EXPERIMENT 03 / ALARMS & OPERATIONS
Dozens of alarms.
One cause.
A cooling water pump trips on a fictional process unit. Within minutes the alarm list fills up. Find the alarm that matters, then see how a better-designed alarm system changes the same upset.
OPERATOR CHALLENGE
You are the console operator.
At 60 seconds something on the unit trips. Alarms will arrive faster than you can read them. Select an alarm to see what you can do about it. Each action keeps you busy for 20 seconds. Keep the unit running: the safety system shuts it down at 380 kPa.
Alarm system: as found, with no priorities, delays or suppression.
Off by default. The horn sounds until every alarm is acknowledged. As found, every alarm sounds the same; with priorities, each priority has its own tone.
| Priority | Alarm | Since |
|---|
DEBRIEF
ALARM DESIGN
Same upset. A better alarm system.
The process and its measurements are identical in every case. Only what the alarm system presents to the operator changes.
| Measure | As found | All three changes |
|---|---|---|
| Alarms in the 10 minutes after the upset | 41 · flood | 5 |
| Chattering alarms | 3 | 0 |
| Consequential alarms suppressed | 0 | 7 |
| Root-cause alarm position at 2 minutes | 7 of 7 | 1 of 1 |
The as-found list at 2 minutes
- HighVessel temperature highsince 118 s
- HighReflux drum level lowsince 97 s
- HighReflux flow lowsince 93 s
- HighCooler outlet temperature highsince 68 s
- HighCooling water return temperature highsince 65 s
- HighCooling water flow lowsince 63 s
- HighCooling water pump trippedsince 60 s
The cooling water pump tripped at 60 seconds. In the as-found list, its alarm is the oldest, so it sits at the bottom.
Static comparison shown. The operator challenge needs JavaScript.
MODEL & BOUNDARIES
An alarm is a request for action.
The unit is invented: a heated vessel cooled by a water circuit, with a reflux drum and a product analyzer. At 60 seconds the cooling water pump trips. Heat builds in the vessel, pressure rises, and 13 alarm points respond to the process and to each other. A fictional safety system shuts the unit down at 380 kPa. The standby pump delivers flow 10 seconds after you start it, and every action occupies the operator for 20 seconds.
Measurement noise is fixed by a seed, so the same choices always give the same result, and changing the alarm design never changes the process: only what the operator is shown.
Where the ideas come from
The vocabulary and the three design changes follow published guidance: ANSI/ISA-18.2, Management of Alarm Systems for the Process Industries, and EEMUA 191, Alarm Systems: A Guide to Design, Management and Procurement. Both treat more than about 10 alarms in 10 minutes for one operator as a flood. Counting an alarm as chattering when it is presented three or more times within a minute is a common rule of thumb.
What this exercise can establish
It shows why an alarm flood hides the cause of an upset, and how priorities, on-delays, deadbands and suppression of consequential alarms change what an operator sees. It is not an alarm philosophy, a rationalization method or guidance for any facility. Every tag, limit, delay and priority is invented for this page and does not reflect any employer's systems or practices.
Terms used on this page
- Alarm flood
- More alarms than one operator can read and act on, commonly more than about ten in ten minutes, so the important ones are lost in the rest.
- Chattering alarm
- An alarm that repeatedly raises and clears in a short time, usually because a measurement hovers around its limit.
- Alarm suppression
- Hiding an alarm from the operator while a related condition makes it redundant, such as the consequences of an equipment trip already alarmed.
- Deadband
- The margin a measurement must move back past its limit before an alarm clears, so small fluctuations do not toggle it.