The JOURNAL

• Nuisance alarms. When alarms are functioning well, they perform three important tasks:
  1. Alerting the operator that a change has occurred.
  2. Informing the operator of the nature of the change.
  3. Guiding the operator to take the correct action.

  Without a disciplined alarm management program, the process alarms in a plant become less functional over time. The number of nuisance alarms increases to a point at which the alarms distract the operator from the plant, rather than doing what they're designed to do.

• Alarm Proliferation. Alarm management has existed as long as there have been alarm systems, but it has become more important because alarms now are created or changed by configuring a setting in a computer, rather than requiring a hard-wired signal to a panel.

As a result, more alarms could be configured for lower cost. This meant safer operations, but it also relaxed the engineering controls on the creation of alarms. Since there was no cost to implement an alarm, no incentive existed to limit the number of alarms. Naturally, some of the alarms that were configured were unnecessary, or were set at the wrong value. This leads to nuisance alarms — alarms that don't tell the operator anything he didn't already know, or which require no action.

Since the 1970s, more and more process units have been centralized under the control of fewer panel operators, so each operator has become responsible for more alarms. In addition, the number of alarms that can be configured on a single measurement has ballooned. Alarms now are commonly set on Low, High, Low-Low, High-High, Deviation, bad value and sometimes other values.

An operator now is confronted with tens of thousands of configured alarms within his area of the plant. During upsets, hundreds or thousands of these alarms can occur in a very short period.

In addition, organizations such as the Occupational Safety and Health Administration (OSHA) and U.S. Environmental Protection Agency (EPA) or voluntary programs such as Responsible Care, ISO-9000 and ISO-14000 require periodic process hazard analyses or process assessments. These all result in the creation of additional alarms.

When too many alarms go off during an upset, they distract the operator and conceal the actual nature of secondary problems, instead of alerting the operator to real problems.

So, in the absence of an alarm management program, manufacturing plants become less safe rather than safer, incidents become worse rather than better, and production losses increase.

• Operator training on how to respond to alarms.
• Reducing the number of systems that can generate alarms.
• Documenting the steps to be taken when an alarm occurs.
• Operator assistance in finding information about an alarm.
• Standardizing and enforcing the criteria for determining alarm priority.
• Risk-based evaluation of all alarms to reconfigure or eliminate unnecessary alarms.
• Identifying and eliminating nuisance alarms, using alarm history.
• Alarm enforcement.
• Alarm change management.
• Automatic alarm suppression.
• Defining different alarm limits for different operating conditions or modes.
• Replacing "early-warning" alarms with continuous monitoring.

• Do I need to know how many alarms I get in a day, how often alarm floods occur, or which tags are causing the most problems?
• When I walk into the control room on a quiet day, do more than 10 to 15 alarms show up on the alarm summary screen for a single operating area?
• Are there more than two systems that generate alarms, for example, DCS and a single additional emergency system panel?
• When there is an upset,
  • Does the alarm annunciator continuously sound?
  • Does one operator continuously lean on the alarm silencer button?
• Is the alarm annunciator disconnected?
• Have there been any operating incidents in which the operator missed an alarm that did occur?
• Do more than 1,000 alarms occur in a given operating area in a day?
• Do operators change alarm limits?
• Do operators use alarms to inform them of noncritical changes in the plant, such as end-of-batch?
• Are there alarms to which operators don't know how to respond?
• Does any operator lack understanding about why each alarm is the priority it is?

If the answer to more than one of these questions is "I don't know" or "yes", then your alarm management system needs at least an assessment, and probably improvement.

• Continuous monitoring detects disturbances to which the operator must respond to assist the automatic control system regulate the plant.
• Process control system alarms alert the operator to significant upsets that must be corrected.
• Safety system alarms indicate the onset of critical events that require fast, sometimes radical action, such as shutting down the plant.

A properly applied alarm management program ensures that the alarms are:

• Properly configured and enforced, so they're set at the correct operating conditions.
• Understood by the operator, and are therefore effective.
• Practical, so the operator has enough time to respond to the alarms before a significant loss occurs.

1. Continuous improvement of normal operations.
2. A new alarm management program.

Both approaches start with an assessment. The Alarm Management Assessment (AMA) is an evaluation of your current operation by trained, experienced personnel who examine all aspects of your existing alarm management systems. The AMA evaluates your exposure to risk, and provides you with a grade in each of the different areas of alarm management, as well as an overall grade for your plant. Depending on the grade, the AMA recommends one of two different courses in each area.

The areas of alarm management evaluation are:

• Alarm Definition — the existing procedures for defining and configuring alarms, alarm settings and priorities; the documentation of alarms and alarm-related procedures.
• Management of Change — the effectiveness of the plant organization in maintaining the alarm settings once defined, and in ensuring that alarm settings are updated when equipment, procedures and plant operating parameters change.
• Operator Readiness — the current state of operator training in response to alarms, and the systems in place to ensure operators are trained, qualified and able to respond to alarms.
• Alarm System Effectiveness — the actual performance of the alarm system during normal operation and upsets; the frequency of nuisance alarms and alarm floods; the availability of the alarm documentation as and when needed; and the effectiveness of the alarm system during significant operating incidents.

If the existing practice in an area receives a grade of A or B, then no urgent need for improvement exists. You may need some management systems to ensure that performance is maintained or continuously improves over time; however, large amounts of effort are unnecessary in that area.

If the existing practice receives a grade of C or lower, then an organizational need to improve in that area exists, as described in the following sections.

Continuous Improvement. If all is well, or if you have other organizational priorities, you can apply a continuous improvement philosophy. You can greatly reduce nuisance alarms during normal operation by using this method. However, this approach is only effective at improving and maintaining an already well-managed alarm system.

1. Collect data. Collect alarm history for at least one month, including all alarms for all consoles along with all operator actions. This data will provide both an original benchmark and the basis for alarm analysis.
2. Analyze. Most nuisance alarm occurrences are caused by a surprisingly small number of actual configured alarms. The initial alarm analysis will quickly identify alarms that need reconfiguring. It also will provide insight into the severity of the problem.
3. Benchmark. Analyze the alarm history to determine whether the rate of occurrence is within the EEMUA guidelines for standing alarms and alarm occurrences per shift, and for alarm bursts. Analyze alarms area by area because some operating units or areas are more prone to alarms than others. Using the alarm history, measure the original performance as a benchmark for comparison to show improvement in nuisance alarms over time.
4. Spend one or two days per month doing alarm management. As more alarm history is collected, a senior operator and an engineer should spend a day or two each month to find the worst nuisance alarms and reconfigure them in the HMI.
5. Measure. Confirm that improvements are being maintained. The monthly alarm occurrence statistics will show the frequency of alarms and the number of standing alarms decreasing over time. This can be powerful evidence of an effective alarm management program.

An Alarm Management Program for the Future. This approach is similar to the Six Sigma program: First the problem and objective are defined, then the current state is measured and analyzed, action is taken to improve the situation, and finally the situation is automatically monitored to control or sustain improvement.

This approach helps to produce a self-sustaining alarm management competency within the organization, and to bring the initial benefits of alarm management as quickly as possible:

1. Create an alarm philosophy. Define the purpose of each type of alarm or message that is issued by an automated system. Specify the criteria for each priority, for hardware alarms and for when an alarm is needed at all. Best practices in this area include integrated risk measures and addressing human factors and cognitive limitations of human operators.
   
   Define other alarm management policies, such as business rules governing alarm changes, inhibiting or suppressing of alarms, expectations of operators, and so on. This step produces a document that clearly defines the objectives of the alarm system and ground rules for its implementation.
2. Benchmark alarm performance. Assess the actual current state. This provides useful data for the following analyses, and also provides a benchmark of the original state of the organization. Capture HMI alarms and events, track changes and display original engineered values compared to what is on the HMI/PLC with master alarm database provided by solutions such as the Matrikon Alarm Manager from Matrikon, Inc., a participating Encompass™ Product Partner in the Rockwell Automation PartnerNetwork™.
3. Decide which areas require rationalization. Alarm rationalization, or alarm objectives analysis (AOA), is a procedure in which each alarm is examined to ensure it conforms to the alarm philosophy. During this process, many alarms are eliminated, others have their priorities changed, and still others have their trip points altered. The process can be time-consuming, so it's best to start in those parts of the plant that have the worst problems with alarms.
4. Implement an alarm configuration system. After choosing a starting point, implement a database to collect, retain, control and present the information collected during the AOA process. This database will form both the change management system and the online operator assistance.
5. Commit resources. This team will need to work together for several weeks, so free them of most of their other responsibilities for the duration of the analysis. Form a team consisting of:
   • A facilitator, familiar with the AOA process and with alarm analysis. At least one area operator, preferably two.
   • The area process engineer.
   • The area production supervisor.
   • An area instrumentation technician.
6. Conduct AOA meetings. Use analysis reports as evidence of problems or situations. Review the configured alarms and answer several questions about actual alarm occurrence and the purpose for the alarm. For example:
   • Possible causes for the alarm, whether legitimate (providing information), spurious (misleading or nuisance) or redundant (telling the operator something he already knows).
   • The procedure to identify the cause and thus validate the alarm.
   • The procedure to mitigate the different causes.
   • The time frame in which the operator has to respond, before an undesirable consequence occurs.
   • The follow-up action required to verify that the procedure was effective.
   • The historical frequency at which the alarm occurred, and how many occurrences were spurious or redundant.
   • The final alarm trip point and priority.
   During the AOA process, also consider alarms that don't exist, but should.
7. Reconfigure HMI. Implement the changes from an AOA carefully; don't do it piecemeal. An AOA results in an alarm system that is designed to alert, inform and guide the operator. The set of alarm configurations work together to define the boundaries of normal operation — if AOA configurations are made piecemeal, some alarms may be removed before alarms intended to replace them have been configured. In that case, the plant will be less safe.
   
   It's also important to introduce continuous monitoring applications identified during the AOA. Continuous monitoring applications, such as multivariate trends, and provide the operator with improved visibility into the process without having to rely on alarms as the operator's "eyes and ears."
   
   Much of the barrage of alarms during upsets is a result of the misuse of alarms to alert the operator that an expected event has occurred. Continuous monitoring restores the alarms to their original function of identifying unexpected events that require a response.
8. Address human factors. Examine factors such as design of the operator interface in the HMI to the number of independent systems that emit alarms, the audible alarm itself and when (and whether) it can be silenced.
9. Continue to measure and sustain alarm system effectiveness.

For more information about alarm management and Matrikon Inc. and its Rockwell Automation FactoryTalk-compatible products, visit www.rockwellautomation.com/go/p-matrikon.