Adroitly Manage Alarms

Every process plant of any significant size has an alarm system. At most sites, operators routinely work with control systems that have several thousand configured alarms and many plants have far too many alarm activations. A 1994 accident at Milford Haven in the U. K. stemmed in part from a poorly functioning alarm system [1]. It drew attention to the alarms problem. A survey of 13 plants commissioned by the U. K.’s Health and Safety Executive (HSE) showed that alarm systems in many plants performed poorly [2]. In response to the problem, the Engineering Equipment & Materials Users’ Association (EEMUA), London, issued its Publication 191 "Alarm Systems — A Guide to Design, Management and Procurement" in 1999. (The second edition came out in 2007 [3].) That guidance has had a tremendous impact. Various authors, e.g., those of Refs. 5 and 6, have described the range of problems encountered and means for improvement. Considerable progress has been made. A particular focus has been on the alarm rate targets suggested by EEMUA (Table 1).

The Abnormal Situation Management (ASM) Consortium [4] ran a benchmarking study to measure what had been achieved. Based on a sample of 37 consoles from plants operated by ASM Consortium members, the study showed that most of the sites averaged fewer than two alarms per 10 minutes — a considerably lower level than that found on many plants in the past. The study also showed that 13 sites had achieved an average of less than one alarm per 10 minutes. Progress towards the upset metric hasn’t been as satisfactory. Indeed, a summary paper [7] on the ASM study noted:

Alarm Targets

Table 1. The guidelines in EEMUA Publication No. 191 underscore the need for fewer but more informative alarms.

"However, the EEMUA recommendation for peak alarm rates following a major plant upset (i.e., not more than ten alarms in the first ten minutes) appears to be a challenge, given today's practices and technology. Only two of the 37 consoles came close to achieving the alarm rate guideline for upset conditions. This suggests that to achieve alarm system guidelines for upset conditions, more advanced site practices and alarm-handling technology (e.g., dynamic or mode-based alarming) are required."

Achieving further improvement
Many plants have primarily relied on rationalization of a relatively small number of bad actors (often just the "top 10" or "top 20") — this certainly can yield good performance improvements. But rationalization of bad actors usually doesn't significantly impact subsequent alarms floods because a large number of different alarms are likely to occur and those alarms usually won't have been the bad actors activated during routine plant operations. For the many sites that have already successfully completed a bad actors project (based on a coherent alarm philosophy) and that require further improvement, ways forward include:

1. Full rationalization of alarms (i.e., not just bad actors);
2. Use of a Master Alarm Database (MAD) to facilitate control and management of changes to the alarm configuration parameters;
3. Improvements to the Human Machine Interface (HMI), such as better graphics design for alarm management and easy access to alarm help;
4. Mode-based alarming;
5. Testing of alarms; and
6. Alarm suppression technology.

Let's now consider these separately, with the understanding that some may not apply everywhere.

1. Full rationalization. A considerable effort is required to rationalize all of the alarms configured for a particular plant area. The number of alarms that can be rationalized by an experienced team is often quoted at around 100 per day.

The benefits of full rationalization are that alarms activated during incidents are better designed and, thus, less likely to contribute to unnecessary alarm floods. One aspect of rationalization that deserves special attention is the use of appropriate dead-bands and debounce timers (when alarms are activated or cleared). An ASM Consortium project confirmed that more extensive use of debounce timers can be particularly effective when some alarms otherwise would chatter during alarm floods [8]. The ASM study found that the use of debounce timers and other configuration changes reduced the 10-min. alarm rate by 45% to around 90%. However, many plants don’t use this functionality very extensively even when it’s readily available on the distributed control system (DCS) and known to be effective.