary

Level 1 example

Level 2 Example

Level 3 Example

Nova Chem, Joffre, Alberta
• By using the ASM concepts in

one of their process units
- ASM graphics
- Alarm management
- Etc …
• >35% improvement in
recognizing process deviations
before an alarm
• 25% improvement in their ability
to solve the problem
• 35-48% improvement in operator
response time to deviations
• As compared to other units that
were using US station type
technologies as their control
room environment, operators
were able to orient to problems ~ C$1M per year in savings
faster, more completely resolve
the problems, and generally deal
with abnormal situations faster

Honeywell is also applying the
EEMUA guidance and ASM Graphics
guidance to it’s Alarm Summary as
well as in the HMIWeb Solution Pack
Experion PKS Alarm Summary
One-click sorting!
Create and store
“views” of areas,
filters, and sorting
Enter comments
on alarms for later
analysis!
Presents
instructions for
each alarm

Alarm Summary
Asset Model shows alarm counts per ‘asset’

in the hierarchy

Alarm Summary Filtering
Filter alarm display based on

‘asset’ selected

Repeated Alarm Handling
Initial time
the alarm
was raised
Most recent time the

alarm was raised
Number of
times the
alarm has
occurred

Summary
• Considerable progress has been made in Alarm

Management, particularly since the publication of
the EEMUA 191 guidance.
• Safety Regulators and Insurers are also giving
added momentum throughout the world.
• But much remains to be done, particularly in the
area of “alarm floods”.
• The use of an Asset Model and associated work
processes gives a promising way forward.
• Operator Graphics vary enormously in
effectiveness. Good graphics give real benefits.
• The ASM Consortium has it’s own guidance in both
areas – being applied extensively in Experion PKS.

Contact Information
peter.andow@honeywell.com
www.honeywell.com

Alarm Management and Operator Graphics: Peter Andow Honeywell Process Solutions

Uploaded by

Copyright:

Available Formats

Alarm Management and Operator Graphics: Peter Andow Honeywell Process Solutions

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Alarm Management and Operator Graphics: Peter Andow Honeywell Process Solutions

Uploaded by

Copyright:

Available Formats

Alarm Management and

Institution of Chemical Engineers

2 © 2005 HONEYWELL PROCESS SOLUTIONS Alarm Man Op Graphics

3 © 2005 HONEYWELL PROCESS SOLUTIONS Alarm Man Op Graphics

4 © 2005 HONEYWELL PROCESS SOLUTIONS Alarm Man Op Graphics

Customer Driven Solution Drives 3-8% Additional Capacity

No plant-wide philosophy Minor operating Documentation

Some alarms When nothing is

6 © 2005 HONEYWELL PROCESS SOLUTIONS Alarm Man Op Graphics

7 © 2005 HONEYWELL PROCESS SOLUTIONS Alarm Man Op Graphics

8 © 2005 HONEYWELL PROCESS SOLUTIONS Alarm Man Op Graphics

The ASMC is very

9 © 2005 HONEYWELL PROCESS SOLUTIONS Alarm Man Op Graphics

• A huge step forward!

• EEMUA also calls for other improvements which are

10 © 2005 HONEYWELL PROCESS SOLUTIONS Alarm Man Op Graphics

Problem Type Solution Approach Target

Background alarms Alarm rationalisation (just < 10 per hour

Alarm floods Full alarm rationalisation. < 10 in first 10

11 © 2005 HONEYWELL PROCESS SOLUTIONS Alarm Man Op Graphics

• Average alarm rates (the “background” rate) have improved

ASM is a registered US trademark of Honeywell Inc.

13 © 2005 HONEYWELL PROCESS SOLUTIONS Alarm Man Op Graphics

14 © 2005 HONEYWELL PROCESS SOLUTIONS Alarm Man Op Graphics

Alarm floods Full alarm rationalisation. < 10 in first 10

15 © 2005 HONEYWELL PROCESS SOLUTIONS Alarm Man Op Graphics

• As noted in the EEMUA Guide:

16 © 2005 HONEYWELL PROCESS SOLUTIONS Alarm Man Op Graphics

• If an alarm system is considered as a safety-related

17 © 2005 HONEYWELL PROCESS SOLUTIONS Alarm Man Op Graphics

… generally reinforces the generic

• “It should be noted that a risk reduction of up to a

19 © 2005 HONEYWELL PROCESS SOLUTIONS Alarm Man Op Graphics

• An alarm system can be used as a method of risk

• Some plants seem to be unaware of the IEC

20 © 2005 HONEYWELL PROCESS SOLUTIONS Alarm Man Op Graphics

21 © 2005 HONEYWELL PROCESS SOLUTIONS Alarm Man Op Graphics

• So … some incidents have raised awareness and

• Need for effective tools (not just analysis tools) and

22 © 2005 HONEYWELL PROCESS SOLUTIONS Alarm Man Op Graphics

• Operating within safe operating boundaries is key to

Design PVHI Alarm Limit

24 © 2005 HONEYWELL PROCESS SOLUTIONS Alarm Man Op Graphics

PVHH Alarm Limit

• Consistent reference point based on facts,

• What is the Enterprise Model? Precipitation

- Allows organization of Experion platform to Thickeners

- Will become the basis for other models/views Thickener2

- Existing area-based mechanisms enhanced to Cyclone

Map Constraints To Tags

27 © 2005 HONEYWELL PROCESS SOLUTIONS Alarm Man Op Graphics

Applications use boundaries

28 © 2005 HONEYWELL PROCESS SOLUTIONS Alarm Man Op Graphics

• ACM Information exposed:

29 © 2005 HONEYWELL PROCESS SOLUTIONS Alarm Man Op Graphics

Operating limits used by Standard Low

30 © 2005 HONEYWELL PROCESS SOLUTIONS Alarm Man Op Graphics

31 © 2005 HONEYWELL PROCESS SOLUTIONS Alarm Man Op Graphics

PC105 PI115 FI204