SP-2036, Well Engineering General Operational Safety ... · Web view7.1 The number of configured alarms per panel operator 30 7.2 The average alarm rate per PANEL operator 31 7.3

Petroleum Development Oman L.L.C.

Engineering and Operations

Guidelines for Alarm Management And

Rationalisation

User Note:

A controlled copy of the current version of this document is on PDO's EDMS. Before making reference to this document, it is the user's responsibility to ensure that any hard copy, or electronic copy, is current. For assistance, contact the Document Custodian or the Document Controller.

Users are encouraged to participate in the ongoing improvement of this document by providing constructive feedback.

Please familiarise yourself with theDocument Security Classification Definitions

They apply to this Document!

This document is the property of Petroleum Development Oman, LLC. Neither the whole nor any part of this document may be disclosed to others or reproduced, stored in a retrieval system, or transmitted in any form by any means (electronic, mechanical, reprographic recording or otherwise) without prior written consent of the owner.

UNRESTRICTEDDec-09 Filing Key: Business Control

http://sww3.pdo.shell.om/getdoc?dataid=3966312

mailto:[email protected]?subject=Ref:%20SP-1219,%20Well%20Engineering%20H2S%20Specification

mailto:[email protected]?subject=Ref:%20SP-1219,%20Well%20Engineering%20H2S%20Specification

Petroleum Development Oman LLC Revision: 2.0Effective: Dec-09

This page was intentionally left blank

Page 2 GU-513 - Guidelines for Alarm Management And Rationalisation

Printed 11/09/23

The controlled version of this CMF Document resides online in Livelink®. Printed copies are UNCONTROLLED.


i Document AuthorisationAuthorised For Issue – December 2009

Document Authorisation

Document Authority

(CFDH)

Document Custodian Document Controller


Printed 11/09/23



ii Revision HistoryThe following is a brief summary of the 4 most recent revisions to this document. Details of all revisions prior to these are held on file by the issuing department.

Revision No. Date Author Scope / Remarks

2.0 Dec–09 Salim Hinai, UES Refer to Appendix 7 for Summary of Changes

1.0 Dec-05 M. Shujauddin / Salim Hinai

First Issue for Implemetation

iii Related Business Processes

Code Business Process (EPBM 4.0)EP.64 Design, Construct, Modify and Abandon Facilities

iv Related Corporate Management Frame Work (CMF) Documents

The related CMF Documents can be retrieved from the CMF Business Control Portal.

CP-114 Maintenance and Integrity Management - CoP

SP-1243 Corporate Philosophy for Control & Automation


Printed 11/09/23


http://sww1.pdo.shell.om/dept_applications/Infrastucture/IMandT/TAXI/cmf/index.htm


TABLE OF CONTENTS

i Document Authorisation....................................................................................................3

ii Revision History................................................................................................................4

iii Related Business Processes.............................................................................................4

iv Related Corporate Management Frame Work (CMF) Documents......................................4

Summary................................................................................................................................. 7

1 Introduction....................................................................................................................... 8

1.1 Background................................................................................................................. 8

1.2 Scope and objectives...................................................................................................8

1.3 Operational Excellence................................................................................................9

1.4 Alarm Response analysis...........................................................................................10

1.5 Distribution, intended use and regulatory considerations.............................................12

2 Definitions and Meanings................................................................................................13

2.1 General definitions.....................................................................................................13

2.2 Specific definitions Include definitions for each alarm type..........................................13

3 ALARM RATIONALISATION REVIEW............................................................................14

3.1 General Requirements...............................................................................................14

3.2 Recommended Measures..........................................................................................14

3.3 Alarm Management and Rationalisation Review Process............................................16

3.4 Steps for Alarm Management and Rationalisation study.............................................16

3.4.1 Preparatory works...............................................................................................16

3.4.2 Timing................................................................................................................. 16

3.4.3 Required Documents...........................................................................................17

3.4.4 Team Composition..............................................................................................17

3.4.5 AMR Facilitator....................................................................................................17

3.4.6 AMR Secretary....................................................................................................18

3.4.7 Master alarm database and report.......................................................................18

4 ALARM PRIORITISATION GUIDELINES........................................................................20

4.1 Assigning of Activities and Alarm Priorities.................................................................20

4.2 Guidelines for Normal Distribution of Alarms among Priority Level..............................22

5 ALARM SUPPRESSION – IMPLEMENTATION GUIDELINES........................................23

5.1 Static alarm suppression............................................................................................23

5.2 Dynamic Alarm Suppression......................................................................................24

5.3 Dynamic mode dependent alarm settings...................................................................26

6 OPERATOR’S HELP MENU...........................................................................................29

7 ALARM MANAGEMENT PERFORMANCE MEASUREMENT.........................................30

7.1 The number of configured alarms per panel operator..................................................30

7.2 The average alarm rate per PANEL operator..............................................................31


Printed 11/09/23



7.3 Indication of frequent alarms......................................................................................31

7.4 The Mean Time Between Alarm.................................................................................31

7.5 Number of alarms following a trip...............................................................................31

7.6 Number of standing alarms........................................................................................32

7.7 Benchmarking............................................................................................................32

7.8 Improvement.............................................................................................................33

7.9 Overall Alarm Management process..........................................................................33

8 REFERENCES...............................................................................................................37

Appendix 1 – Typical ARM Info Pack......................................................................................38

Appendix 2 – AMR Report/Close Out Report..........................................................................39

Appendix 3 – AMR Work Process..........................................................................................40

Appendix 4 – AMR Workshop Request..................................................................................42

Appendix 5 – Abbreviations...................................................................................................43

Appendix 6 – Master Alarm Database to be used for Alarm Rationalization Exercise..............44

Appendix 7 – Summary of Changes......................................................................................45


Printed 11/09/23



SummaryThis document is created to provide a guide for the execution of Alarm Rationalisation Review of PDO facilities, in order to provide operator with meaningful alarms, i.e. an adequate set of warning facilities during normal and upset operation whilst minimising, as far as is reasonably practicable:

Standing alarms Nuisance alarms Repeating alarms Alarms floods Bad PV alarms System Alarms

It thus:

1. Gives a brief overview on the Alarm Rationalisation review process and alarm prioritisation guidelines.

2. Contains specific PDO data which are necessary to ensure a fit-for-purpose and consistent approach to all alarm rationalisation review process.

3. Outlines the endorsement process of the recommendations and the close-out procedure.

4. Guides users to a safe, cost effective and consistent design and implementation of alarms in an instrumentation system (FCS, DCS, IPS panels (if any), F&G Panels, Local panels etc.

5. Gives a brief overview of the overall Alarm Management Process for new facilities and existing facilities.

This document shall always be used in conjunction with the Shell DEP 32.80.10.14-Gen Alarm Management, June’2007


Printed 11/09/23



1 Introduction

1.1 BackgroundIt has been widely recognised that lack of a clear philosophy for “Alarm Management” on process plants controlled by a Distributed control system (DCS) or a Fieldbus based control system (FCS) often results in there being too many alarms, leading to problems with:

Standing alarms;

Nuisance alarms;

Bad PV alarms;

Frequently repeating alarms;

Alarm floods;

System alarms

The operator’s inability to prioritise remedial actions.

Alarms, if not rationalised and managed can seriously impair the operator’s ability to manage the process. Alarms floods during upset conditions can cause a minor event to escalate into a more serious incident. This is contrary to the design intent, which should seek to assist the operator to control the plant, avoid upsets and mitigate the consequences of undesirable events.

The guidelines on setting alarm priorities are generally based on the actions the operator needs to perform upon the alarm. Practical experience has shown that establishing the alarm priority based on an assessment of risk and the consequence when the alarm is not actioned upon requires disproportional efforts in relation to the results. Moreover this risk-based approach often does not offer acceptable or reliable results.

Setting the priorities of alarms is meant to help the operator to prioritise his actions. However if the alarm rate is low, prioritisation is not required. If the alarm rate is high, the operational situation is already deteriorated to such an extent that the operator no longer uses the alarm system to assess the situation and to prioritise his actions. Hence just setting different alarm priorities have little practical relevance.

It is therefore felt that instead of spending efforts on setting alarm priorities, attention should be focussed on the ability of the alarm system to provide meaningful alarms under most or all the operating conditions including upset and trip conditions.

1.2 Scope and objectivesThis document provides Guidelines for classifying the alarms, assigning of alarm priorities, reviewing the alarm configurations and guidelines for managing them.

The guidelines provided in this document are based on good industry practice rather than any national or international regulations or standards or codes of practice. Whilst there is presently no such document covering the configurations of FCS/ DCS alarm systems in general, some standards and codes of practice for machinery and other equipment may include specific requirements on alarm provisions. Under these circumstances, it may be necessary to adjust this methodology to maintain compliance with mandatory aspects of these codes and standards.

The overall objective is to review all alarms given their prime purpose, to ensure only meaningful alarms are provided and to achieve a significant improvement in the alarm system operability.


Printed 11/09/23



A “best practice” alarm system provides meaningful alarms under operating conditions including upset and trip conditions.

The Operator role varies considerably within PDO plants. There are 3 types of operator roles that have major impacts on alarm management:

1. Plants run with an Operator staffing the panel (manned, for 8 hrs minimum).

2. Plants run with Operators routinely making trips to wells etc. that may be 30 minutes drive or more from the panel. In this case, it is clear that no alarm should require quick action – unless the alarm is used to avoid automatic shutdowns where the Operator happens to be present when the alarm occurs.

3. There is also a Central Control Room (CCR) where Operators remotely monitor all PDO plants. It is clear that this case means that CCR Operators are effectively covering far more alarms than is reasonable – but they cannot act on many of them anyway due to their remote location. It may be appropriate to consider displaying only the higher-priority alarms at this location (e.g. Urgent and High as per Table 4.1).

This document defines the generic Alarm Guidelines for all PDO sites and will need to be augmented by other documents that cover system-specific considerations.

The guidelines provided in this document are based on established industry best practices and, in particular, the EEMUA 191 guidance. That guidance is primarily oriented to situations as per the first case above – where there is an Operator present at the panel

1.3 Operational ExcellenceCurrently operators spend 20 to 25% of their time on scheduled activities. The remainder of their time is spent on unscheduled re-active work responding to situations that actually should not have happened. This is visualised in Figure 1-1.


Printed 11/09/23



Figure 1-1: Percentage of time an operator spends on various activitiesIn Figure 1.1 the 'normal' shows the current state of affairs. A disproportional fraction of the time is spent on handling alarms. The fraction of time spent on correcting process upsets is even less than in the 'good' situation as the upset condition generates a lot of meaningless alarms that still need to be handled.

In a much-improved situation, the operator spends 50% of his time on pro-active activities. Ideally this percentage is even 80% as shown in the 'excellent' column.

The 'good' and 'excellent' are shown as targets to base the design of the alarm system on.

The alarm management methodology described in this paragraph aims at bridging the gap between the current state of affairs in most operating units and the good/excellent targets.

Of course apart from managing alarms properly, base layer control and IPF's should be optimised as well to allow the targets to be achieved.

1.4 Alarm Response analysisWhen considering the design of an alarm system, it is reasonable to assume that operators and technicians are well trained and knowledgeable about the equipment they operate and maintain. The function of the alarm system is then to:

Trigger a trained response to certain emergency conditions.

Alert the operator to plant conditions that need consideration and possible action.

Advise the operator of further developments that need action.

The aspect of 'acknowledge' and "consideration" - the analysis of the situation, the identification of the correct action and its execution or communication - is one that has


Printed 11/09/23



been ignored in many past alarm system implementations. This results in cognitive overload for operators in upset situations and an increased potential for escalation. A good alarm system should assist the operator in evaluating the situation, which is fundamental to identifying the correct actions. Depending on the circumstances, these actions can be directed either at avoiding an event or mitigating its consequences.

This alarm handling process is visualised in Figure 1-2:

Figure 1.2: Alarm Response diagram

The process of "acknowledge" and "consideration" described above takes typically 0.1 to 5 minutes each. Taking an average figure of say 5 minutes for a complete response, the maximum alarms (i.e. the meaningful alarms) load that one operator can handle effectively is limited to around 1 alarm per 5 minutes. However considering that the operator has many additional tasks, the average number of alarms should be limited to the quantities as given in the table 1-1 below.

Table 1-1: Average number of alarms.

% of time spent on alarm handling

# of alarms that effectively can/should be handled

Normal (current)

Good

Excellent

40%

10%

4%

4 - 6 per hour

1 per 1 hour

1 per 2 hours

For the numbers above in the table, an upset situation will probably be ignored. However it is important not only to avoid unnecessary alarms during normal steady state conditions but also under upset conditions. It is also important for the operator to be able to access relevant plant information quickly and effectively, in order to speed up the process of responding to an alarm, and thus improves the effectiveness of his corrective actions as shown in Figure 1-2. The design of the operator control interface


Printed 11/09/23



and the rapid and comprehensive availability of current and trended information are important facets of alarm system design.

The configuration of an alarm system is therefore a balancing act between giving the operator an extensive set of warning facilities for normal operation and the need to avoid information overload under upset conditions.

1.5 Distribution, intended use and regulatory considerationsUnless otherwise authorised by PDO, the distribution of this document is confined to Petroleum Development Oman and their nominated design and Construction contractors.

This document is intended for use in the oil and gas installations and production facilities, in conjunction with any type of operator’s alarm facility.

It shall form the basis of approach for Engineering and Operations, for the Alarm review and handling in the existing or new build facilities.

If national and/or local regulations exist in which some of the requirements may be more stringent than in this document, the Contractor shall determine by careful scrutiny, which of the requirements are the more stringent and which combination of requirements will be acceptable with regards to safety, environmental, economic and legal aspects. In all cases the Contractor shall inform the Principal of any deviation from the requirements of this document which is considered to be necessary in order to comply with national and/or local regulations.

Any queries relating this document such as technical content, scope and/or philosophy should be referred to CFDH, Control & Automation.

Any reader is invited to give his/her opinion, experience and suggestions for any improvement.


Printed 11/09/23



2 Definitions and Meanings

2.1 General definitionsThe Contractor is the party, which carries out all or part of the design, engineering, procurement, construction, commissioning or management of a project or operation of a facility. If the contract allows, the Principal may undertake all or part of the duties of the Contractor.

The Manufacturer, Vendor, Supplier, Seller is the party which manufactures or supplies equipment and services to perform the duties specified by the Contractor.

The Principal is the party, which initiates the project and is ultimately accountable. The Principal will generally specify the technical requirements. The Principal may also include an agent or consultant who is authorised to act for, and on behalf of, the Principal.

The word Shall indicates a mandatory requirement.

The word Should indicates a strong recommendation.

2.2 Specific definitionsAlarm priority - A parameter that is set during the configuration of an alarm to match the perceived importance of an alarm. In the control system, the priority of an alarm is used to control how the alarm is presented to the operator. The IPF initiated alarms are also transmitted to the Control systems where the priority is defined.

In this document, the following priority descriptions are used:

Emergency or Urgent priority (U).A priority assigned to alarms that require immediate operator attention and action for emergency responses. This is meant for those emergencies or events that may lead to have major impact on the HSE e.g. a major environmental incident, unplanned unit shutdown and a major economic loss to the Company. These include Fire/Gas alarms and alarms tied to executive functions

High priority (H).A priority assigned to alarms that require very fast operator attention and action to prevent a major operational upset or shut down. This is meant for those events that are likely to lead to major process upset, plant/ unit shut downs, moderate economic loss and minor HSE issues.

Low priority (L).A priority assigned to alarms that do not require fast operator action, but which should nevertheless be brought to the operator’s attention. This is meant to cover those incidents that have minor significance. Delayed response should never pose a threat to Company’s HSE matters, or a stable operation of the unit

Journal (J).A Facility for recording time sequenced historical event. This meant to cover those incidents that result in deviation from normal operations, operational mode changes and status of equipment/ systems etc.


Printed 11/09/23



3 ALARM RATIONALISATION REVIEW

3.1 General RequirementsA formal Alarm management and rationalisation study is required to provide the operator with meaningful alarms, i.e. an adequate set of warning facilities during normal and upset operation whilst minimising, as far as is reasonably practicable:

standing alarms;

nuisance alarms;

repeating alarms;

alarms floods;

bad PV alarms;

System alarms

Summarising, alarm management is intended to guide users to a safe, cost effective and consistent design and implementation for alarms in an instrumentation system (FCS, DCS, IPS panels (if any), F&G panels, local panels etc.).

3.2 Recommended MeasuresThe following measures will improve alarm management such that alarms become more 'meaningful':-

Setting Alarm priorities and DestinationThe setting of alarm priorities such that the operator only gets alarms that he can actually take action on. For existing installations, this includes the downgrading of the alarm priorities or removal of the alarm function.

Optimising alarm parametersAlarm parameters such as filtering and dead-band allow the reduction of repeating alarms.

Static alarm suppressionAlarms that are always in alarm when a process unit or a large piece of equipment is shutdown are suppressed.

Dynamic alarm suppressionAlarms that always follow after a process trip are suppressed.

Dynamic mode dependant alarm settings Alarm settings are dynamically changed based on detected operational mode changes.

Measuring alarm management performanceBy measuring the performance of the alarm management, attention and effort can be focused to aspects of existing alarm systems such that it can be optimised with the minimum of effort. Alarm management performance is measured using benchmarks.

Optimise Alarm ergonomicsBy optimising the way alarms are presented to the operator, operator alarm handling may be greatly enhanced. This includes on-line alarm help.


Printed 11/09/23



Better Use of DeadbandsMany existing systems use poor settings (e.g. 1% of EU range) for dead-bands on analogue PVs. The EEMUA 191 guidance suggests the following defaults:

Flow: 5%

Level: 5%

Pressure: 2%

Temperature: 1%

Increased values for dead-bands will often reduce the number of “repeating” alarms.

Use of Alarm Delay OptionsDelay the activation and/or the clearing of alarm messages:

Delaying activation is particularly appropriate where “spikes” are often seen in analogue signals. The alarm is not displayed as active unless it violates the alarm limit for longer than a specified period of time.

Delaying clearing is particularly appropriate when an alarm would otherwise cycle on and off due to small changes in an analogue signal. The alarm does not clear until a specified period of time has elapsed and the analogue value is still not violating the alarm limit.

Alarm rates can often be substantially reduced using these facilities. Alarm delay functionality is sometimes described as “debounce” functionality or “time dead-banding” functionality.

Alarm delay functionality is described in more detail in EEMUA 191

Use of Alarm ShelvingThis allows an Operator to temporarily move an alarm from the Alarm Summary to a “shelf” (another display) where the list of shelved alarms may be viewed at any time. The benefit is that the Alarm Summary is not filled by “standing alarms” that are well known to the Operator and reduce his effectiveness.

This also helps to reduce the number of standing alarms so that there will be less use of multiple pages of alarms on the Alarm Summary. (EEMUA 191 recommends that there should be less than 10 standing alarms and less than 30 shelved alarms).

Shelving functionality is described in more detail in EEMUA 191.

Use of BAD VALUE FunctionalityIt has been observed that a disproportionate number of BAD VALUE alarms occur during upsets. This occurs because analogue values are driven to extreme ends of the instrument range during upsets. These extreme values may then violate the defined Minimum and maximum values for the measurement because of drift in the instrument calibration.

There are two distinct ways of reducing the number of BAD VALUE activations:

Use of “extended range” functionality where available on the DCS. Extended range will avoid BAD VALUE alarms for small (e.g. typically a few %) drifts in calibration.

During rationalization, the team should critically question the need for BAD VALUE alarms where the measurement concerned is not being used for control purposes. The priority of BAD VALUE alarms should also be considered in such cases – since it may be appropriate to route such


Printed 11/09/23



alarms to maintenance staff but not to Operators.

Use of Improved Alarm DisplaysIt is widely recognised (e.g. see EEMUA 191) that alarm display is an important aspect of “best practice” alarm management.

Use of a Master Alarm DatabaseA “master alarm database” enables “capturing” of the as-agreed alarm configuration parameters from rationalization. It also allows for “enforcement” of that data when changes in the DCS values are detected during exception reporting.

The master alarm database can also support mode-based alarming (which may be required for effective alarm suppression) and electronic “Operator Help”.

3.3 Alarm Management and Rationalisation Review ProcessThe alarms review and rationalisation should be carried out as recommended in the flow chart in Appendix 3.

In principle, the review should take place for all the alarms. The IPF database / I/O list for the project can be extracted for preparing the master alarm database. However, in the case of existing installations, this may be done on a selection basis for those alarms that have been frequently seen as standing or nuisance alarms or full review of the facility as to suit the operational requirements.

Alarms shall be grouped on the basis of the process units that would help defining the static and dynamic alarm suppression groups. To speed up the review process, identical or similar alarms functions can be grouped and limited to one review for such a group. Eg. Causes of an ESD or Electrical Alarms or System alarms can be grouped together.

All applicable or related tags should be listed in the same alarm function sheet as applicable.

3.4 Steps for Alarm Management and Rationalisation studyIt is essential to set up a structure to optimise team productivity and quality of output. Refer Appendix 1 for the AMR information package requirements and Appendix 3 for the AMR Study work process.

3.4.1 Preparatory worksTo minimise delays, all preparatory work shall be done prior to the study.

The Master Alarm database should be pre-loaded with all information as defined in Appendix 6.

Once the team has started the alarm management and rationalisation study process no time should be lost doing work that could have been done in advance. A PC containing the master alarms database shall be available alongwith pre-requisites for generating a report after the Alarm Rationalisation Exercise.

3.4.2 TimingThe Alarm rationalisation review should be undertaken during detailed engineering phase of a project after IPF actions are closed-out, for existing installations, at any time when it is felt or demonstrated from actual events that:


Printed 11/09/23



there are too many standing alarms;

there are too many and/or too often nuisance / meaningless alarms;

some alarms are frequently repeated causing flooding alarm lists, event recorders and alarm buffers;

alarm floods occur during process upsets or trips;

the operator has difficulty to evaluate the situation with increased potential for escalation.

3.4.3 Required DocumentsThe alarm management study essentially requires more or less the same set of documents used for the IPF classification exercise. Refer Appendix 1 for the list of documents required for the rationalization exercise.

3.4.4 Team CompositionThe composition shall, as a minimum, be with the following members.

Facilitator

Secretary

Operation’s representative

Process engineer

Control & Automation engineer

DCS system Engineer and Instrument Maintenance Engineer, when required

The facilitator shall be from the Approved facilitator’s list maintained by the CFDH, Control & Automation.

The facilitator shall be well conversant with the Alarm management methodology. The task of the facilitator is to guide the team through the review process and to ensure that the discussions are sufficient enough to meet the objectives of the alarm study.

3.4.5 AMR FacilitatorThe AMR leader shall be an experienced facilities engineer and thoroughly familiar with the AMR methodology. AMR leader’s task is to guide the rationalisation team through the methodology and ensure that each step is sufficiently debated and recorded to the satisfaction of all team members before proceeding to the next step.

Furthermore, the AMR leader should function as a facilitator, ensuring that each member provides input into the exercise and amongst others, end debates when these are no longer productive.

The AMR leader must have attended the at least one major AMR exercises before he/she can be considered as a potential leader. The candidate will be assessed by the CFDH C&A (UES) and if found competent he will be certified as a Leader.

The leader shall be completely independent from the design team for the facility being classified.

UES (CFDH, Control & Automation) approves the AMR leaders and is the authority responsible for appointing a leader for any AMR study.


Printed 11/09/23



3.4.6 AMR SecretaryThe secretary is responsible to record all the alarm rationalization study review results and associated discussions. He/she should have a technical background and be fully conversant with the Alarm Rationalization study and the Master Alarm Database prepared for the project. There is no special certification requirement to be a secretary.

3.4.7 Master alarm database and reportFor each alarm function, the following data shall be recorded to create function database:

Purpose of the alarmBriefly note the design intent of the alarm

Alarm TypeAlarm types are classified into following categories. Alarm type shall be defined for each function during the study.

Standalone alarmPre alarmTrip alarmFGS alarmSystem alarmFault alarmOverride alarmCommon alarmMisc alarmDiagnostic Alarm

Consequence of No ActionBriefly note what is expected to happen if the alarm sounds and the operator takes no action at appropriate time. For pre alarms the consequence of no action should be the same as the IPF safe failure for the corresponding trip tag.

Type of ActivitySelect from Table 4-1 the appropriate type of activity, e.g. "Emergency, Plant shutdown, Normal Process Upset etc." The type of activity should be based on urgency of the required action.

The activity types are defined from the possible potential consequences so as to mean the preventive or corrective measures required.

Most likely Required Operator ActionA brief description of what the operator is most likely (80% of the case) required to do upon hearing the alarm. In some instances plant operators will be unable to do anything upon hearing an alarm. In these instances the word "Nothing" should be entered. In that case the alarm should be an "operational message only".

Less likely required Operator ActionA brief description of what the operator is less likely (20% of the case) to do when the most likely action is not appropriate.


Printed 11/09/23



Note: The list of types of activities may be extended or altered to suit local conditions and procedures.

Review if “Most likely and less likely” is required or it should be “required operator action” only.

Refer Appendix 6 for Master Alarm Database format to be used during the Alarm Rationlization exercise.

After the Alarm Rationalization exercise, an alarm study report shall be made.

Refer Appendix 2 for Alarm Rationalization Study report and close out report requirements. Any action items generated during the review exercise shall be logged and should be closed out during the course of the project.

Refer Appendix 3 for the Alarm Rationalization work process. A copy of the final Alarm Rationalization results (Master Alarm Database-as in Appendix 6) is maintained by functional control and automation project support leader. On completion of the Alarm Rationalization exercise the pdf file of close-out report and the back-up of the Master Alarm Database shall be sent to functional control and automation project support leader.


Printed 11/09/23



4 ALARM PRIORITISATION GUIDELINES

4.1 Assigning of Activities and Alarm PrioritiesFor each alarm the activity type should be defined. The table below gives the typical example of the activity type and correspondingly the action type and priority.

Alarm priorities are to be assigned based on the required action upon receipt of alarm. All alarms, including system alarms shall be prioritised. Key factors in determining alarm priority shall be; time available for operator action, consequence of failure to take corrective action and if they are HSE-critical. Priority shall be distinguished by display location and/or colour according to the guidelines in the relevant standards.

Table 4.1: Assigning of activities & alarm priorities based on urgency of operator response.

Activity Type Action Type Priority

Fire

Immediate UrgentGas release

Major rupture

Emergency

Plant shutdown

Fast HighSystem failure to plant shutdown

Major equipment shutdown

Major process upset

Equipment trip/shutdown

Normal LowNormal process upset

MOS/OOS switching

System faults, but plant in operation

Stand by in operation

Record Journal

Events

Set point changes

Mode changes

Operational messages

Raise work order (Note-6)

Notes:1. The response time available from the alarm notification to take operational

corrective action should be taken into account while determining the consequences and the priorities. In case the response time (e.g. buffer volume in separator) available is very short by which the operator’s corrective action is not possible, then the presence of that pre-alarm has no meaning and as such should


Printed 11/09/23



be removed rather than assigning with high priority.

2. Switching actions such as starting or stopping pumps or opening/ closing valves as normal (on/off) control behaviour shall not be alarms.

3. Note that separate alarm analysis shall be carried out for each different setting as they have different functions and hence different actions to be taken upon alarm. For example, a high and low alarm to the same measurement may have different operation actions.

4. In case one setting has different required actions depending on the mode of operation, the severest case needs to be assigned. Alternatively, different alarms are to be configured with the same setting of which only one is active in the appropriate mode of operation. The others are then automatically suppressed.

5. Bad Value alarms, normally configured for over or under range signals, have a potential for generating nuisance alarm floods during process upsets. They should, therefore, be used with care and not given high priorities. However critical measurements, which can lead to major upsets or shut down on failure, can be considered for high priorities.

6. Journal is selected in case work order is to be raised through work management system. Messages to be repeated to specific engineers alarm summary (if available).Note that this feature is not used at present but is planned to be used in future with SAP.

Table 4-2: Alarm Priorities – Specific Requirements. Update based on Table 4-1

Alarm

priority

U Urgent alarm (emergency)

Audible tone, printer log, events log, visual alarm, hardwired visual alarm & siren.

H High priority Alarm

Audible tone, printer log, events log & visual alarm.

L Low priority Alarm Printer log, events log & visual alarm.

J Journal Events log.

Notes:

1) The priority U effectively means that a hardwired (e.g. Fire & Gas) alarm panel is required. In case hardwired mimic panel is not provided in the facility control room, then the alarm should be made available to the system/HMI, which has at least 8 hours power back-up.


Printed 11/09/23



4.2 Guidelines for Normal Distribution of Alarms among Priority Level According to EEMUA publication No.191, Statistical guidelines for proportional prioritisation of Alarms should be as follows:

less than 5% of all alarms Should be in a process unit should be High priority

less than 15% of all alarms Should be in a process unit should be Medium priority

Greater than 80 % of all alarms in a process unit should be Low priority.

Figure 4.3: Prioritize in ProportionAccording to EEMUA Guideline the number of alarms of each priority--high, medium, low--should be proportioned as shown.


Printed 11/09/23



5 ALARM SUPPRESSION – IMPLEMENTATION GUIDELINES

5.1 Static alarm suppressionOperators often find alarm systems difficult to manage when larger quantities of alarms are (semi) permanent in alarm. There is the risk of any new alarm to stay unnoticed and the standing alarms cannot be 'meaningful' to the operator. Static alarm suppression is required in order to minimise the number of standing alarms (to achieve the benchmark as given in para 7.7).

Figure 5-1: Static Alarm SuppressionAlarms that are always in alarm when a process unit or a large piece of equipment is shut down are statically suppressed. Only after the manual suppression command and the suppression permissive are met, the alarms are suppressed.

Static alarm suppression shall be implemented on per a section (process unit, piece of equipment) of the plant, basis.

Switching on the static alarm suppression is only possible when defined process permissives are met. These conditions differ for each alarm suppression group. When, with static alarm suppression switched on, the defined process conditions are no longer satisfied, the static suppression is automatically to be switched off and a message to the operator is to be generated.

Alarms generated in the FCS/DCS from analogue inputs that are suppressed through this functionality show in the process graphic e.g. as a blue measurement. The actual alarm condition is not visible (in general no buzzer, no alarm in the alarm list, no alarm to the printer, system or measurement faults not visible). The alarm status however, is still available on the individual tag's faceplate.


Printed 11/09/23



When the alarm suppression for a group is released, the suppressed alarms are not to be

regenerated (not sounding the buzzer, flashing etc.)

When defining static alarms suppression groups, the following data shall be recorded:

Static Alarm Suppression Group and Group nameA reference tag name of the group and Group name to allow reference and proper administration.

PermissivesBoolean statement with the (FCS/DCS) tags and conditions (signals) that have to be 'true' to permit the static suppression to be switched ON. This includes the condition (alarm, H alarm, LL alarm etc.)

Static Suppression GroupThis is a list Instrument Tags to be suppressed.

Note: The static alarm suppression does not differentiate between H or L or LL alarms, Bad PV etc. All alarms associated to the listed tag number are to be suppressed. This is done to prevent alarms that are generated as a result of maintenance activities on the shut down section.

5.2 Dynamic Alarm SuppressionOperators often find alarm systems difficult to manage following a trip. The stress of the situation makes matters even worse. In order to minimise the number of alarms following the trip (to achieve the benchmark as given in para. 7.7) automatic and dynamic alarm suppression is required.

With dynamic alarm suppression, the first alarm in a group sounds the buzzer until silenced by the operator. It is shown on the alarm list and printed on the alarm printer. Subsequent alarms in the same group do not sound the buzzer, are not shown on the alarm list and are not printed.

Apart from the dynamic aspects, another difference between static suppression and dynamic suppression is that static suppression suppresses all alarms related to a tag while dynamic alarm suppression suppresses only one specific alarm. For example static alarm suppression suppresses both H, L and fault alarms while dynamic alarm suppression suppresses only H.

A soft switch shall be provided to enable dynamic alarm suppression.

Dynamic suppression will be automatically turned off after a configurable time period (default 30 min) or when all trigger alarms return to normal. See Figure 5-2.


Printed 11/09/23



Figure 5-2: Dynamic Alarm Suppression

A timer will be started when the first of the group's trigger alarms is received. Once the timer has expired any new alarm in the group will sound the buzzer but existing alarms will remain suppressed. In case the new alarm is a trigger, it will restart the timer, reinstating a further (30 min) period of dynamic suppression. The operator can choose to manually suppress the alarm group, by means of static alarm suppression, at this time if appropriate. It shall be realised however that the grouping for static alarm suppression is not necessarily the same as the grouping for dynamic alarm suppression.

The performance of the alarm suppression logic shall be such that it suppresses subsequent alarms within 4 seconds after the trigger. This is the time for the trip system to respond to a trip condition, final elements to reach their safe position and the process response to generate the next alarm. The available 4 seconds includes signal transmission via gateways and various nodes on the control system network. For alarms that come faster after a trigger, part of the suppression logic may have to be implemented in the IPS using the 'first-up' signal as the trigger.

The process graphics will show the actual alarm condition for all suppressed alarms.

Where triggers are Trip initiators, the trigger shall be disabled when the MOS is switched ON. Likewise the dynamic alarm check shall be disabled for the point as well.

In case an alarm in a group is not generated while it is expected to come on as a consequence of a trip, a common fault alarm is raised to the operator. This is a common alarm for the group, not the one related to each suppressed alarm. In case the operator wishes to know which alarm did not come on, the alarm suppression graphic will have to be checked.

Note: Note that this fault alarm is also available when the dynamic alarm suppression is not enabled.

When defining dynamic alarm suppression groups, the following data shall be recorded:


Printed 11/09/23



Dynamic alarm Group name and descriptionThe dynamic alarm suppression group is usually a subset of the tags associated to the equipment safeguarding system (an UZ block). The Group name should be selected to show the relation with the system, e.g. 016UZ-250.

Delay before alarm on checkThe "Delay Before Alarm On Check" (the delay time the control system allows before checking to determine if all expected alarms, marked dynamic, have in fact activated) is to be 60 seconds greater than the largest individual dynamic suppressed alarm "Time for Alarm to Come Up". Each and every alarm tag, marked with a cross in the "dynamic" box, should always alarm when each and every trigger is activated.

Dynamic suppression Switch Off delayThe "Dynamic Suppression Switch Off Delay, should always be 1800 seconds unless the Delay Before Alarm On Check is 1800 seconds or more.

Dynamic Grouping CommentsComments may be added to clarify particular issues for future reference.

Dynamic Suppressed Tag numbersFor each of the Dynamic Suppressed Tag numbers the following is to be recorded:

- Tag number and service description as taken from the tag number database

- A check box indicating if the tag number also serves as a trigger

- A check box indicating if the alarm needs to be dynamically checked.

- Time for Alarm to Come Up

The “Time for Alarm to Come Up” is the estimated time (in seconds) expected for the alarm to reappear after the reset of group trigger If the time is less than 4 seconds, a remark is to be added "Fast suppression logic required" as discussed above.

Notes:

1. Group Trigger alarms will almost always be trip alarms or drive failure indicators. If the group trigger is not an alarm (e.g. a motor running status) and therefore not in the database the tag should be added. All new trigger tags added that are not alarms should be "record only".

2. In some instances dynamic suppression will need to be applied to groups not related to a particular equipment safeguarding system. For these cases a new dynamic suppression group tag number will need to be defined. The tag may be based upon sequence logic blocks (KS blocks) or on the major trigger tag for a group. For example if the major trigger tag for a group not related to a safeguarding system, was 214LZA555 then the dynamic suppression group tag could be 21 4UL555 (U standing for Multivariable).

3. A trigger alarm can be suppressed. However the actual trigger shall not be suppressed.

5.3 Dynamic mode dependent alarm settingsDynamic mode dependent alarm setting may be required to further reduce the meaningless alarm rate. Mode dependant alarm setting may be required where systems have distinct operational modes that require distinct alarm settings. This is for instance the case for furnaces having a normal mode and a decoke mode. Also the


Printed 11/09/23



burner management system may have Oil firing mode, a Gas firing mode and a combination of both (dual-firing mode). A dryer will have an operating and a regeneration mode. A crude distiller may have different alarm settings depending on the crude being processed.

With dynamic mode dependant alarm settings, the alarm settings of analogue or digital points are changed based on the detected mode of operation. The mode switching is detected from a set of process parameters and may also involve a manual switch.

Upon a detected mode change, the new set of alarm settings is automatically downloaded into the FCS/DCS point. These new settings will be applicable until the next mode change is detected or the dynamic mode dependant alarm setting enable switch is disabled. When disabled the default set of settings is downloaded into the FCS/DCS point automatically See Figure 5-3.

Figure 5-3: Dynamic mode dependent alarm settingsWhen none of the defined modes are detected, the default mode shall be selected automatically.

Dynamic mode dependant alarm setting shall not be normally applied to IPF's of SIL1 and above, since these settings are based on the excursion of safe operating envelops that should not be mode dependant. Where mode dependent settings are absolutely essential for some IPF’s of SIL1 and above, then the complete mode selection and control should be implemented in the IPS using special algorithms to assure the IPF class integrity. Where pre-alarms are also used to alarm excursion from the normal operating envelope, they may have dynamic mode dependent alarm settings.

Alarm setting changes (each mode change) shall be logged in the FCS/DCS for each point.

When defining Dynamic mode dependant alarm setting groups, the following data shall be recorded:


Printed 11/09/23



"Mode dependant alarm setting " Group name and description For each Mode, a reference tag name of the group and Group name shall be recorded and maintained to provide documentation and support system administration. The group name and description should give a reference to the system (e.g. furnace) having the different operating modes.

Various Modes names and description For each Mode, a reference tag name of the mode and operating mode name shall be recorded and maintained to provide documentation and support system administration.

Permissives and CommentsFor each Mode, a boolean statement shall be developed complete with the (FCS/DCS) tags and conditions (signals) that have to be 'true' or 'false' to detect the mode switch. This includes the condition (alarm, H alarm, LL alarm etc.). Conditions may include timers to limit the time a particular mode may be on.

"Mode dependant alarm setting " Group with default settings This is a list with Instrument Tags (and attribute such as L, HH etc.) to be manipulated including the default settings.

Alarm settings for each defined mode This is a list of alarm settings for each instrument tag defined in the dynamic alarm settings group. A detailed alarm setting list should be prepared for each dynamic mode of operation defined in the list identifying the various operating modes.

CommentsComments may be added for each instrument tag to clarify particular issues for future reference.

The lists "Various Modes", "Mode dependant alarm setting Group", "Alarm settings for each defined mode" and "Comments" are best combined in tabular form where instrument tags are listed vertically in the first column and the default and mode dependant settings are listed in subsequent columns.


Printed 11/09/23



6 OPERATOR’S HELP MENUA good alarm system should assist the operator in evaluating the situation, which is fundamental to identifying the correct actions. Depending on the circumstances, these actions can be directed either at avoiding an event or mitigating its consequences.

This will help to improve the overall alarm response time as visualised in Figure 1-2.

Therefore ‘operator’s help’ should be available to each alarm. The operator may request for help by clicking on the alarm-line on the alarm summary or on the process graphics. A window should appear showing the data initially entered as recorded:

Purpose of the alarm

Consequence of No Action

Type of Activity

Most likely required Operator Action. (containing context sensitive buttons to check other data)

Less likely required Operator Action (containing context sensitive buttons to check other data)

The data tables containing these help texts should be easily maintainable by an assigned operator acting to collect the best practices for alarm responses.


Printed 11/09/23



7 ALARM MANAGEMENT PERFORMANCE MEASUREMENTThe extent as to how successful the alarm system is in presenting the operator with meaningful alarms at an acceptable rate can be measured using benchmarks. Benchmarking the alarm system provides the means for possible improvement measures to those areas where the system is weakest and to those measures that score the highest effect.

This paragraph below gives an extract from the guidelines given by EEMUA for the measurement of the performance, i.e. the capability of the alarm system to provide 'meaningful alarms'.

The following benchmarks are recommended to be used to assess the alarm system performance:

The number of configured alarms per panel operator

The average alarm rate per operator

Indication of frequent alarms

The Mean Time Between Alarm

Number of alarms following a trip

Number of standing alarms

Following paragraphs discuss each of the benchmarks. These factors should be considered in any new design as well as during the audit of an existing system.

7.1 The number of configured alarms per panel operatorThe more alarms that are configured per panel operator, the higher the average alarm rate will be. Therefore, by limiting the amount of alarms configured per panel operator, the more likely the average alarm rate will remain within acceptable limits.

If alarm suppression techniques can or will not be implemented the number of alarms should be limited to some 1000 per panel operator. The more this quantity is exceeded the more likelihood alarm management problems will exist.

When many more alarms are configured per panel operator, a check could be made on the number of alarms that should be expected to be configured per instrument. The values given in Table 7-1 below are only indicative, but provide an indication as to whether designers are likely to have installed too many or too few alarms on a plant.

Table 7-1: Guidance on alarms per instrument

Low Average High

Alarms per control valve

Alarms per analogue measurement

Alarms per digital measurement

1

0.5

0.2

4

1

0.4

6

2

0.6

The total number of alarms "Low", "Average" and "High" are calculated by adding the number of alarms to be expected per control valve, analogue measurement and digital measurement. Trip transmitters should also be counted as analogue measurement, trip switches (e.g. pressure switch) as digital measurement.

A controller (analogue measurement, controller and control valve) shall be counted as 'control valve' (without an additional analogue measurement).

The figures in Table 7-1 apply to continuous processes. For batch processes these values should not be used for benchmarking.


Printed 11/09/23



7.2 The average alarm rate per PANEL operator The following Table 7-2 provides benchmarks for average alarm rates:

Long term average alarm rate in steady operation

Acceptability

More than 1 per minute

One per 2 minutes

One per 5 minutes

Less than one per 10 minutes

Less than one per hour

Less than one per 2 hours

Unacceptable

Over-demanding

(industry average in HSE survey)

Likely to be over demanding

Very likely to be tolerable

Good

Excellent

This table is based on an average response (acknowledge and consideration) time of 1 – 5 minutes for an alarm. As the operator also has other plant supervisory duties and tasks, and alarms may come in bursts rather than in a steady rate over longer time periods, the average alarm rate should be significantly less than 1 per 10 minutes.

7.3 Indication of frequent alarmsOften a very small number of alarms have a large contribution to the alarm rate. In some instances only 5% of the configured alarms contributed to 50% of the alarms generated! By analysing the frequency distribution of the alarms generated both in steady state and during upset conditions, one may achieve significant improvements in the performance of the alarm system with relative little effort.

7.4 The Mean Time Between AlarmOften the same alarm is alarmed soon after corrective action has been taken. The mean time between a repeat alarm is an good indication of how successful remedial action has been. The benchmarks for MTBA are shown in Table 7-3.

Table 7-3: Benchmarks for MTBA

Mean Time between repeat alarm Acceptability

Less than 3 day

Less than 1 month

Less than 1 year

more than I year

Unacceptable

requires urgent improvement

manage to improve

Good

7.5 Number of alarms following a tripOperators often find alarm systems difficult to manage following a trip. The stress of the situation makes matters even worse. A good performance indication for proper alarm management is the number of alarms in the 1st 10 minutes following a trip.

The following Table 7-4, shows performance indicators for the number of alarms following a trip. The table is again based on an average of 1-5 minutes required to handle a meaningful alarm.

Table 7-4: Performance indication for the number of alarms following a trip


Printed 11/09/23



Number of alarms displayed in 10 minutes following a major plant upset

Acceptability

more than 100

20-100

under 20

Definitely excessive and very likely to lead to the operator abandoning use of the system.

Hard to cope with

Should be manageable - but may be difficult if several of the alarms require a complex operator response

7.6 Number of standing alarmsOperators often find alarm systems difficult to manage when larger quantities of alarms are (semi) permanent in alarm. There is the risk of any new alarm to stay unnoticed and the standing alarms cannot be 'meaningful' to the operator.

Alarm systems should have less than 10 standing alarms per operator. When the alarm system is capable of 'shelving' of alarms (Shelving is a facility where the operator is able to temporarily prevent an alarm from being displayed to him when it is causing him nuisance) the number of shelved alarms shall be less than 30 per operator.

7.7 BenchmarkingThe performance of the completed alarm management system needs to be bench marked. For new projects this is best done as part of the integrated FAT, by defining typical alarm scenarios (simulation) and test if the alarm system will lead to information overload of the operator during normal, process upset and trip conditions. If the information leads to an overload situation as measured against benchmarks, the system needs to be refined and tested again.

The performance may be evaluated under actual field conditions if Operations report that the performance is still not satisfactory with changes implemented accordingly until desired improvements have been obtained. After the system is commissioned and fully operational, the alarm summary shall be evaluated and the findings summarised and compared against the benchmark values in table 7-5.

The performance of an alarm management system can be summarised and benchmarked in the Table 7-5.

Table 7-5: Score chart for alarm management systems

Performance Indicator Score description Score

Number of configured alarms per panel operator

>> 3000

3000< Qty <1000

< 1000

0

0.5

1

Average alarm rate per panel operator

more than I per minute

more than one per 10 minutes

more than one per 1 hour

more than one per 2 hour

0

0.5

1.5

3.5

Frequent alarms per panel operator

5% of configured alarms cause 50% of alarms


0

0.5


Printed 11/09/23




1.5

Average Mean Time between Alarms

Less than 3 day

Less than 1 month

Less than 1 year

more than 1 year

0

0.2

0.5

1

Alarms following a trip per panel operator

more than 100

20-100

under 20

0

1

2.5

Number of standing alarms per panel operator

More than 30

More than 10 and less than 30

less than 10

0

1

1.5

Total score 1-10 Score <7 : Not satisfactory, requires improvement.

7 : Average

8 to 9 : Good

10 : Excellent

7.8 ImprovementIf the alarm system requires improvement on one or more areas (performance indicators as listed in Table 7-4) the proposed changes should first be evaluated for effectiveness.

This is completed by capturing the alarm scenarios followed by evaluating the effect of the proposed changes on the performance of the alarm system. E.g. when alarm suppression techniques are proposed to reduce the number of alarms following a trip, one should evaluate which alarms will be suppressed from the actual alarms presented to the operator following a number of trips (alarm scenarios) and to what extent this results in a significant improvement.

7.9 Overall Alarm Management processThe problems seen in FCS-based alarm systems are often too great to be addressed simply by reviewing one alarm parameter alone, such as priority assignments. It is usually necessary to:

- substantially reduce the total number of alarm points;

- reduce the frequency at which the remaining alarms are triggered;

- help the operator to recognise the most important alarms during an upset.

Ideally, all of the key parameters for any point should be reviewed by asking:

- Is an alarm on this point helpful to the operator?

- How will it behave in routine process upsets?

- How will it behave during start-ups, when alarm flooding is common?

- What priority setting should it be given?


Printed 11/09/23



- What is the optimum trigger point (i.e. the numeric setting of the alarm)?

- How wide a dead band can be set?

- Is there any advantage in a time delay or similar feature?

However, whilst a rigorous approach should be applied to the alarm configuration in a new-build design, the effort required for a point-by-point review of all alarms in an existing installation can be prohibitive. Instead, a more pragmatic approach is needed, seeking to maximise the benefits from the effort applied.

The objective of the alarm management process is to provide a structured way to carry out alarm management. The process is different for new facilities and for existing facilities as shown in Figure below. Therefore alarm management may be split into 3 elements:

- For new installations: Alarm system design

- For existing installations: Alarm rationalisation or alarm system re-design

- During operation: Alarm handling.

Establish alarm system KPIs

Alarm system Basis of design

Existing or new plant

For each alarm

KPIs OK?

Finished

yes

new F&G alarms

Diagnostic alarms

Alarm narrative typicals

Manual trip alarms Process alarms

Establish bad actors DCS

Are there obvious bad actors?

no

Establish alarm system KPIs

For each bad actor

yes

Start

KPIs OK? yes no

no

existing

Alarm work process (see Figure 4)

Design Alarm system

Alarm work process (see Figure 4)

Update Alarm system

Establish overall alarm philosophy

The overall alarm management process

New facilties:


Printed 11/09/23



For new facilities, the alarm system design is part of the engineering effort. In this case the aim is to realise an alarm system that performs satisfactorily from the initial start-up onwards. If this is not (yet) the case, the alarm system is further treated as an existing alarm system.

For a new facility the alarm system design process first defines the alarm philosophies and generic configurations. This again results in templates that include the handling of fire & gas alarms, diagnostic alarms, alarms related to manual trips and common alarms.

For new facility, all configured alarms shall either be assigned to one of the pre-defined alarm categories (templates) or analysed individually. Individual analysis is potentially a time-consuming exercise, hence the maximum use of templates.

For each configured alarm that does not fall into one of the predefined categories (templates), the review mainly establishes the priority (including whether the alarm is really required) and the optimum parameters such as setting, dead band and signal filtering. If required to achieve an acceptable performance, any required alarm suppression techniques are identified. Additionally the opportunity is taken to record the purpose of the alarm, the consequence of no action and the possible operator responses.

Following the realisation and commissioning of the alarm system, the performance of the alarm system is measured. If performance is satisfactory, the review process is completed. If performance is not acceptable the further improvement effort follows the same process as for an existing plant.

Two phases

The alarm study (or alarm review process) is split into two phases. The first phase of the alarm study is intended to establish whether an alarm is really necessary or appropriate, or whether the risk associated with the hazardous situation becomes ALARP with an alarm.

If there are doubts whether the risk is ALARP, the IPF method or HEMP method should be applied.

The first phase also establishes expected operator response times, process safety time and the severity of consequences if the alarm is not responded to. By means of Figure 10, the alarm priority is derived from the process safety time and the severity of the consequences.

The second phase of the alarm study establishes the required operator actions, suppression requirements and other relevant parameters.

Existing facilities:

For existing facilities, the alarm rationalisation and alarm system re-design aims to restore the performance of an existing alarm system to satisfactory levels. Quick gains are important and a more pragmatic approach is needed, seeking to maximise the benefits from the effort applied.

For an existing facility, the HAZOP study may not be complete or may be absent altogether. The alarm setting documentation may be incomplete and settings may have developed over time to levels that are ill advised. Therefore, for existing facilities, the alarm settings/ limits shall be confirmed and re-defined, based on an understanding of the process and equipment constraints, process dynamics, operator response times etc.

For existing facility the alarm rationalisation and alarm system re-design initially concentrates on bad actors that make a disproportionate contribution to the poor performance of the alarm system.


Printed 11/09/23



However, before the bad actors are analysed, alarm philosophies and generic configurations need to be agreed upon. This process produces templates for F&G alarms, diagnostic alarms (alarms that indicate possible malfunctioning of instruments or equipment that may not immediately result in a process upset), alarms related to manual trips and common alarms. These templates (generic configurations) allow these alarms to be applied in a consistent manner throughout the alarm listing without further detailed analysis..

For each bad acting alarm, the alarm work process mainly establishes the priority (including if the alarm is really required) and the optimum parameters such as setting, dead band and signal filtering. If required to achieve an acceptable performance, any required alarm suppression techniques are identified. Additionally, the opportunity is taken to record the purpose of the alarm, the consequence of no action and the possible operator responses.

The bad actor analysis is repeated until either the alarm system performance (KPIs) is acceptable or no obvious bad actors are left. In the latter case the improvement effort follows the same process as for a new plant.


Printed 11/09/23



8 REFERENCESIn this document, reference is made to the following main publications.

NOTE Unless specifically designated by date, the latest edition of each publication shall be used, together with any amendments/supplements/revisions thereto.

Document name Document No. PDO ref. No (if applicable)

STANDARDSHuman – Machine interface in a control room DEP32.00.00.11-PDO SP1192

Measurement Validation and Comparison MF 94-0495

Classification and implementation of instrumented protective functions

DEP32.80.10.10-GEN, Oct.2001

Instrument engineering procedures DEP32.31.00.10

Instruments for measurement and control DEP32.31.00.32

Instrumented Protective systems DEP32.80.10.30

Fire, Gas & Smoke detection system DEP32.30.20.11

EUROPEAN STANDARDSGeneric standard on “Functional safety of Electric/ Electronic Programmable (E/E/PES) safety related systems”

IEC 61508

Specific standard for the Petrochemical industry on “Functional safety of Electric/ Electronic Programmable (E/E/PES) safety related systems”

IEC 61511

INDUSTRY PRACTICESEEMUAEngineering Equipment & Materials Users Association

191


Printed 11/09/23



Appendix 1 – Typical ARM Info Pack

Typical AMR Info PackDocuments / Information required for AMR

1. Process Engineering and Utility flow schemes (PEFS /UEFS)

2. Process flow schemes (PFS) and Process safeguarding flow schemes (PSFS)

3. Cause & Effect matrices including fire and gas detection system

4. IPF Classification report (for reference, if available).

5. Operating philosophy or plant operating manuals.

6. Control & Safeguarding narratives

7. List of alarm & trip set points (alarm & trip database)

8. Master Alarm Database

9. List of Standing Alarms during typical steady operation (applies to existing facilities)

10. Alarm Journal printouts following typical upsets (applies to existing facilities)


Printed 11/09/23



Appendix 2 – AMR Report/Close Out Report

TABLE OF CONTENTS

1.0 Introduction

2.0 Process Description

3.0 AMR Team and Meeting Details

4.0 AMR Basis & Assumptions

5.0 Action points

Annexure

1. PSFS/PEFS2. Cause & Effect Diagram.3. Alarm Rationalisation database4. Action Point Close out5. Variance Logs


Printed 11/09/23



Appendix 3 – AMR Work Process

AMR Work Process Activity Action Party

ARRANGE AMR MEETING (6 weeks prior to actual AMR date)

Request UES for AMR Facilitator PDO PE using AMR Web tool

Arrange AMR Secretary Contractor / Consultant (Project Engineer)

AMR INFORMATION PACKAGERefer Appendix 1

for Typical AMR info packContractor / Consultant

AMR MEETING PREPARATION

Function Identification AMR Secretary in consultation with AMR Facilitator

Alarms into AMR Database (Master Alarm database)

AMR Secretary

Contractor / Consultant

AMR CLASSIFICATION MEETING

Invite participants PDO PE

Arrange Facilities Contractor / Consultant (Project Engineer)

DRAFT AMR CLASSIFICATION REPORT

Print AMR Classification sheets

Print of Action points

Note : Design team to proceed with close-out of AMR and action points on receipt of the

above sheets

AMR Secretary (within 5 days)

AMR CLOSE-OUTS

Prepare AMR report including

Master Alarm Database

Alarm function database & report

Contractor / Consultant

Report review PDO Project C&A Engineer

AMR ACTION CLOSE-OUT MEETING (if required) Invite participants from the AMR PDO / Contractor / Consultant

(Project Engineer)

AMR FINAL REPORT

Compilation of the final report consisting of AMR worksheets, PEFS, C&E, Alarm Master

Alarm Database, Alarm prioritisation etc.Contractor / Consultant

Report Approval PDO TA-2 Approval

Distribute copies to project team and issue one hardcopy (master) including electronic copy (pdf version, with links from Table of contents to individual section) of final report

to UES

Contractor / Consultant (Project Engineer)


Printed 11/09/23




Printed 11/09/23



Appendix 4 – AMR Workshop Request


Printed 11/09/23



Appendix 5 – Abbreviations

ALARP As Low As Reasonably Practicable

CFDH Corporate Functional Discipline Head

DCS Distributed Control System

EEMUA Engineering Equipment & Materials Users Association

ESD Emergency Shut Down

FCS Field bus Control System

FGS Fire, Gas and Smoke Detection System

HSE Health, Safety, and Environment

IPF Instrumented Protective Function

IPS Instrumented Protective System

MAD Master Alarm Database

PLC Programmable Logic Controller

PV Process Variable

SIL Safety Integrity Level

AMR Alarm Management and Rationalisation


Printed 11/09/23



Appendix 6 – Master Alarm Database to be used for Alarm Rationalization Exercise


Printed 11/09/23



Appendix 7 – Summary of Changes

Summary of Changes at Revision 2The previous edition of this guideline Dec 2005. Other than editorial changes, the following are the main changes since that edition:

Section 1.2 – Scope & Objectives - 3 types of operator roles included.

Section 3.1 – System alarms included

Section 3.2 – included – Deadbands, Alarm Delay options, Alarm Shelving, BAD VALUE Functionality, Improved Alarm displays, Master Alarm database.

Section 3.3 - Alarm Management and Rationalisation Review Process included as flow chart in Appendix 3.

Section 3.4.1 & 3.4.3 – additional sub points included.

Section 3.4.5 - AMR Facilitator & Section 3.4.6 - AMR Secretary included.

Section 7.9 added

Appendix 1 - Typical ARM Info pack included

Appendix 2 - Typical ARM Report / Close-out Report included

Appended 3 - AMR Work Process included

Appendix 4 - AMR Workshop Request included

Section 2.3 Abbreviations included in Appendix 5

Appendix 6 - Master Alarm Database to be used for Alarm Rationalization Exercise included.


Printed 11/09/23
