Emerson Exchange 365

Even after more than two decades of improvements in software tools and systems design, alarms are still a major concern for the oil and gas industry. “The sheer scale of the problem is daunting,” says Neil Brown of Profimation, who presented an informative overview of alarm management this week at the 2014 Emerson Global Users Exchange in Stuttgart, Germany. “This is particularly true for upstream hydrocarbon production facilities where it is common for large installations to have 20,000 or more tags supporting 65,000 alarms, of which 25,000 are enabled.”

“Compliance with the ANSI/ISA 18.2 alarm management standard has become all but mandatory, so how can process managers hope to address the alarm dilemma without investing enormous amounts of time and resources? Obviously, reviewing many thousands of alarms one by one is beyond the capability of most organizations—and beyond the tolerance of most humans.”

As systems have become more reliable with modern control and maintenance techniques, human factors are increasingly found to be at the root of industrial accidents. Brown listed five major oil and gas disasters since 1994 that were ultimately attributed to human error, not counting the hundreds of “near misses” that have occurred over the last 20 years. “Humans have become the weakest link,” he said. “But at the same time, only humans can improvise and cope with unexpected situations. As engineers, our designs must exploit these strengths while mitigating human weaknesses.”

The probability of a successful response to an alarm falls exponentially as the number of alarms per minute increases, until it reaches a point when the operator is completely overwhelmed. The real danger, therefore, is not the operator missing an alarm or failing to respond in time—it's cognitive overload, Brown says. This can lead to “tunnel vision” and “scenario fulfillment” where the inevitable cascade of events results in catastrophic human failure. After some point, adding more alarms becomes self-defeating, and it is actually often necessary to remove some alarms to ensure the effectiveness of those that remain.

The process of identifying and removing these ineffective alarms is called alarm rationalization. “It is not a complex task, just a difficult one,” Brown said. “Many alarms are similar and can be grouped together by nature and urgency of operator response or consequences of a failed response. These groups are called 'alarm typicals.'” Examples of process alarm typicals include major and minor shutdown pre-alarms, valve fail-to-close, motor fail-to-start, and shutdown 'cause' alarms. Fire and gas and system alarm typicals include confirmed fire, extinguisher released, safety shower activated, etc.

“Some typicals can be relegated to 'event' status or removed altogether, depending on their priority and need for action,” Brown explained. “Alarms should only be assigned to things the operator can do something about. Try to resist 'priority inflation,' wherever possible. 50 or fewer typicals can cover up to 99 percent of all alarms using this method of rationalization. The rest can be reviewed one-by-one or in small groups. This can help achieve consistency, simplify documentation, and provide good guidance for future additions and modifications.”

Once alarms are grouped into typicals, operators can use Emerson Process Management's DeltaVTM process automation system to optimize basic alarm performance by selecting appropriate setpoints, deadbands, and on-off delay timers. Setpoints can present a dilemma of their own: Setting an alarm too close to the normal process value can result in repeating or stale alarms; setting it too close to the trip limit can leave little or no time for the operator to react. Deadbands can be effective in reducing repeating alarms, but they too must be selected carefully. Brown said ANSI/ISA 18.2 can provide useful guidance in setting deadbands and on-off delay timers.

Dynamic alarm suppression is another one of the enhanced alarm facilities available in DeltaV. This feature can automatically turn off alarms on equipment that is not operating (state-based suppression), or in instances when an alarm would sound as an inevitable consequence of some other event (consequential suppression). These functions can be extremely useful in making sure higher priority alarms do not get “lost in the mix.”

According to Brown, implementing alarm rationalization and optimization on a large offshore platform can typically reduce the average alarm rate from 6-7 alarms per operator per 10-minute period down to 1-2. The peak alarm rate can drop dramatically from 1,500 or more down to less than 100, and the number of stale alarms can be cut from 1,000 or more down to less than 100. “Again, the principals here are straightforward, but putting them into practice can be difficult,” he concluded. “But with good technology, an effective methodology and lots of hard work, the challenge of streamlining any large and complex alarm system can definitely be overcome.”