Hybrid Model-Based Framework for Alarm Anticipation

Hybrid Model-Based Framework for Alarm AnticipationShichao Xu,† Arief Adhitya,† and Rajagopalan Srinivasan*,‡,§

†Institute of Chemical and Engineering Sciences, A*STAR (Agency for Science, Technology and Research), 1 Pesek Road, JurongIsland, Singapore 627833, Singapore‡Department of Chemical and Biomolecular Engineering, National University of Singapore, 4 Engineering Drive 4, Singapore 117576,Singapore

*S Supporting Information

ABSTRACT: Modern chemical plants consist of a number of integrated and interlinked process units. When an abnormalsituation occurs, the automation system alerts the operators through alarms. In this work, we introduce a new type of alarms,known as anticipatory alarms, aimed to enable operators to orient holistically to the abnormal situation. These anticipatoryalarms are developed based on an alarm anticipation algorithm that utilizes dynamic process models to offer an accurate short-term prediction of the process state. In particular, these models predict the rate-of-change of process variables, which are thentranslated into predictions of time horizons for occurrence of various critical alarms. Anticipatory alarms seek to improve thesensemaking facilities offered to the operator through advance warning of impending alarms. As a result, operators can adopt amore proactive approach in managing abnormal situations. The benefits of anticipatory alarms have been demonstrated throughsix fault scenarios in a depropanizer unit case study. All alarms are successfully predicted, providing a diagnosis time benefit ofaround 35 s to the operators.

1. INTRODUCTIONModern chemical plants are complex systems and consist of alarge number of integrated and interdependent process units.To optimize the supervision of operation in these plants,process operators and engineers depend on automation systemsto assist them in (1) extracting key information of the state ofthe plant, which is then used for (2) managing and controllingoperations in real-time. One key constituent of the automationsystem is the alarm system. During an abnormal situation, whena process variable deviates beyond its acceptable limits, analarm is flagged, presented in the alarm summary page of theDistributed Control System (DCS) user interface, on panel-mounted enunciator boards, or as audible bells or sirens. Theprimary function of the alarm system is to direct the operator’sattention toward any plant condition requiring timely assess-ment or action. Hence, when an alarm occurs, operators areexpected to intervene in the process operation (typicallythrough the control system), rectify the cause of the abnormalsituation and bring the plant back to normal operating state. Onthe part of the operators, this requires sensemaking, that is, theactive process of building, refining, questioning, and recoveringsituation awareness.1

Alarms are typically configured in the early stages of theplant’s lifecycle. However, the relative ease of configuring newalarms in modern-day alarm systems often leads to theirproliferation, that is, far too many alarms are configured. Duringan abnormal situation, because of the highly integrated natureof modern chemical plants, these leads to “alarm flood”,wherein more alarms are generated within a short time than canbe physically addressed by the operator (typically 10 alarms per10 min). Alarm floods lead to information overload on the partof the operator thus hampering the recovery steps that he hasto take. A number of real-life incidents offer evidence of thescale of the problem. A simple incident of a compressor trip

was reported to generate a total of 392 alarms within 1.5 h,2

that is, 43 alarms on average every 10 min. An accident at Esso’sLongford Refinery generated 8500 alarms over a 12-h period.3

This flood of one alarm every five seconds was highlighted asthe main contributor to the accident since the operator missedsome important alarms leading up to the accident. Similarstatistics were also reported by Srinivasan and co-workers4,5 fora refinery in Singapore. In Texaco’s Milford Haven Refinery,the operator had to recognize, acknowledge, and act on 275alarms in the last 11 min before an accident occurred. Poorlyprioritized alarms and inadequately designed control displayswere again pointed out as the root cause of the accident.6 As abenchmark, the UK Health & Safety Executive (HSE) classifiedthe number of alarms that an operator can effectively manageinto three levels:7 (1) manageable, one alarm per threeminutes; (2) overdemanding, one alarm per 1.5 min; and (3)unmanageable, one alarm per minute.Once the number of alarms reach an unmanageable level,

they become disorienting and result in delays in takingcorrective measures, which will eventually lead to an emergencyshutdown in the best case or sometimes worse. Somecontributors to poor alarm systems include chattering alarms(where the same alarm is triggered three or more times in aminute), duplicate alarms (where one alarm always followsanother and hence does not provide the operator any additionalinformation), and nuisance alarms (that do not require anyoperator action). The financial implications of poor alarm

Special Issue: David Himmelblau and Gary Powers Memorial

Received: May 10, 2013Revised: January 20, 2014Accepted: January 21, 2014Published: January 21, 2014

Article

pubs.acs.org/IECR

© 2014 American Chemical Society 5182 dx.doi.org/10.1021/ie4014953 | Ind. Eng. Chem. Res. 2014, 53, 5182−5193

pubs.acs.org/IECR

management have been placed variously at three to ten millionpounds per year for a typical oil refinery8 and 10 to 20 billiondollars annually in the U.S. petrochemical industry.7,9

Most of the research in the field of alarm management hassought to develop systematic approaches for rationalization soas to reduce the number of alarms without compromising onthe ability to detect all potential abnormal situations. Anothercomplementary aspect is to enable the operator to quicklyunderstand the alarms in the context of the dynamic processstate. We seek to address this latter issue in this paper. Recenthuman factors studies reveal that, when an abnormal situationoccurs, those operators who are able to predict the evolution ofthe plant state are best able to cope with alarm floods.10

Motivated by this, we propose to provide predictive alarminformation in order to improve operators’ sensemakingfacilities. Therefore, when an abnormal situation occurs, theoperators can quickly orient themselves and therefore wouldhave a longer lead time to identify the root cause and takecorrective actions to bring the plant back to a safe operatingrange. The rest of this article is organized as follows: section 2summarizes the recent developments in alarm management. Insection 2.1, we discuss the role of human factors in alarmsystems. In section 3, we introduce the concept of anticipatoryalarms. The prediction of the future state of the alarm variablesrequires a dynamic model of the process. We propose aframework for developing such models in section 3.1. Section 4illustrates these concepts and their effectiveness using a refinerydepropanizer unit example. The results are then presented insection 5.

2. LITERATURE REVIEWAlarm management has received a lot of attention in recentyears with a number of standards, handbooks, and articlesproposing new techniques. The ISA 18.2 standard11 addressesthe development, design, installation, and management of alarmsystems adopting a lifecycle approach. The key stages in thelifecycle are specification of the alarm philosophy, identificationof potential alarms, detailed design including specifying alarmset points, implementation including operator training,monitoring and assessment of alarm system performance,which may trigger modifications, thus leading to managementof change. Various handbooks12−14 offer various insights foreach of the stages. A number of software systems are also nowavailable that offer various types of analysis for alarmmonitoring and reduction including alarm rates and alarmfrequency calculation, determination of stale (or standing)alarms, and support for alarm rationalization.15 These have ledto a number of successes in actual industrial implementation,such as the case reported by Mahajan and Surve16 at a gasrecycling plant of Qatar Petroleum.In tandem, several researchers have proposed more advanced

techniques to evaluate alarm systems and improve alarms. Izadiet al.17 proposed the use of process data and knowledge alongwith alarm data to diagnose and rectify the problems of alarmsystems. For example, using process knowledge, Foong et al.18

developed a fuzzy-logic based alarm prioritization scheme thatenabled operators to decide, which alarms to attend to first if analarm flood occurs. One family of approaches have sought toutilize the correlation among different alarms19 or betweenalarms and operator actions20,21 to determine the need andimportance of alarms or select suitable thresholds. Suchcorrelation analysis takes into account the temporal depend-encies between alarms and can help detect strongly correlated

and hence duplicate alarms, as well as unnecessary alarms whichdo not require any operator action. Kimura et al.22 developedindices to quantitatively evaluate alarms in terms of theireffectiveness, recall, and timeliness, which gauge if the alarmwould enable the operator to respond in an effective and timelymanner. As another approach to evaluating alarms systems, Liuet al.23 constructed an operator model for use as a virtualsubject to analyze their behavior during process malfunctionswithout the need of process operational data. Such offlineassessment and alarm rationalization approaches are meant tobe applied periodically (weekly or monthly) to review thehealth of the alarm system. Graphical tools, such as visual-ization, can further assist the engineer identify patterns amongthe alarms “manually”.24 It is also now being recognized that,although alarm rationalization is probably the most effectivestrategy to solve alarm problems, they are heavily knowledgeintensive; hence, statistical and data mining technologies canoffer only partial support.17

It has been recognized for some years now that alarmmanagement is not solely a technological problem.25,26

Ultimately, it is the responsibility of the operator to respondto abnormal situations and prevent catastrophic consequences.The actions of the operator during an abnormal situation canbe viewed in terms of the Boyd loop, which models thedecision-making as consisting of four steps: observe, orient,decide, and act (and hence also called the OODA loop).27 Therole of the alarm system in the OODA loop is to help orient theoperator to the current (abnormal) state of the plant.Subsequently, operators have to decide and act by takingcorrective actions to bring the plant back to normal operatingstate. Nuisance alarms and alarm floods delay or prevent theorientation through information overload; hence, alarmmanagement is important. However, besides reducing nuisancealarms, other approaches can be additionally pursued toimprove the operator’s ability to orient quickly to the plantstate.

2.1. Human Factors in Alarm Management. Processcontrol industries usually entail working in a huge, interactivesystem involving man and machine. Apart from developingsmarter alarm management tools that improves the “machine”aspect, the “man” aspect in managing alarms through theunderstanding of the behaviors of operators during anabnormal situation is equally important.28 In an ethnographicstudy conducted by Yin,10 the behaviors of plant operators wereclassified into two groups, namely, novice and expert. Operatorsbelonging to the novice group had less experience in managingthe plant. Yin10 found that this group of operators tends toadopt a more reactive monitoring approach, that is, theygenerally rely on alarms to diagnose faults and to alert them ofany abnormal behaviors happening to the plant. As a result,novice operators were more likely to be disoriented during analarm flood and prone to activating the emergency shutdownwhen the fault/abnormal situation could not be promptlydiagnosed and rectified. Operators belonging to the expertgroup, on the other hand, had a more complete understandingof the process dynamics. This group tended to adopt a moreproactive process monitoring behavior, which involved utilizingtrend displays to predict future process states. This mentalprediction helped them diagnose and rectify the abnormalsituation early and prevent plant shutdowns. One way tomitigate this performance gap between novice and expertoperators is to provide tools that can help the former performjust as well as the latter. Expert operators benefit from years of

Industrial & Engineering Chemistry Research Article

dx.doi.org/10.1021/ie4014953 | Ind. Eng. Chem. Res. 2014, 53, 5182−51935183

operational experience, which allows them to develop mentalmodels to quickly understand and anticipate situations.Anticipatory alarms seek to support the performance of noviceoperators using first-principles and data-driven process models.The crucial role of prediction during real-time decision

making has been brought out in a number of domains rangingfrom firefighting29 to medical devices.30,31 Predictive tools canprovide operators with information about the process’ futurestate, so as to improve their situation awareness and provide alonger lead time for action. Such a predictive aid is currentlynot implemented in the chemical industries but has foundwidespread usage in various other domains. For example, thecockpit display of traffic information in modern airplanes showsother aircrafts in the vicinity and their trajectories, and alertsthe pilots of any potential conflicts. This improves pilots’ abilityto anticipate and reduces their workload.32 Fire fightersanticipate how bushfires will spread so as to come up withthe best resolution strategy.29 As human errors in medicaldevice use account for a large portion of medical errors,methods have been developed to predict patient safety inmedical devices with integral information technology to reducesuch errors.30,31 Tsunami warning systems aim to relay possibleimpending rogue waves to affected shorelines in hopes to warnand advise people to evacuate to higher ground.33 Similarpredictive applications and benefits are also found in maritimeindustries.34 A more familiar example is in hurricane forecasts,in which powerful simulations seek to extrapolate the paths ofhurricanes. These examples reflect the common theme ofintegrating available information to calculate a prediction, andpresent this result to the user during decision-making. In thiswork, we adopt a similar approach for alarm management,called anticipatory alarms.

3. ANTICIPATORY ALARMSThe key motivation for anticipatory alarms is to help plantoperators, especially those that are less experienced, to manageabnormal situations in a more proactive manner. Theinformation flow in traditional alarm systems from measure-ments to the display on the DCS is shown in Figure 1. When a

large disturbance or abnormal situation occurs in the process,the operator’s attention is captured by the numerous alarms.Other variables that are moving toward their alarm limits buthave not yet reached their alarm threshold would appear to benormal. In the absence of trend information, as is the case inmost DCS schematics today, the operator does not have readilyaccessible information for inferring the true state of the plant,which hinders the operator’s sensemaking.

Anticipatory alarms seek to overcome this handicap of partialinformation.35,36 As shown in Figure 2, in the proposedapproach, operators are provided with real-time informationnot only about the alarms that have already occurred, but alsoabout those that would occur in the near future. Through this,operators can obtain a comprehensive view of the current stateof the process and its predicted state which would help themlocalize and rectify the problem. Alarm anticipation can beachieved in various ways. One simple strategy is reducing thealarm thresholds. However, alarm limits are usually set based onnumerous considerations, especially safety-related ones.12

Changing the alarm limits could be misleading to the operatorsand have the inverse effect of worsening safety performance ifoperators become nonchalant to alarms, knowing subcon-sciously that they do not accurately reflect safety limits.3

Another approach could be using past data to performextrapolation. Our preliminary investigation suggests that thequality of such prediction would be highly dependent on theextent of noise in the system. What is required is a multivariate,easy-to-develop, model-driven anticipation scheme that re-spects the fundamental laws. Therefore, in this paper, wepropose a hybrid first-principles and data-driven model thatconsiders interactions between different variables for anticipat-ing alarms.The proposed anticipatory alarms are built around an alarm

anticipation algorithm, and utilize dynamic process models,known as anticipatory alarm models or AA-models, to estimatethe rate-of-change of process variables in the near-term. Usingthe rate-of-change, the time at which each process variablewould trigger its alarm limits, termed as anticipated alarm timeor AA-time, is calculated and used to trigger anticipatoryalarms.Let yj be an alarm variable, where the index j is used to

indicate different alarm variables. Each alarm variable yj isaffected by other measured variables, Zk

j , where the index kindicates that various measured variables could affect yj. In real-time, the alarm anticipation system uses AA-models and Zk

j

values to estimate the AA-time for each yj. First, themeasurements of the process variables that are required inthe AA-model, Zk

j , are obtained at each time instant t. Second,based on the AA-model, the rate-of-change of the alarmvariable, y td /dj , is estimated. Finally, the alarm anticipation

algorithm utilizes the predicted rate-of-change to estimate theAA-time of yj:

=−t

Y y

y td /djAA j j

j (1)

where Yj represents an alarm limit for yj.The time horizon for which prediction is performed is called

the anticipation time window or AA-window. Variables whoseAA-time is within the AA-window are conveyed to the operatoras anticipated alarms. Figure 3 shows the AA-window, where t*is the current time and W is the length of the AA-window. Att*, the rate-of-change of the process variable is estimated. TheAA-time is then calculated based on this predicted rate-of-change, the current variable value, and the alarm limit. Thereare two possibilities as shown in Figure 3: (a) the AA-time fallswithin the AA-window tj

AA ≤ W or (b) the AA-time is outsidethe AA-window (tj

AA > W). In the former case, anticipatoryalarm is triggered and the operator is notified of the predictedAA-time. In the latter case, no anticipatory alarm is triggered.

Figure 1. Existing alarms management in chemical plants.



The rate-of-change of the alarm variables y td /dj is predicted

online using AA-models, which are developed offline before-hand, as described next.3.1. AA-Model Development. Developing dynamic

models of complex industrial processes is in generalchallenging. AA-models pose additional requirements sincethese models must be simple, for real-time use, yet berepresentative of the process dynamics in a wide range ofoperations including abnormal situations for which plant datamay not be available beforehand. Developing a first-principlesmodel that accurately represents the process dynamics duringabnormal situation can be expensive and time-consuming.Further, the necessary parameters such as reaction kinetics andheat transfer coefficients are rarely measured. Data-drivenmodels on the other hand are easier to develop if historicalprocess data is available. However, the prediction capabilities ofdata-driven models are limited to the domain covered by thedata. Since data from abnormal situations is usually rare orscarce, data-driven models by themselves would not offer goodpredictions. To overcome these challenges, we propose ahybrid modeling strategy that utilizes both first-principles anddata-driven modeling techniques to estimate the process stateaccurately in the short-term. Rather than a single monolithicmodel that seeks to model the entire process, we consider theevolution of each variable individually and develop a set ofsimple yet multivariate models. Further, not every variable inthe process is considered. A limited number of measuredvariables in the plant have alarms configured in the DCS. Wedevelop AA-models to predict the evolution of only thesevariables with alarms, yj.The proposed model structure is shown in Figure 4. In the

proposed scheme, measured process variables, Zkj , are input to

the AA-models, which are represented in general by

=y

tf Z

d

d( , )j j j

(2)

where Zj = [z1j ,z2

j , ...] denotes the set of measured processvariables Zk

j that affect yj, andj denotes the set of parameters

pkj in the first-principles model. Function f(...) relates themeasured input process variables and the unknown parametersto the rate-of-change of yj. It is a hybrid first-principles anddata-driven model.We propose to identify the structure of f using first principles,

that is, mass and energy balances. Once the first-principlesmodel of a process variable is derived, we use data-drivenmodeling techniques based on historical data of Zk

j and yj toestimate the unknown parameters j. A parameter estimationprocedure is used to select the parameter values.A variety of data-driven techniques could be used to estimatej. In this paper, we use an optimization-based method similar

to the nonlinear least-squares approach that minimizes theerror between actual and the predicted rate-of-change ofprocess variables. The model structure of process variable yj(given in eq 2) is first linearized and rearranged into thefollowing form:

= · = + +

+ =

n n p n p n

p n n N

( ) ( ) ( ) ( ) ...

( ), 1, ...,

jj j j j j j

Kj

Kj

1 1 2 2

(3)

wh e r e j d eno t e s p a s t m e a s u r emen t s o f y j ,

= p p p[ , , ..., ]j j jkj

1 2 denotes the parameters to be estimated,

and = [ , , ..., ]j j jkj

1 2 , where kj is a term comprising one

or more variables zkj in the linearized equation. There can be a

Figure 2. Alarms management using the anticipatory alarms framework.

Figure 3. Anticipation time window.

Figure 4. Structure of anticipatory alarms model.



driving force ( )kj that involves more than one variable (zk

j ).For example, in eq 8, the difference between two variables TI16and TI17, that is, TI16 − TI17, is one of the driving forces. k is

the number of terms in j and N is the number of samples/observations in the historical data set used for parameterestimation. In the optimization-based method, the aim is toreduce the error between the actual (given by the historicaldata) and predicted (given by eq 2) rate-of-change of theprocess variable as follows:

∑ −

=

⎛⎝⎜⎜

⎞⎠⎟⎟

tn

y

tnmin

d

d( )

d

d( )

n

Nj j

1

2

j

(4)

subject to

≤ ≤j j j (5)

where td /dj is the rate-of-change of process variable yj

obtained from the historical data and y td /dj is the predictedrate-of-change of the process variable obtained using eq 2 and

j. j and j represent the lower and upper bounds of j,respectively.In summary, the procedure for developing the AA-models is

as follows: (1) Identify the process variables, yj, in the plant tobe used for anticipatory alarms monitoring. (2) For an alarmvariable yj, (a) develop the first-principles model based on massand energy balances relating yj to measured variables zk

j andother unmeasured variables, (b) estimate each requiredunmeasured variable through interpolation or relating it tomeasured variables, (c) obtain historical data for yj and zk

j that

Figure 5. Schematic of depropanizer unit.

Figure 6. Control volume for developing AA-model of TI17.



are required in the first-principles model, and (d) using thefirst-principles model and historical data, estimate the unknown

parameters j using data-driven techniques. Next, the benefitsof anticipatory alarms are evaluated using a simulateddepropanizer plant case study.

4. CASE STUDY: DEPROPANIZER PLANT

The schematic of the depropanizer plant is shown in Figure 5.37

The primary objective of the unit is to separate a feed mixture(typically from either the deethanizer unit bottoms or thedebutanizer unit overheads), consisting primarily of C3 and C4

hydrocarbons, into two product streams. The lighter product,from the top of the unit, consists primarily of C3. The bottomstream consists of C4 and other heavier hydrocarbons, which isfurther processed in the downstream units to recover the heavyhydrocarbons.The depropanizer unit has 24 measured process variables.

However, from the point of view of the operator, not all processvariables have equal importance. In this case study, eightprocess variables, TI13, TI14, TI16, TI17, TC11, LC11, LC12,and PC11, have alarms configured. These were selected foranticipatory alarms.4.1. Development of AA-Models. AA-model for each

process variable was first developed. Consider TI17, thetemperature of tray 1. To develop the AA-model for TI17,we first develop its first-principles model. Taking tray 1 as thecontrol volume as shown in Figure 6, the energy balanceequation can be written as

= + − −mH

tD H V H L H V H

dd

L

D11

RL

2 2V

R 1L

1 1V

R (6)

where m1 is the liquid moles hold-up on tray 1, DR is the refluxflow rate, LR, V1, and V2 represent the respective liquid andvapor flow rates, and H denotes the respective specific enthalpy.The subscript index of H denotes the tray number, while thesuperscript index represents the type of flow (i.e., L for liquidand V for vapor). By expanding the specific enthalpy terms, H1

L,H1

V, HDR

L , and H2V (derivation details given in the Supporting

Information), eq 6 can be rewritten as

=+

−

++

−

++

−

++

−

++

−

⎡⎣⎢

⎤⎦⎥

tA

m A BL

Bm A B

L

m A BVR T

Am A B

V T

Bm A B

L T

dTI17d ( TI17)

[ (TI16 TI17)]

2 ( TI17)[ (TI16 TI17 )]

1( TI17)

( TI17)PC11

( TI17)[ ( TI17)]

2 ( TI17)[ ( TI17 )]

L

1L L R

L

1L L R

2 2

1L L

2

V

1L L 2

V

1L L R 2

2 2

(7)

where AL, AV, BL, and BV are unknown parameters in the first-principles model. Equation 7 can be rearranged to the formgiven in eq 3 as follows:

Given the historical data, the term on the left-hand side of theequation and those in the square brackets are known while therest of the terms (five parameters) are unknowns. Equation 8thus provides the model structure for variable TI17 with theknown process variables (measured or estimated) T2, TI16,TI17, PC11, V, and L. T2 is estimated from measured variablesTI15 and TI17, L is estimated from FC12, and V is estimatedfrom FI13 and LC11. The data-driven optimization method isthen used to determine the unknown parameters, j, usinghistorical data.Similar models were developed for all eight alarm variables in

the case study. The interested reader is referred to theSupporting Information for details of the other models. Oncethe AA-models are developed, they are used online to predictthe AA-time for the process variables in real-time.

5. RESULTSThe model developed above has been used for generatinganticipatory alarms in real-time. In this case study, a total of sixdifferent fault scenarios are studied. They are as follows: (S1)loss of cooling water at condenser E12, (S2) loss of hot oil atreboiler E11, (S3) degradation of reflux pump P11A, (S4) lossof feed, (S5) fouling of reboiler E11, and (S6) fouling ofcondenser E12. The sampling period is four seconds. In eachscenario, the fault is introduced at t = 15 s. The actual alarmsthat are triggered and their sequence in each scenario are givenin Table 1. Because of limitation of space, we report detailedresults for three scenarios. The AA-window length used in thesescenarios is 60 s.

5.1. Scenario 1: Loss of Cooling Water at CondenserE12. In this scenario, there is a loss of cooling water enteringthe condenser E12. As there is no water to condense the vaporcoming from the distillation tower, vapor starts to build upleading to a pressure increase in the column. Eventually, thecolumn pressure PC11 will trigger its high-limit alarm at t = 88

Table 1. Alarms Triggered in the Six Scenarios

scenario description actual alarms (time)

S1 loss of coolingwater

PC11 HI (88s), TI16 HI (120s), TI13 HI (132s),TI17 HI (164s), LC12 LO (196s)

S2 loss of hot oil TC11 LO (80s), LC11 HI (132s), LC12 LO(192s)

S3 degradation ofreflux pump

TI17 HI (48s), LC12 HI (164s), TI16 HI (180s),TI14 HI (292s), LC11 LO (296s), TC11 HI(360s), TI13 HI (508s), PC11 HI (516s)

S4 loss of feed LC11 LO (400s), TI14 HI (440s), TC11 HI(472s)

S5 reboilerfouling

TC11 LO (104s), LC11 HI (252s), LC12 LO(364s)

S6 condenserfouling

PC11 HI (84s), TI16 HI (152s), TI13 HI (196s)



s. As the pressure builds up in the reflux drum, the temperatureof its content increases. This causes the temperature of theliquid flowing out of the reflux drum, TI16, to increase,resulting in increasing temperatures of the bottom product(TI13) and the top tray (TI17) as well. As a result, all threeprocess variables, TI16, TI13, and TI17, trigger their high-limitalarms at t = 120, 132, and 164 s, respectively. Since nocondensation takes place after the fault, the liquid level in thereflux drum, LC12, decreases and eventually triggers its low-limit alarm at t = 196 s.Anticipatory alarms can offer significant advance indication

for each of these impacted variables as shown in Figure 7. Thex-axis denotes the process time while the y-axis denotes the AA-time, that is, the predicted time to alarm (tj

AA) for each alarmvariable. A marker in the figure indicates an anticipatory alarm,that is, at that sampling instant, a particular alarm variable hasbeen predicted to hit its alarm limit in the next tj

AA seconds (tjAA

≤ 60 s, the AA-window length). At the end of the simulation,the actual time of every alarm is known. These actual alarmtimes are indicated by the circled markers that lie on the x-axis.The first anticipatory alarm is triggered at t = 64 s, predicting

PC11 HI to occur 27 s later. Thus, the operator is notified earlythat there is a potential problem involving PC11, 24 s before itsalarm actually sounds at t = 88 s. At this point, the operatormay not be able to localize the fault yet, since PC11 HI canoccur in three scenarios: S1, S3, and S6 (see Table 1). Similarly,the next three alarms, TI16 HI (anticipated at t = 92 s), TI13HI (anticipated at t = 84 s), and TI17 HI (anticipated at t = 128s) could be caused by either S1 or S3. Only after the

anticipatory alarm for LC12 LO is triggered at t = 160 s, theoperator can localize the fault to be S1 (loss of cooling water),seeing that S3 would involve LC12 HI rather than LC12 LO.The operator can therefore conclude from the anticipatoryalarm of LC12 LO at t = 160 s that the abnormal situation is infact loss of cooling water and initiate recovery action evenbefore the LC12 LO alarm actually sounds at t = 196 s. Asshown in Figure 7, AA correctly anticipated all the five alarms inthis scenario and offered an additional diagnosis time advantageof 36 s.The accuracy of the anticipatory alarms is illustrated in

Figure 8, which shows how the AA-times for each of the eightvariables compare with the actual alarm time. The actual alarmtime is denoted by T at the right end of the x-axis, while the y-axis denotes the time to alarm. The x-coordinate of the first(left-most) marker of each alarm variable shows the timeadvantage provided by AA, as it signifies the first time theoperator is notified of the incipient alarm. For example, theanticipatory alarm for TI13 HI gives a time advantage of 48 s. Aperfect prediction will fall on the 45-degree solid line in Figure8. It can be observed that while some AA-times are higher andothers are lower than the actual time to alarm, the predictionsbecome more accurate (the markers approach the 45-degreesolid line) as they get closer to the actual alarm time. Forinstance, at t* = T − 48 s, the AA-time for TI13 HI is 54 s,which is six seconds higher than the actual time to alarm; at t*= T − 4 s, the AA-time for TI13 HI is three seconds, adifference of only one second.

Figure 7. Anticipatory alarms in scenario 1.

Figure 8. Comparison of AA-times with actual time to alarm in scenario 1.



5.2. Scenario 2: Loss of Hot Oil at Reboiler E11. In thisscenario, there is a loss of hot oil entering the reboiler E11. Thisresults in less bottom liquid flow being vaporized and causesthe temperatures in the column to decrease. For instance, thetemperature of tray 34, TC11, dips to below 80 °C, whichtriggers its low-limit alarm at t = 80 s. The liquid hold-up at thebottom of the column also increases and the bottom hold-upliquid level, LC11, triggers its high-limit alarm at t = 132 s.Since no vapor eventually goes up to the top of the distillationtower, less and less condensation takes place. As such, the

liquid level in the reflux drum, LC12, decreases and eventuallytriggers its low-limit alarm at t = 192 s.As shown in Figure 9, AA also successfully predicted all three

alarms in this scenario. The first anticipatory alarm wastriggered at t = 56 s, predicting TC11 LO to occur in 35 s,before it actually sounded at t = 80 s. From Table 1, it can beobserved that only S2 and S5 trigger TC11 LO. In fact, boththese faults have the same alarms pattern. Thus, when notifiedof TC11 LO, the operator could localize the fault to be eitherS2 (loss of hot oil) or S5 (reboiler fouling) and proceed to


Figure 10. Comparison of AA-times with actual time to alarm in scenario 2.




check the status of the hot oil flow and the reboiler to confirmthe diagnosis. Thus, in this case, the proposed anticipatoryalarms give a diagnosis time advantage of 24 s. The accuracy ofthe anticipatory alarms in this scenario is shown in Figure 10.The starting time of AA is different for the three variables, withLC12 LO providing the most advance notification of 60 s.Again as in scenario 1, while the predicted times initially deviatea bit from the actual time to alarm (which becomes known onlymuch later), they consistently become more accurate as theyapproach the actual alarm time.5.3. Scenario 3: Degradation of Reflux Pump P11A. In

this scenario, the performance (horsepower) of reflux pumpP11A degrades significantly. Consequently, the reflux flow intothe distillation tower decreases. The process variable that isaffected directly by this fault is the temperature of the top tray,TI17, which starts to increase. Subsequently, temperatures ofthe reflux flow (TI16), other trays, tray 26 (TI114) and tray 34(TC11), and bottom product (TI13) are also affected.Eventually, all these variables trigger their respective high-limit alarms: TI17 HI at t = 48 s, TI16 HI at t = 180 s, TI14 HIat t = 292 s, TC11 HI at t = 360 s, and TI13 HI at t = 508 s.Also, since less reflux is being pumped back to the distillationcolumn, the liquid level in the reflux drum starts to increase andLC12 hits its high-limit at t = 164 s. If no corrective action isundertaken by the operator, the liquid level will keep on rising,eventually flooding the entire condenser, while the bottomhold-up in the column, LC11, will decrease and ultimatelytrigger the low-limit alarm at t = 296 s. Vapor continues tobuild up in the column leading to a pressure increase.Eventually the column pressure PC11 high-limit alarm istriggered at t = 516 s.AA successfully predicted all eight alarms in this scenario, as

well and offered significant advance indication for each of theseimpacted variables, as shown in Figure 11. The first anticipatoryalarm was triggered at t = 20 s, predicting TI17 HI to occur in37 s, before it actually sounded at t = 48 s. From Table 1, it canbe seen that TI17 HI could be caused by either S1 or S3. Onlyafter the anticipatory alarm for LC12 HI was triggered at t =148 s, the operator could localize the fault to be S3(degradation of reflux pump), seeing that S1 would involveLC12 LO rather than LC12 HI. The operator could thusdiagnose the fault based on the anticipatory alarm before theLC12 HI alarm actually sounded at t = 164 s. Thus, in this case,the proposed anticipatory alarms provided a diagnosis timeadvantage of 16 s.We have done similar analysis for the other three scenarios,

which in the interest of space are not reported here (seeSupporting Information). On average, in the six scenarios AAprovides a diagnosis time advantage of 35 s.5.4. Comparison of Different AA-Window Lengths.

The performance of the proposed anticipatory alarms dependson only one tuning parameter, that is, the AA-window length.The selection of the AA-window length depends on severalfactors. One is the accuracy of the AA-models; the AA-modelsusually offer higher accuracy when the process variable is nearits alarm limit, so shorter AA-windows should be used. Further,processes with smaller time-constant would also necessitate ashorter AA-window. However, from an operation point-of-view,the earlier the anticipation the earlier the operator can respond;hence a longer AA-window is more valuable. The above resultsused a window length of 60 s. Here, we study the effect ofdifferent AA-window lengths on prediction accuracy.

The performance of the AA-models can be evaluated byaverage anticipation error, false positive and false negative rates.Anticipation error is defined as the absolute difference betweenAA-time and the actual time to alarm (known only a posteriori)at a particular sampling instant. Figure 12 depicts the predicted

and actual times to alarm as a function of time. A perfect modelprediction will lead to its AA-time tracking along the diagonalwith the actual time. However, in practice, models are seldomperfect and the predicted time would deviate as illustrated. Theresulting anticipation error is shown by the shaded area. Theaverage anticipation error, εj, of a particular alarm variable yj iscalculated as the mean of the anticipation errors from allsampling instants when its anticipatory alarm is active.

ε =∑ | − |

− += t i t i

M l

( ( ) ( ) )

1ji lM

j jAA act

(9)

where l represent the sampling instant when the anticipatoryalarm starts and M represents the sampling instant just beforethe actual alarm is triggered. Times tj

act(i) and tjAA represent the

actual time to alarm and the AA-time for the process variable atthe ith time instant, respectively. A value of εj ≈ 0 indicates thatthe prediction from the model is accurate. The higher the εj, themore mismatch between the AA-time and the actual time toalarm.False alarms offer another indication of performance. A false

negative is defined as an instance where an actual alarm occurswithout triggering any anticipatory alarm. On the other hand, afalse positive is defined as an instance where an anticipatoryalarm has been triggered, but the actual alarm does notmaterialize during the scenario. The false positive rate iscalculated as the percentage of samples with false positiveanticipatory alarms flagged. These statistics are dependent onthe AA-window length.The performance statistics for 120, 90, 60, 45, 30, and 15 s

AA-windows are given in Table 2. In all six scenarios, there isno false negative; all alarms are successfully anticipated. Asexpected, it can be observed that a shorter AA-window indeedleads to lower anticipation error and false positive rate.However, there is a trade-off since the shorter AA-windowwith improved accuracy results in decreased time advantagefrom the earlier alarm notification. From the statistics in Table2, it is clear that the 60-s AA-window (which has an averageanticipation error of 13.59 s and false positive rate of 2.5%)seems to be a good trade-off as its performance is significantlybetter than the 90 s (31.87 s and 4.8%) and 120 s (37.25 s and

Figure 12. Comparison between actual and predicted times onanticipated alarms.



5.8%) AA-windows, while providing adequate advancenotification.

6. CONCLUSIONS AND DISCUSSIONIn this paper, a new type of alarms, known as anticipatoryalarms, is introduced. This type of alarms aims to provideoperators with anticipatory information on alarms that wouldoccur as an abnormal situation arises in a plant. They are builtaround an alarm anticipation algorithm that utilizes models,known as AA-models, to predict the rate-of-change of processvariables within the plant. The predicted rate-of-change ofprocess variables are then translated into time predictions,known as AA-time, of the occurrence of various alarms within acertain time-window, called the AA-window. Anticipatoryalarms would enable operators to carry out more effectivesensemaking during abnormal situations since holistic informa-tion about the status of the entire unit can be better estimatedwell before alarms actually occur. As a result, operators can bemore proactive in managing abnormal situations. The benefitsof AA have been demonstrated through six scenarios in adepropanizer unit case study. All alarms are successfullypredicted, providing a diagnosis time benefit of around 35 sto the operators.

Unlike typical models that seek to predict the processvariables themselves,38−40 AA-models are developed to predictthe rate-of-change of process variables for a short time period inthe future. The AA-models developed in this paper utilizedtechniques from both first-principles and data-driven methods;thus it has several advantages over models developed usingeither of these methods. One, in isolation they are more flexiblecompared to models derived using the first-principles techniquealone and two, they extrapolate better than classical black-box/data-driven models.41 The AA-models can be used as long asthe system remains in a condition where the mass and energybalances under which the AA-models were derived still apply.For example, Scenario 1 if unresolved would result in theactivation of a pressure safety valve due to the continuingincrease of column pressure PC11. This would change thestructure of the system and as a result the prediction from theAA-models would be erroneous. To prevent this, we include acondition to use the AA-models only when the pressure safetyvalve is closed, i.e. when the model structure is preserved.While the AA-models developed in this paper are able to

provide good predictions, they are “decentralized”, that is,different AA-models are derived for different alarm variables.However, the process is integrated and different variables affectone another. As such, the AA-models for these variables couldbe developed to take such relationships into account. However,this would lead to increased model complexity, which couldcompromise prediction accuracy. Therefore, it remains to beseen if the performance gain from incorporating multivariaterelationships outweighs this additional source of error. Futurework will focus on extending the proposed modelingframework to include the multivariate relationships betweenprocess variables and establish their relative benefits.The emphasis in this paper has been on the development of a

predictive scheme for anticipatory alarms. Such informationneeds to be conveyed to operators through a suitable user

Table 2. Statistics for Different AA-Window Lengths

AA-windowlength (s)

average anticipationerror (s)

false positiverate (%)

false negativerate

120 37.25 5.8 090 31.87 4.8 060 13.59 2.5 045 11.88 1.8 030 6.32 1.1 015 4.53 0.2 0

Figure 13. Example of display for anticipatory alarms.



interface so that they can use it in their sensemaking. Anexample of such a display is shown in Figure 13. The alarmdisplay shows the temporal trends of the alarms in two panes,one (historical pane on the left) showing real alarms that haveoccurred in the recent past and the other (prediction pane onthe right) showing anticipatory alarms. Actual alarms andanticipatory alarms are thus displayed in an integrated fashionto enable better sensemaking. In the display, each alarm isdepicted as a triangle that is either pointing upward torepresent a high-limit alarm or pointing downward to representa low-limit alarm. In addition, the triangles are colored red todepict a process variable that has triggered a real alarm andamber to depict anticipatory alarm. Alarms are also groupedbased on their process unit to reduce the complexity of thedisplay and allows operator to identify and understand thealarms in a systematic manner. For example, the alarms in adepropanizer unit are grouped into condenser, distillationtower, reflux drum, reboiler, and feed units. Human factorsexperiments have to be conducted with human subject(operators) to determine the effectiveness of such a displayin enabling better sensemaking for abnormal situation manage-ment in real time. This is the subject of our current research.

■ ASSOCIATED CONTENT*S Supporting InformationDerivation of AA-model equations and results from scenarios 4,5, and 6. This information is available free of charge via theInternet at http://pubs.acs.org/.

■ AUTHOR INFORMATIONCorresponding Author*E-mail: [email protected]. Tel: (65)65168041. Fax:(65)67791936.

Present Address§Indian Institute of Technology Gandhinagar, VishwakarmaGovernment Engineering College Complex, Chandkheda,Visat-Gandhinagar Highway, Ahmedabad, Gujarat, India382424. Email: [email protected]. Tel: (91) 79-32210155.

NotesThe authors declare no competing financial interest.

■ ACKNOWLEDGMENTSThis work is funded by the Science and Engineering ResearchCouncil (SERC), A*STAR, under the Human FactorsEngineering (HFE) Thematic Strategic Research Programme(TSRP). The authors thank Professor Martin Helander and DrYin Shanqing for helpful discussion.

■ REFERENCES(1) Hutton, R.; Klein, G.; Wiggins, S. Designing for sensemaking: Amacrocognitive approach. In Proceeding of the 2008 Human Factors inComputing Systems, Florence, Italy, 5−10 April 2008; ACM Press: NewYork, 2008.(2) Mattiasson, C. The alarm system from the operator’s perspective.In IEEE People in Control Meeting, Bath, U.K., 1999; IEEE: Piscataway,NJ, 1999.(3) Hopkins, A. Lessons from Longford: The Esso Gas Plant Explosion;CCH Australia Limited: North Ryde, New South Wales, Australia,2000.(4) Liu, J.; Lim, K. W.; Ho, W. K.; Tan, R.; Srinivasan, R.; Tay, A.The intelligent alarm management system. IEEE Software 2003, 20,66−71.

(5) Liu, J.; Ho, W.; Lim, K.; Srinivasan, R.; Tan, K. Intelligent alarmmanagement in a petroleum refinery. Hydrocarbon Process. 2004, 47−53.(6) Health and Safety Executive. The Explosion and Fires at the TexacoRefinery, Milford Haven, 24 July 1994, Incident Report; HSE Books:London, 1997.(7) Bransby, M.; Jenkinson, J. Alarm management in the chemicaland power industries: Results of a survey for the HSE. In IEEEColloquium on Best Practices in Alarm Management; IEEE: Piscataway,NJ, 1998; pp 1−10.(8) Campbell-Brown, D. Alarm management: A problem worthtaking seriously. Control 1999, 52−56.(9) Nimmo, I. Adequately address abnormal situation operations.Chem. Eng. Prog. 1995, 91, 36−45.(10) Yin, S. Proactive monitoring in process control using predictivetrend display. PhD thesis, Nanyang Technological University,Singapore, 2012.(11) International Society of Automation. Management of AlarmSystems for the Process Industries, Technical Report; InternationalSociety of Automation: Research Triangle Park, NC, 2009.(12) Hollifield, B.; Habibi, E. Alarm Management Handbook: AComprehensive Guide: Practical and Proven Methods to Optimize thePerformance of Alarm Management Systems; International Society ofAutomation: Research Triangle Park, NC, 2010.(13) Rothenberg, D. H. Alarm Management for Process Control;Momentum Press: New York, 2009.(14) ASM Consortium. Effective Alarm Management Practices; ASMConsortium: Phoenix, AZ, 2009.(15) Gooch, J. Keys to successful alarm management. HydrocarbonProcess. 2011, 90 (4), 85−88.(16) Mahajan, S.; Surve, V. Operator performance enhancement byalarm management. SPE Prod. Oper. Symp. 2012, 1, 532−538.(17) Izadi, I.; Shah, S.; Chen, T. Effective resource utilization foralarm management. In 49th IEEE Conference on Decision and Control;IEEE: Piscataway, NJ, 2010; pp 6803−6808.(18) Foong, O.; Sulaiman, S.; Awang Rambli, D.; Abdullah, N. ALAP:Alarm prioritization system for oil refinery. In World Congress onEngineering and Computer Science, San Francisco 20−22 October 2009;International Association of Engineers: Hong Kong, 2009.(19) Yang, F.; Shah, S.; Xiao, D.; Chen, T. Improved correlationanalysis and visualization of industrial alarm data. ISA Trans. 2012, 51(4), 499−506.(20) Higuchi, F.; Yamamoto, I.; Takai, T.; Noda, M.; Nishitani, H.Use of event correlation analysis to reduce number of alarms. Comput.-Aided Chem. Eng. 2009, 27, 1521−1526.(21) Nishiguchi, J.; Takai, T. IPL2 and 3 performance improvementmethod for process safety using event correlation analysis. Comput.Chem. Eng. 2010, 34, 2007−2013.(22) Kimura, N.; Takeda, K.; Noda, M.; Hamaguchi, T. Anevaluation method for plant alarm system based on a two-layercause-effect model. Comput.-Aided Chem. Eng. 2011, 29, 1065−1069.(23) Liu, X.; Noda, M.; Nishitani, H. Evaluation of plant alarmsystems by behavior simulation using a virtual subject. Comput. Chem.Eng. 2010, 34 (3), 374−386.(24) Kondaveeti, S.; Izadi, I.; Shah, S.; Black, T.; Chen, T. Graphicaltools for routine assessment of industrial alarm systems. Comput.Chem. Eng. 2012, 46, 39−47.(25) Cochran, E.; Bullemer, P. Abnormal situation management: Notby new technology alone. Proc. AIChE Process Plant Saf. Symp. 1996,218−223.(26) Bloom, C.; Bullemer, P.; Barreth, R.; Reising, D. Situationawareness for refining and petrochemical process operatorsNot bytechnology alone. Proc. NPRA Annu. Meet. 2010, 247−258.(27) Chu, R.; Bullemer, P.; Harp, S.; Ramanathan, P.; Spoor, D.Qualitative user aiding for alarm management (QUALM): anintegrated demonstration of emerging technologies for aiding processcontrol operators. IEEE Int. Conf. Syst., Man, Cybern. 1994, 1, 735−740.



http://pubs.acs.org/

mailto:[email protected]

mailto:[email protected]

(28) Kim, I. Computerized systems for online management offailures: a state-of-art discussion of alarm systems and diagnosticsystems applied in the nuclear industry. Reliab. Eng. Sys. Saf. 1994, 44,279−295.(29) Lewandowsky, S.; Dunn, J.; Kirsner, K.; Randell, M. Expertise inthe management of bushfires: Training and decision support. Aust.Psychol. 1997, 32, 171−177.(30) Zhang, J.; Patel, V. L.; Johnson, T.; Chung, P.; Turley, J.Evaluating and predicting patient safety for medical devices withintegral information technology. Adv. Patient Saf.: Res. Implementation2005, 2, 323−336.(31) Chung, P.; Zhang, J.; Johnson, T.; Patel, V. An extendedhierarchical task analysis for error prediction in medical devices. InAMIA Annual Symposium, January 2003; AMIA: Bethesda, MD, 2003.(32) Morphew, E.; Wickens, C. Pilot performance and workloadusing traffic displays to support free flight. In 42nd Annual Meeting ofHFES, Chicago, IL, 5−9 October, 1998; HFES: Santa Monica, CA,1998.(33) Titov, V. In the Sea. Tsunamis Forecasting, Vol. 15; HarvardUniversity Press: Cambridge, MA, 2009.(34) Van Breda, L. Anticipatory Behaviour in Supervisory Control,Technical Report; Delft University Press: Delft, the Netherlands, 1999.(35) Xu, S.; Yin, S.; Srinivasan, R.; Helander, M.; Karimi, I.;Srinivasan, R. Proactive alarms monitoring using predictive tech-nologies. Comput.-Aided Chem. Eng. 2012, 31, 1537−1541.(36) Xu, S.; Srinivasan, R. Anticipatory alarms for predictiveabnormal situations management. In 4th World Conference of Safetyof Oil and Gas Industry, Seoul, Korea, 2012; WCOGI, 2012.(37) Helander, M. Personal Communication, 2011.(38) Thompson, M.; Kramer, M. Modeling chemical process usingprior knowledge and neutral networks. AIChE J. 1994, 40, 1328−1340.(39) Kahrs, O.; Marquardt, W. The validity domain of hybrid modelsand its application in process optimization. Chem. Eng. Process. 2007,46, 1054−1066.(40) Ng, C.; Hussain, M. Hybrid neutral network-prior knowledgemodel in temperature control of a semi-batch polymerization process.Chem. Eng. Process. 2004, 43, 559−570.(41) Psichiohis, D.; Ungar, L. A hybrid neural network-first principlesapproach to process modeling. AIChE J. 1992, 38 (10), 1499−1511.



Documents

Hybrid Model-Based Framework for Alarm Anticipation