Streamline your manufacturing processes with pipeline scada alarm management for manufacturing

How to create outlook signature

well good day everybody my name is Peter Clark from xericon and this is me offering you a very warm welcome to our latest webinar and our ongoing monthly series of webinars on topics related to um process safety and process hazards analysis today's webinar topic is on alarm management and the idea is today that I'm going to go through a kind of start from nothing assuming no prior knowledge overview of the concepts of alarm management so this is going to be a helicopter view I'm not going to go into great detail about any of the individual aspects of what alarm management entails or how to implement it but it's just meant to kind of wet your appetite and give you some awareness and understanding maybe if you've heard the term before but you've never actually encountered it for yourself in your own workplace then this could be your your opportunity hopefully this will be helpful for you a quick introduction to myself my name is Peter Clark and I've run a small process safety consulting firm called ixaricon and I'm based in Taiwan uh the company Nick saricon provides facilitators for hazard and Sil studies for alarm management studies we also do desktop work such as RAM study we do everything to do relating to functional safety we also have quite a big Pro a portfolio of training courses available and there is also our sill verification software called syllability that is available for license so if you're interested in any of those things please feel free to get in touch either through the website or by dropping me an email and my email address will be at the end of this presentation so first of all why do we even care about process safe about alarm management um so um the reason that Industries started paying attention to alarm management was as a result of several incidents some of which were very serious um in the that occurred in the industry and one of the most famous that occurred was the um the Milford Haven Refinery fire in 1994. the background to it was that this was an operating refinery in Wales um there was a lightning strike on the CDU which caused the CDU to shut down and um as a result of that a whole Cascade of upset conditions occurred which caused a massive number of alarms to come in The Operators workstation the alarms were numbered in the hundreds or thousands and this Cascade of alarms was completely beyond the capacity of the operator to analyze and respond to them and it went on for five hours during which time The Operators were unable to get any kind of sense of what was really happening on the plant and how to bring everything back under control um as a result they made some decisions which in retrospect were not the correct decisions to make um and that resulted in a liquid carryover to a flare knockout drum which was corroded and as a result of that there was a loss of containment release of hydrocarbon and an explosion leading to multiple weeks of downtime luckily there were no fatalities that is at least partly because it happened on a Sunday when there were relatively few people on site had it been on a weekday there would certainly have been fatalities but there were quite a number of injuries occurred in that incident so that was one of the kind of most famous cases where um a problem with the alarm system was badly set up alarm system directly contributed to the operator's inability to bring an incident under control and I have been multiple other incidents um throughout the recent history of the chemical industry also you may have heard of The Three Mile Island incident um in I believe it's 1979 which was a a nuclear plant in the U.S um where um there was a serious incident that fortunately also didn't lead to any fatalities um and that was also contributed to by problems with alarms and I I could give several other examples as well but I think one is enough just to get a feel for why this is an important issue so what are we actually trying to do then with alarm management um what we're trying to do is to look at the alarms that are configured in the system and to make a decision about whether each alarm really needs to be there and whether it's actually serving a useful purpose so in the alarm management process we are trying to make sure that every alarm has a defined purpose we're trying to make sure that each alarm can guide the operator to take an appropriate corrective action so in other words it actually helps him to understand what's really going on what is the root cause of the situation that he's facing we also need to make sure that the rate at which alarms are presented to the operator is within the operator's capability to process them and the usual guidance is that it shouldn't exceed something in the range of five uh around five alarms per 10 minutes presented to the operator if you have more than one operator you can multiply that number up but that's the the basic guidance for how long it should really take an operator to properly interpret an alarm and decide what corrective action needs to be taken and then to confirm that the corrective action has actually dealt with the underlying problem and we're also trying to make sure that those alarm floods like the situation that happened at Milford Haven are as unlikely as possible to occur we can never say never but there's a lot that we can do to reduce the risk of alarm floods because once the alarm system is in flood the operator really has very little chance of coping with the situation because he's just dealing with a red screen and with a with a siren going off all the time it's very hard for him to mentally stand back from all of that kind of intrusion into his mental space and really try and focus in on what's Happening and the other thing we need to do is minimize what we call bad actor alarms and these are alarms that are coming to the operator but are not helping him maybe because there's nothing he can do um or maybe because the alarm is not really necessary or maybe because the alarm is always on is always there and he knows that it's just a nuisance and there's nothing he is supposed to do so overall um what we're trying to do is to make sure that the alarm system can actually provide its function of risk reduction or to put it another way that it actually functions as a layer of protection as you may know if you've got experience of doing hazop studies or sill assessments you know that very often we take credit for alarms with operator response as a way of reducing the likelihood of an initiating cause an initiating event propagating through to a serious incident and we can only be confident that the alarms can really provide that kind of risk reduction if we're sure that the system is well set up in other words that the operator has actually got the ability to respond to the alarms that he knows in other words enough time and the operate and the alarms actually help him to understand what's going on that he's not going to be overwhelmed with too many alarms or useless alarms and that he actually has confidence that the alarm system is is basically doing what it's um what it's supposed to do and not just providing kind of new and irritating noise in the background and covering the screen with um messages that he doesn't know what they mean or he doesn't know how to respond to them so in order to help us on our alarm management Journey there are some standards and guidelines that are typically applied across the industry and these days in my experience it seems like the most commonly Applied Standard is ISA 18.2 this this standard covers the whole of the alarm management life cycle and in particular it provides a lot of detail about what should be in a document called The Alarm philosophy document which we'll talk about a little bit more in a moment and it also provides some quite clear guidance about what we call kpis which are key performance indicators and these are measures numerical measures of how well the alarm system is performing in terms of something that we can measure to see if it really can be credited as a layer of protection there is another um so Isa is from the uh as from the American Body called the ISA um there is also an international standard called IEC 62682 um which is pretty similar to the ISA standard but in practice I don't find it actually applied for that often there is a guideline called emu r191 which comes from a uk-based organization called emua um and um it's important to remember that this is a guideline and not a standard so it's not really possible to audit against it and it's not intended for that purpose it tends to offer multiple options for anything that you want to do so it's not prescriptive it doesn't really tell you what to do it just gives you sort of ideas and examples it's a very substantial document um and if you are thinking about getting into alarm management then it certainly is useful to have an awareness of what it offers but it's not going to give you clear Direction about exactly what uh what to do and how to make your decisions then another document that I find frequently applied in the industry is the um shell dep on alarm management dep is a design and Engineering practice and this is a very detailed document I find it really quite widely applied especially in Southeast Asia it's quite prescriptive and it also takes a somewhat different approach from Isa 18.2 and IEC 62682 in certain regards um so um you can it certainly apply it and it's a valid document but my word of caution is do not attempt to apply more than one of these standards at the same time quite often I go into alarm management projects and the client I say which standard do you want to follow and they say all of them and I say no you can't they are not mutually compatible and there's no reason to follow more than one because each one of them provides sufficient except for the Emu 191 each of them provides sufficient guidance for the complete life cycle and you don't need it's not helpful to attempt to apply more than one mutually incompatible standard so I mentioned briefly in passing there something called The Alarm management life cycle what is it well you may be familiar with the concept of life cycle from other um areas of process safety and also quality management as well um so um the life cycle um or the so the life cycle is the various steps that you are expected to go through in order to successfully manage your alarm system and so it goes through various steps such as first of all defining what alarms you you need you and you have already if it's an existing system and then you go through a process which is called rationalization which is where you try to assess whether all those alarms are really needed and whether they're properly set up so that they can actually do their job of risk reduction then you may go through various refinement processes where you make changes to the alarm system in order to try to approve compliance with the kpis that you set for yourself and then you run the system for a while and then you measure you the system's performance and um you need to keep on cycling round so it's not enough just to do it once and then walk away because um like everything in the field of process safety there's always a drift away from the ideal or the as designed configuration alarms get changed process conditions gradually change operating expectations gradually changing so the alarms also need to change from time to time as well so we Define something called The Alarm philosophy which sets out what the phases in the life cycle is that's point one on this slide it also needs to Define roles and responsibilities for looking after the alarm system um and one of those roles and responsibilities is what we usually Call The Alarm Champion so the thing is with alarm management is it's it's an interdisciplinary um aspect it's not wholly the responsibility of for example the process Engineers project Engineers instrument Inc Engineers safety it doesn't really belong in any of those camps so that means that you need to get um different disciplines to work together to achieve it and unless you have one person whose job it is to basically bang heads together and say come on guys we've got to keep this moving we need to move on to the next step and don't just let it lapse um then things tend not to happen so that's why it is usual to appoint an alarm champion and that person would typically be some either somebody in operations or somebody in process engineering I think it's quite good if the alarm Champion is a is an operations person because they really see the problems and issues with the alarm system firsthand so your alarm philosophy also should indicate the kpis um that you are going to measure and try to comply with um and then your alarm philosophy will also say um we'll also say how often you're going to review the alarm system performance against those kpis to see what remedial action needs to be taken and there are other things as well that need to go into the philosophy document but that's just to give you an impression of the main aspects that are important so there are philosophy document is really the heart of the alarm management system it should be the go-to document to describe how we're going to do it and what we need to do next and what the goals are it kind of works a bit like a Safety Management plan but specifically focused on the alarm system and it needs to be compliant with the standards so whichever standard you're trying to apply and as I mentioned before if you are applying Isa 18.2 that has quite a lot of specific requirements for the alarm philosophy document and one thing I would like to emphasize is the APD alarm philosophy document is not a procedure so on top of that you may also need some procedures for certain aspects of the alarm management lifestyle life cycle in particular the alarm rationalization activity so philosophy is meant to be kind of a higher level where it's just providing overall guidance and Direction setting for the alarm management in the yellow box at the bottom of this slide you can see what the minimum requirements are for the APD which would include the things that I just mentioned a moment ago all the things about life cycle management kpis and assessment of the alarm system performance it also needs to set out the methodology that you're going to use for alarm rationalization or if you prefer to keep that as a separate document which is actually not a bad idea then it needs to refer to and state which document it is another thing you need to do is to Define alarm priorities so or at least Define the the names of the priorities and how many different priority levels you want to use so as a typical example um three priority levels sometimes they're just called high medium and low or sometimes they're called kind of alert um important and critical or sometimes it's something like um you know urgent and they they use various different names but they all basically mean the same thing the concept is that the higher the priority of an alarm that comes um the sooner the operator is supposed to respond to it so if two alarms come at the same time and one is high priority one is low then he's supposed to set aside the low priority one for the time being until he's dealt with a high priority and it's important that there should also be an alarm priority which does not enunciate um which sometimes is called journal or log and what I mean by enunciate is um sound the Sounder the Hooter and Flash up on the screen so in other words it needs to still exist in the system but it needs to quietly go into a log file or some kind of background list of events or notifications to the operator but it mustn't grab the operator's attention away from what he's actually doing at that time that is pretty important because there will be very often events in the system that you want to be recorded but do not deserve basically telling the operator to stop whatever he's doing and pay attention because they don't require his immediate risk analysis and response okay just uh sorry just gonna fix one little problem okay right and the other thing that the alarm philosophy document that the standards require is to define something called alarm classifications now the purpose of classifications is to Define what type of alarm it is in terms of how usually in terms of how much maintenance how much testing is needed for the alarm in other words how critical it is for a certain purpose so an example of a classification would be a safety critical alarm where maybe it's being used as a credit to mitigate a potentially very serious incident or another example would be an environment critical alarm and this is an alarm that's warning you that you are going off spec in terms of emission limits that might be reportable to an authority and could eventually lead to a final prosecution so those alarms probably would be needed needed to be tested and maintained more frequently than they'll kind of all your regular alarms in the system and so one way of handling them is to create a class or a classification for those alarms um now in practice to be honest I don't see classification used very much um but in principle the standards usually do say that you should have such a thing as alarm classification okay um so the next thing to do is to uh as I said before list out all the alarms you've got in your system and ask the question about each one um is this alarm really doing the job that I need it to do which is to help me run the plant safely without overwhelming the operator with too much information and there are some questions that you should ask about each alarm to make sure that it really needs to be in the system and it needs to be configured so working clockwise around this slide starting from the top from the 12 o'clock position the first thing is that every alarm should attract the attention of the operator so if you've got something that is just a background message or an entry and a log that is not an alarm within the definition of um what this the standards call an alarm so it has to be an audible or visible enunciation the next thing is it needs to be aimed at the operator so if the message that the alarm is given giving is actually aimed at someone else like for example a maintenance Personnel or management or instrument department but it's not aimed or not it does not require attention from the operator then it should not be counted as an alarm and it should not be directed to the operator you shouldn't really use the operator as a conduit to channel information through so for example if you've got an alarm that says you've got a faulty sensor but the operator doesn't immediately need to do anything about that maybe because it's a redundant sensor then that piece of information that notification should be sent to a different workstation and not to the operator's Workstation okay the next thing is that the alarm must indicate that something abnormal has occurred um now quite often when we are asked by clients to start an alarm rationalization process we see that their system is full of alarms that sound just when the process is doing its normal thing so let's say for example you've got a pump which is emptying a sump when the level in the sump starts to get high so sometimes you'll find that there's an alarm when the pump starts and another alarm when the pump stops and that's just correct and normal behavior on the part of the pump but it's generating two alarms for every start Stop Cycle that is not a correct use of alarms alarms should only be used for abnormal situations that require the attention of the operator now sometimes when we bring this fact to the attention of the um the team that's doing alarm rationalization they say their response is oh but the operators like to have those alarms because they like to be informed that the pump is working but once again that's not the purpose of the alarm system it's not there to inform the operator that everything is okay it should only be there to tell the operator that something is not okay and he needs to pay attention to it so in a situation like that where you've got an alarm relating to a sump pump what my recommendation is is don't alarm when the pump starts alarm when the level is high but the pump fails so perhaps your alarm for example for example on a high high level or you alarm on a pump fail to start like a discrepancy between the commanded State and the actual state of the pump for example because that is then telling the operator all right something's wrong I need to intervene and that's what the alarm system should be for for abnormal situations only another thing is that the alarm should only come to the operator if it requires an intervention on the part of the operator if it's only for the operator's general information that is again not correct use of the alarm system you can generate other different kinds of notification to the operator if if you really feel that that's necessary in order to help the operator have situational awareness of what's going on on the plant let's say for example there's a change of feedstock where the system automatically switches over from Source a to Source B and the operator doesn't actually need to do anything he just needs to know that okay I switched from maybe tank a to tank B so just so that he's aware of what's going on and that's that's okay but that's not an alarm you can you can call it something else you can call it an alert or a message but it should not sound the Sounder and it should not distract the operator from responding to actual alarms um the next thing on the bottom left of this slide is the alarm should do whatever it can to guide the operator to understand the underlying problem that he needs to solve and that is a lot of that is down to for example where the alarm is located in terms of what process measurements it actually makes and what the alarm message is is it can he actually understand it you know in older systems DCS systems sometimes you are limited to let's say 16 characters or in two lines of 12 characters each something like that for the alarm message and so they tended to be very cryptic with very kind of abbreviated words and um if you didn't really know what it meant especially if it's an alarm that rarely comes then the operator may not simply be able to understand what it actually means but those days are very short and cryptic alarm messages I think should be gone now in more modern alarm systems um the the alarm system can provide the operator with much more details help and information than that and so you should make use of that information to basically make sure that the alarm that comes guides the operator directly to understand what the underlying problem is the next guideline is that in an ideal situation if one incident occurs it should raise only one alarm now in practice that is difficult to achieve and rarely happens you would often expect multiple alarms to come because you know if you have a low flow for example then it may be related to a low pressure somewhere and it might you might get if it's caused by a pump trip then you might get a pump trip alarm as well or a low motor current alarm or there might be several alarms come simultaneously ideally what you should do is try to arrange the alarm system using techniques that I'll talk about in a few minutes so that you don't get multiple alarms from one situation because extra all those extra alarms they're not really giving the operator any or not much useful additional information what he really needs to see is the most direct alarm that tells him something specific some specific problem has occurred and all of those other kind of resultant alarms that Cascade on from that aren't should not be his direct focus of attention at that time I'm not saying to delete the alarms those alarms are still important but try to make it that they don't grab his attention away in other words they don't enunciate um uh so they're in the system but they don't grab his attention away from dealing with the first alarm and then finally alarms must give the operator enough time to respond as very often the case for example if you look at a low-level alarm let's say in a steam drum of a boiler that the time from the low alarm until when the drum is empty and the tubes can get burned there's maybe only one or two minutes and that's really not enough time for the operator to notice the alarm go to the relevant screen to figure out what's going on make a correct judgment about what the problem really is and then make a correct judgment about what action he should take in response to that and then take the action and that's really a very tall order to expect a response in one or two minutes especially if somebody somebody actually has to go out into the field to take the action then of course one or two minutes is definitely not going to happen so the um often uh companies will set risk owners will set a minimum time limit of 10 minutes for a control room response to an alarm others will say 15 or 20 minutes even 30 in some cases if I even seen 60 Minutes as the minimum response time um so what time you select for your system uh really depends on conditions like you know how many operators you've got um how experienced they are how well set up the alarm system is how complex the process is how familiar The Operators are with the process and whether they need to liaise with field operators in order maybe to diagnose or take a responsive action and all of those will help you to make a decision about what minimum time you should assign to your alarm response if there's not enough time to respond then the alarm may not actually be that useful it may be that all it can do is scare the operator or tell him that something bad is going to happen soon and there's nothing you can do about it which is okay might be useful information for him to have but it's it will be much better to give him a notification that does give him enough time to prevent the the next consequence so once we've determined that maybe all is not well with our alarm system and the alarms do need some um adjustment in order to meet those criteria that I just showed you then go into a process called alarm rationalization well sometimes also you'll hear the term alarm objective analysis and there are some some differences between them but exactly what the definition of one or the other is doesn't seem that clear so I prefer to just stick with the term alarm rationalization because it's very clear about what we mean by that so when we do alarm rationalization it's normally in a workshop we sit down with process guys operations guys instrument guys sometimes with electrical team as well we review all the alarms that are configured in maybe in the whole plant or in a certain plant area to ensure that they meet the criteria that I showed you on the previous slide which were these ones and um if they don't then we make adjustments to try to bring them into um compliance for those criteria and we also will make sure that each alarm has got a defined priority whether that by high medium and low for example and that's normally done by following some kind of rule set that's defined in the procedure and the most typical way of doing that is you have a matrix which shows the severity of what happens next if the operator doesn't respond to the alarm on one app one axis and on the other axis you show how much time is available to respond to the alarm and of course the shorter the time available and the more severe the consequence then the higher the alarm priority needs to be um in alarm rationalization you your team should have the power to propose that alarms can be obviously upgraded to a higher priority if necessary and also downgraded because it's more likely if you're starting out this process that you're getting too many rather than too Few alarms and and so in order to deal with that you are going to have to downgrade some alarms either to lower priorities or even downgrade them to non-enunciating categories such as calling them alert or prompt or journal or message are some of the um the terms that are used in other words then they are there they're the Opera the operator can access them when he needs to there he can call them up on the screen but they don't jump out and grab his attention and they don't sound the the horn other things in the yellow box at the bottom of this screen that you may also cover in alarm rationalization is to review the settings or parameters of the alarm such as the set point and the delay times and another thing that does need to be done at some stage is to define the guidance information that is given to the operator and this can be either on screen when the alarm comes or it can be in a separate alarm response manual which you can have at his fingertips either in hard copy or soft copy or maybe both could have the same information in both and that operator guidance should include information such as if an alarm comes what are the most likely causes of the alarm the root causes and that you can find out from your hazard study hopefully it should also guide about the operator to what are the most likely appropriate corrective actions now that's not to say that he can only take those corrective actions but it's to help to guide him in what is hopefully the right direction for this thinking and also another thing you can provide in the guidance is some suggestions on how the operator can convince himself that the alarm is for real and it's not a spurious alarm now this is potentially important especially if the there is a history of spurious alarms alarms which come either they're meaningless or they're not real or you know they're caused by you know some loose wires that you know when the wind blows an alarm may come even because it's kind of making and breaking some contacts in some loose wires and maybe if especially if you've got an older plant you might find that there are some alarms like that which are not real they're not telling you that there's really a problem in the plant and um so that tends to reduce the confidence of the operator in the alarm system now we mentioned right at the beginning the problem of alarm flooding and the alarm rationalization one of the most important purposes of it is to reduce the risk of alarm floods because we want to avoid being in a situation like at the um the Pembroke Dock refinery um what is an alarm flood well it is a sudden increase in the rate of alarm enunciation which exceeds the operator's capacity to assess and respond to each of those alarms and it it's caused by some kind of incident which is not part of the steady state operation now it doesn't necessarily have to be an unexpected incident it could be something that you expect to happen from time to time let's say for example switching over from compressor a to compressor B now that might be if your alarm system is not well set up that might trigger a whole Cascade of alarms coming from compressor a when you shut it down which might be tens or even hundreds of alarms if this system is really not well set up so that would be a planned incident but what we're usually more worried about is alarm floods arising from unplanned incidents such as a lightning strike so the types of incidents that you can see at the bottom of this slide that we normally should pay into attention to would be equipment trips especially trip of major equipment that is at the heart of the process such as a big compressor power failure that can be either powered to a specific area of the plant or a site by blackout in fact that's probably one of the most common and serious causes of alarm floods um and another one that can also cause an alarm flood is if you have a safety instrumented function or Sif which trips spuriously maybe due to a malfunction of a sensor or maybe because somebody accidentally pressed the manual trip button and that could lead to a large number of alarms um because it will shut down various shutdown Valves and various pieces of equipment it may have quite a lot of um actions taken by this if so there could be a huge number of alarms come from that which are not helpful to the operator and trying to figure out what's what's happening what's gone wrong okay all right so another thing that we mentioned earlier in the talk is bad actor alarms um now let's give a little bit more detail about what Bad actors are and alarm rationalization another of the purposes of it is to cut down as low as possible the number of such bad actor alarms Bad actors are alarms that come which are enunciated but don't help the operator and instead they just cause distraction or confusion and they may be a significant contributor to missed missing your kpi targets um some common examples of Bad actors are for example fleeting alarms a fleeting alarm is an alarm that just comes for a few seconds and then it disappears again and then it comes and then it goes and it comes and it goes um they're very irritating for the operator they can fill up the screen with notifications um and it's obviously a situation that he doesn't need to respond to because um the the whatever the problem is is not there all the time so it may be caused by something like a loose wire as we said before could be a badly tuned alarm um maybe the set point or delay time needs to be adjusted um could be just some completely spurious issue could be caused by some electronic noise some you know radio frequency interference RFI could be multiple causes but fleeting alarms you need to identify them and you need to get rid of them and deal with them another example is a chattering alarm and that's an alarm that um maybe it comes and then you look at the situation you think okay I maybe need to take some action or I don't and then you clear it and then it comes back again and you take some action and you clear it and it keeps coming back over and over and over again um also very distracting consumes a lot of The Operators attention and focus and tends to decrease his level of trust in the alarm system kind of opposite to that is alarms that come and then just remain on the screen for hours and hours or maybe for days and there's nothing the operator can do to clear the alarm so it's there um it's kind of attracting his attention but he can't do anything about it in the short term and an example of that would be some kind of equipment fault alarm like a a sensor fault alarm once the operator has reported it to the maintenance department it might take them some hours or days before they get around to fixing it during that time the alarm is potentially still going to be there and just providing distraction so as much as possible we should get rid of the potential for stale alarms and another very important category is alarms that come frequently so I don't mean quite the same as chattering alarms but alarms that take up more than their fair share of the operator's attention um and uh sometimes that's again because of bad tuning or a bad system design um and yeah we need to get rid of them because the operator needs to be able to give his attention to those um more unusual and more concerning situations um and it's very often the case that when you look at the alarm system log for systems that haven't gone through a recent alarm rationalization you find that maybe the top 20 alarms generate 80 percent of all of the alarms that are raised and I didn't say the top 20 of alarms I said the top 20 number of alarms so you might have 10 000 alarms configured in your system but out of those only few tens of alarms are taking most of the operator's attention and if that is true which it normally is then that's not a good State of Affairs because that shows that those alarms there is something wrong with the design of those alarms and they need to be dealt with so that you would do in your alarm rationalization so why is it so important to be aware of bad actor alarms well as I said before they provide distraction and confusion for the operator um another reason is that um the operator may try to get rid of them if he's allowed to for example disable the alarm then that's exactly what he may do just say oh this alarm is just such a nuisance I'm just going to disable it or block it or override it or sometimes in some systems the operator is allowed to change the set point so what you might find is he changes changes the set point to 9999 or something like that which means that the alarm no longer can perform its original purpose um and that might have been a safety critical purpose so that's important an important problem there because the operator Maybe driven to take an unsafe act which is effectively disabling an alarm or making it useless thereby compromising the Integrity of the alarm system and another problem is that if these irritating and useless alarms are coming to the operator all the time it reduces his level of trust in the alarm system and after a while you find that he's hardly even bothering to look at the alarms anymore every time an alarm comes he just presses acknowledge okay whatever just get rid of it you know it'll just be another nuisance alarm I don't have to pay attention and if you're in that state then it means your alarm system is now worse than useless you might as well switch it all off because it is not providing any kind of risk reduction at all in fact all it's doing is consuming the operator's attention with no benefit so that is the time when you really need to stand back and look at your alarm system and say right it's time for to get an alarm management process up and running now what very often happens when you do your rationalization is you go from maybe you know 50 to 100 alarms per hour down to one or two or five alarms per hour and suddenly the control room is eerily quiet because that Sounder that you expected to be kind of creating all of that background nuisance noise all the time is not there and sometimes the operator gets a bit worried by that because they think is it still working why are there so few alarms coming but this is how it's supposed to be um alarms should be a relatively infrequent event because they should be only four times when the operator needs to pay attention and take a remedial action so um don't uh don't worry about that um now the reason why loss of trust is such an important issue um is because it may mean that the operators lose situational awareness because what they'll do is they'll start trusting what they believe to be the case about the state of the plant and not what the state of the plant actually is because the alarms are trying to tell them about the state of the plant but if they don't trust it anymore because it's just full of nuisance alarms and distractions they won't pay attention they'll they'll pay attention instead to what they think the situation is and they will start disbelieving the instruments and that's what we call a loss of situational awareness now that's a very dangerous situation now because now the operator will take actions based on their gut feeling about what's happening on the plant not what's really happening on the plant um and there have been numerous incidents caused by this both in the process industry and also in the airline industry you very often find if you read the reports of um Airline accidents you'll hear that you know the Black Box recorder in the cockpit records alarms that come to the um to the pilots but they disbelieve it they disbelieve the alarms they disbelieve the instruments because they think no that can't be right that just cannot be right we you know we must be flying level even though they're in a rapid nosedive and the instruments are trying to tell them that but they still believe based on whatever you know their gut feeling that everything is is normal and they're flying level and it's safe so that's the dangerous situation is once the operators don't trust the alarms they lose situational awareness and then you are compromising all of the safety of the plant now one of the most important tools that we have available um to help mitigate especially alarm floods um and nuisance alarms is a set of techniques called Advanced alarming um and these are basically methods to reduce the number of alarms that are presented to the operator and enunciated without compromising the safety of the plant and that depends on them being correctly set up of course so I'll just very briefly mention some of the more common Advanced alarming techniques which are available in most modern DCS systems nowadays this is not all of them all of these um options that are available but these are the most common ones firstly we have static suppression now static suppression basically switches off alarms that relate to out of service equipment so if you've got a pump which is deliberately standing idle because it's a spare pump then there is no need to have a low flow alarm from that pump and there's no need to have a low motor current alarm just to take two examples so those alarms can be automatically suppressed by the system another example another sorry another technique is dynamic suppression now this is the main technique that we use for flood suppression and it says when some particular situation occurs then I know that various other alarms are going to come after that but they're not going to add any value to the operator at that time so for example if you have a trip of some equipment then it's going to lead to a Cascade of alarms coming after that low flow alarms low pressure alarms low current alarms all kinds of things may come after that but they don't provide any additional help to the operator they just fill the screen with red so all of those alarms can be suppressed now the alarms still come and they still get logged in the in the system and the operator can still go to the relevant equipment faceplate and see that those measurements are in alarm condition but it doesn't actually sound the Sounder it doesn't create a pop-up message on the screen in other words it doesn't pull the operator's attention away from the original main incident of the equipment trip that he's trying to deal with so that's a very important technique the next one is first out grouping so if you have a group of similar related alarms you can put them in a group so that when the first one of them comes you will see that alarm but the rest of the alarms will be hidden so let's say for example you've got a fired heater with tubes maybe arranged in let's say four passes of tubes and you've got some let's say low flow sensors on each of the passes now those low flow alarms could be arranged in a group so that if you have a loss of feed to the tubes then whichever one comes first you see that one but the second one and the third one and the fourth one they don't provide any further useful information to the operator once he knows that there's a low flow he's going to start looking you know why have I lost my flow is it an upstream problem is it a downstream problem a blockage and having those other three alarms come and pull his attention away from doing that diagnosis diagnosis um is not is not going to help him so you put them in a group so that only the first one is enunciated and once again the other three alarms they're not deleted it just means that um they don't enunciate but he can go to the relevant faceplate and see that those other low other three flow sensors are in alarm state the next one is called shelving and this is basically a snooze button for each individual alarm so if you if he's got an alarm but he knows maybe it's not urgent and it can be dealt with some hours later um or maybe he has dealt with it but it doesn't clear the alarm because the uh the actual alarm measurement is still in the alarm State then there's nothing more he can do he might as well get the alarm off the screen by shelving it so an example of that might be supposing you've got a high level alarm in a waste tank which is telling the operator that he needs to call for the truck to come and empty the waste tank but maybe it's overnight the truck is not going to come tonight it's going to come tomorrow morning so once he's called for the truck he's done all that he needs to do and there is no need for him to see that alarm anymore so he can shelve it now the purpose of shelving is that after a fixed length of time the alarm will come back again and that's useful just in case you know something got forgotten something got missed and also to make sure that the next shift become aware so of of that situation so usually you set the time on the shelving to 12 hours or to the duration of one shift so that it will come back again during the next shift and the final technique that we often use is called eclipsing now supposing you've got a high alarm and a high high from the same sensor then if you reach the high high then there is no point in showing the high alarm anymore because the operator knows it must be already beyond the high level so or high pressure or temperature whatever it is so the high high is set to eclipse the high alarm which means the high alarm disappears off the screen in that situation okay well we're nearly at the end but one thing I do need to talk about is kpis now I'm not going to go through all of what you see on the screen but these kpis that are shown here key performance indicators are the suggested ones the recommended ones in Isa 18.2 and probably the most important ones are at the top the average alarm rate per operator and the recommendation is 6 to 12 per hour I would think probably near the bottom end of that range would be better six alarms per hour means once every 10 minutes and we've got to bear in mind that the operator is not only responding to alarms he has other duties to do as well other things like how much of the time is the system in flood so because we can never say zero floods we usually set a threshold of let's say not more than one percent of the time in flood um fraction of the total alarm events generated by the top n alarms for example not more than five percent of all alarm uh incidents all notifications generated by the top 10 alarms and various other targets that you can see on the screen there and one important one is to set a target for the number of unauthorized changes to the alarm system because what if you've done your um your rationalization and you've set up the alarm system to be configured um so that it should provide optimal performance in terms of risk reduction but then people come along and mess with the settings arbitrarily then you're going to drift away from that optimal situation that you've tried to design so you need to be aware that the system is being messed with and ask you know well why why are people like operators or instrument technicians feeling the needs to modify these settings especially without if it's done without going through the proper management of change process what's going wrong here and try to resolve that situation foreign well that's all that I want to talk about for today I would like to thank you very much for your attention and I hope that you found it useful and interesting um if there's any further guidance that we can give um on the subject of alarm management we have a lot of experience in-house of doing alarm management projects so please feel free to reach out to us through the email address that you can see on the screen now also please let us know if you have any other process safety related topics that you would like us to do in our ongoing monthly webinar series and finally just a reminder that we have a sill verification software app available called syllability which most people who try it really enjoy it and they find it very comfortable to use as well as very powerful with a flexible licensing plan so we'd be more than happy to give you a trial of that and let you get hands on with it for yourself and finally before I sign off I'd like to invite you to join for our next webinar which is on the 15th of June uh continuing our regular um third Thursday of the month pattern and that will be an introduction to a PHA technique called hazid and I'll look forward to seeing you then so thank you very much for your attention today um look forward to seeing you in future look forward to hearing from you my name is Peter Clark and I'll sign off here thank you very much and goodbye