White paper

Alarm Management for power generation

Definition of the term “alarm” The definition means that an alarm must indicate a problem, not a
The concept of alarms (French for “a l’arme” which means normal process condition. The main target audience of an alarm
“spring to arms”) is very old and originates from the military should be operators, not engineers, maintenance technicians, or
concept where a guard warns his fellows in case of an attack. In managers.
process control, alarms have a very long tradition (eg, a whistle
indicating that water is boiling). Older plants were using panels Today’s reality in many plants is different: most of the occurring
with bulbs and bells to alarm the operators. alarms have little or no value for the operators. The supervision of a
process is usually supported by an alarm system.
Unfortunately in many of today’s power plants, an alarm means
something very different: some value has exceeded a threshold, Human capacity is limited
resulting in a cacophony of alarms with most of them having no Theoretically, every alarm shown to the operators should be
value at all for the operator. meaningful and require operator action (see EEMUA 191). EEMUA
191 has emphasized the fact that the human capacity to absorb
Alarm configuration seems to be an easy task alarms is limited. If this limit is exceeded for longer periods of time,
The configuration of alarms historically has been expensive, it is likely that important alarms will be overlooked, and in extreme
because each alarm required extra hardware and wiring. Therefore cases the whole alarm system might be more or less ignored.
the designers of a plant put considerable thought in the decision of
whether an alarm was meaningful or not. This form of implicit alarm The guideline EEMUA 191 published first in 1999 and the standard
management often resulted in good quality operator interfaces. In ISA 18.2 published in 2009 have profoundly changed the way
the current generation of control systems, the cost associated with alarms are engineered in modern control systems.
alarm configuration has been significantly reduced. Therefore, it is
easy to configure several alarms on each and every tag. EEMUA 191 focuses on the properties of the operator’s information
processing capabilities. It emphasizes the usability of an alarm
Project engineers tend to hesitate before removing an alarm when system from the operator’s perspective. If the operator is
unsure if the alarm is relevant. Modern field devices are able to overloaded with alarms, the whole alarm system becomes useless.
generate a multitude of diagnostic messages, many of them issued The document specifies several measurable performance
as alarms. This typically results in huge amounts of configured indicators that can be used to benchmark a plant’s alarm system
alarms. As a consequence, during plant operation, operators performance, for example:
receive huge amounts of alarms, even during normal operation. -- Long term average alarm rate in steady operation: less than
Today it is very common to receive more than 2000 alarms a day 1 alarm in 10 minutes
per operator. Most of those alarms are nuisance alarms that -- Number of alarms during first 10 minutes after a major plant
provide no value for the operators. upset: under 10
-- Alarm priority distribution: high (5%) - medium (15%) - low (80%)
Permanent high alarm rates indicate bad alarm quality -- Average fewer than 10 standing alarms.
More and more companies understand that these high alarm rates
are not acceptable and have an adverse effect on operator Priority distribution report

effectiveness. Alarm system quality improvement projects – often

with the help of external consultants – can rapidly result in 108 715 -58%
impressive alarm rate reductions, eg, by 50% or more and actually 44 084 24%
lead operators to perform their jobs more effectively. But due to the 34 019 18%
dynamic nature of the plant, the peak level of alarm system quality
will degrade over time after it has been reached. If it becomes part
of the daily work procedures to manage the alarm system quality,
the plant staff can ensure that the alarm system continues to be a Of course these figures are only rough estimates and need to
useful tool ensuring safe and efficient plant operation. be adapted to the specific requirements of an individual plant.

An alarm is an audible and/or visible means of indicating to

the operator an equipment malfunction, process deviation,
or abnormal condition requiring a response.
Definition of the term “alarm” according to ISA-18.2
Guidelines and standards

The Engineering Equipment and Materials Users Association EEMUA 191

(EEMUA) published the first edition of their document 191 In 1999, the Engineering Equipment and Materials Users
“Alarm Systems” in 1999 and the second edition in 2007. ABB Association (EEMUA) produced its Publication 191, “Alarm
was actively involved in the writing of EEMUA 191. Since 1999 Systems, a guide to design, management and procurement”.
several other guidelines, standards and books on alarm EEMUA is a non-profit distributing, industry association run for
management have been written, all in the spirit of EEMUA 191. the benefit of companies that own or operate industrial facilities.
The new standard ISA SP 18.2 “Management of Alarm Systems
for the Process Industries” was published in 2009. EEMUA 191 has become the worldwide de-facto standard for
Alarm Management. It explains how the quality of alarm
Guidelines like EEMUA 191 and ISA SP 18.2 rapidly gained systems should be managed.
worldwide acceptance as good engineering practice for alarm
management. Today, the Standard ISA SP 18.2, which builds A key idea of EEMUA 191 is that the cognitive resources of
on the guideline EEMUA 191 can be seen as the most operators are limited and therefore should not be overloaded
normative alarm management document. with alarms. The conclusion is obvious: every alarm should be
useful and relevant to the operator. There should be no alarm
Alarm states and transitions without a predefined operator response.
start
EEMUA 191 introduces several easy to measure Key
Performance Indicators (KPI) that allow to estimate the quality
Condition State:
Inactive, Acked
of an alarm system.

The common expectation is that operators should never overlook

important alarms. However it’s important to understand that human
Alarm Condition State:
acknowledged Active, Unacked operators have a limitation to the extent to which they can operate
effectively to a period of high level uploading. EEMUA 191
recommends that the alarm rate in normal operation should be
Alarm becomes Condition State: below 1 alarm in 10 minutes.
Alarm
inactive Inactive, Unacked becomes inactive
EEMUA 191 is a guideline for Alarm management and not
Condition State: mandatory. The document is recognized by a number of regulatory
Alarm
Active, Acked acknowledged bodies as good practice. EEMUA 191 focuses on the properties of
the operator’s information processing capabilities. It emphasizes
the usability of an alarm system from the operator’s perspective.
A second version of EEMUA 191 was published in 2007.
Report of alarm performance levels
1000
Average alarm rate (alarms per 10 minutes)

overloaded

100

reactive

10

robust stable

predictive

10 100 1000
Maximum alarm rate (on 10 minute time base)
Settings
From: 01.09.2008 00:00:00 To: 01.10.2008 00:00:00
First: 01.09.2008 02:03:01 Last: 30.09.2008 23:45:56

2 Alarm Management for power generation

ISA SP 18.2 As was discussed with EEMUA 191, ISA SP 18.2 proposes Key
The ISA SP 18.2 standard “Management of Alarm Systems for Performance Indicators (KPI). These KPIs are easy to measure
the Process Industries” has been published in 2009. The and can be used to estimate the quality of an alarm system.
committee has wide representation from users, vendors and Measuring the alarm system quality is an important precondition
consultants. As ISA SP 18.2 is based on work and ideas from for quality control and quality improvement – because only what
EEMUA 191 and is a standard (not a guideline as EEMUA 191), is being measured can be controlled. Depending on industry
it is likely that ISA SP 18.2 will take over the role of EEMUA 191 and site-specific requirements adaptations of these KPIs will
as the worldwide de-facto standard for alarm management. make sense. The important step is to define KPIs and
continuously monitor them.
The scope of ISA SP 18.2 is to establish terminology and
practices for alarm systems, including the definition, design, ABB’s alarm management vision
installation, operation, maintenance, modification and work ABB has a long-term involvement in and a strong commitment
processes recommended to effectively maintain an alarm to standards like EEMUA 191 and ISA SP 18.2. Involvement
system over time. Alarm system management includes multiple with these standards coupled with ABB’s long-term experience
work processes throughout the alarm system life-cycle. with all sorts of power plants, has lead to the following vision
for alarm management:
-- Each alarm should alert, inform and guide
-- Alarms should be presented at a rate that operators can
Alarm Management Lifecycle as defined in ISA 18.2 deal with
-- Detectable problems should be alarmed as early as possible
-- Cost/benefit of alarm engineering should be reasonable
Philosophy

The Symphony Plus HMI, S+ Operations, implements ABB’s

Identification
newest technologies to bring this vision to reality. Regarding
the alarm system, there are two parts that can be distinguished
but not separated:
Rationalization Management -- Technical optimization of the alarm system
of -- Optimization of the HMI
Change
Detailed Design Audit Both parts together form the S+ Operations Alarm
Management System.
Implementation

Operation
Monitoring &
Assessment
Maintenance

Alarm Management for power generation 3

 Alarm management lifecycle

Optimizing the alarm management system Alarm engineering

Alarm states and transitions
Stringent alarm management begins in the planning phase and Alarm engineering is the process of configuring and reviewing
accompanies the plant operation as a continuous improvement alarms against the principles of the alarm philosophy and
process: since the plants constantly change, the alarm determining and documenting the rationale and design
management system has to be checked regularly and modified requirements for the alarm. This includes the basis for the
if necessary. alarm setting, the consequence of deviation, and corrective
action that should be taken by the operator. Further
In reality, the alarm management system also has a life cycle rationalization also includes the prioritization of alarms based
for the conception, application and maintenance of the on the mechanism defined in the alarm philosophy or its
corresponding systems that consists of several phases: removal.
-- Definition / engineering
-- Measurement Alarm analysis
-- Analysis To sustain effective operation of a plant, it is important to have
-- Optimization / rationalization a well-configured alarm system and to measure and analyze
this system constantly.

ize De
The alarm philosophy document defines the KPIs describing
it m the required alarm system quality. In the initial plant setup
Op

these KPIs may (or may not) reach the desired quality. But a
fin

plant usually changes all the time (modifications, extensions,

e

wear and tear) and it cannot be assumed that a once reached

Alarm quality level can be kept for long periods. Therefore a
continuous monitoring mechanism needs to be implemented,
that compares the current with the desired quality level.
Ana

ze Regular measurement of the alarm performance indicators is

ly

re

u
as crucial for maintenance and optimization of the system. Alarm
Me management is often implemented as part of the continuous
Define – Measure – Analyze – Improve – Control (DMAIC) cycle
in Six Sigma programs.
Alarm management system Systematic alarm management usually reveals weak spots in
Careful planning and conception is as important for the alarm the plant and can therefore help to directly improve plant
system as it is for the whole plant. The same applies for performance.
documentation - it is equally important for the whole plant as
for the alarm management system.

S+ Operations’ historic trend data

Alarm philosophy document
The first step in implementing an alarm management system
should be a plant-wide and plant specific alarm philosophy
document that describes how alarms should work in a plant. It
defines a consistent alarm philosophy for all systems
generating alarms in the plant.

The alarm philosophy document is the basis for the specification

of the alarm attributes in S+ Operations. This includes the basic
alarm system (thresholds, priorities, grouping, etc.) as well as
more advanced alarming techniques like state-based alarming
or the presentation of alarms in the operator station (HMI).

4 Alarm Management for power generation

Alarm frequency analysis

The operator guidance given by a high quality alarm system will Alarm simulation
further improve the plants performance. Alarm measurement and alarm analysis are essential for
permanent alarm management optimization. But advanced
If the alarm system quality has degraded, the reasons for this alarm management does not end there. S+ Operations‘
degradation need to be analyzed, and actions to fix these modern alarm management system in combination with the
problems need to be performed. For example if new operating information management system supports advanced
procedures are driving the process more to its borders, the old techniques like alarm simulation.
alarm thresholds might be too tight and might need to be
adapted to the new operating procedures. If a broken While analyzing the plants alarm system, this technique allows
measurement instrument permanently generates alarms, this the simulation of changes in alarm limits, thresholds and other
instrument needs to be repaired or exchanged. alarm values to get information with which alarm system
configuration values the optimum results are to be achieved.
With S+ Operations, the measurement of alarms and events is Alarm simulation allows the simulation of value changes for
very easy: its patented integrated information management single alarms as well as the simulation of alarm grouping,
system simply logs every system event within a milliseconds state-based alarm hiding and other simulations.
resolution and makes data easily available for further
processing. Alarm analysis and alarm simulation pave the way for the
optimization and rationalization of the existing alarms.
Standard alarm reports (EEMUA 191 and ISA SP 18.2
compliant) are already integrated and preconfigured eg, Alarm optimization
- - Most-frequent alarms During alarm optimization the results of alarm measurement,
- - Longest-standing alarms analysis and simulation are transferred to the plant.
- - Average time to acknowledge alarms over time (trend)
- - Alarm priority distribution Alarm management lifecycle
- - Number of disabled alarms, inhibited alarms, shelved alarms Since the plants constantly change, the alarm management
and hidden alarms over time (trend) system has to be checked regularly and modified if necessary.

Individual reports for every desired time frame and every

Alarms over time analysis
desired range of alarms can easily be generated by an easy to
use drag-and-drop interface.

With these reports, it is easy to determine which alarms cause

the most disturbance and which are nuisance alarms.

Alarm Management for power generation 5

Improving Operator effectiveness

Alarm summary data values

When an alarm is triggered, an operator’s response is based
on the information and sequence of events data available via
the alarm list. The better this list is, the more appropriate the
operators’ reaction and the quicker the problem gets resolved
in the manner intended.

The way an alarm is presented thus dictates how effectively it is

handled. In S+ Operations alarm management for example,
operators can acknowledge all visible alarms, and enter comments
for individual alarms that are recorded in the events list. Navigation
to the corresponding event list is simple and direct. Alarm shelving

Direct navigation from alarm list to actual values and related information Alarm hiding is set up during the engineering phase. Its main
purpose is to suppress alarms that are either expected or not
relevant in a particular situation, or that are based on a known
process state eg, low temperatures or flow during a controlled
shutdown. As the name suggests, ‘hidden’ alarms are never visible
to operators. They only see alarms that require action on their part.

Alarm shelving
Shelving lets operators decide whether or not to put an alarm
‘on the shelf’ for a defined period of time or a certain
occurrence. This temporarily removes it from the main alarm
list to a special list, but the alarm itself is not affected. It will
later require attention from the operator. In the meantime, the
operator can concentrate on tasks judged to require their
immediate focus. Simple navigation makes alarm shelving a
valuable and much-appreciated tool that helps operators work
with maximum efficiency.
The visible part of S+ Operations alarm lists always gives direct
access to the actual values of the parameters that have S+ Operations alarm grouping
triggered the alarm. For example, when operators are alerted
that the amount of liquid in a tank has fallen below a specified
level, they can see exactly what the current level is. Their
response can thus be based on whether it is just below or way
below.

Additionally statistical evaluations are integrated directly with

the message client to improve the search for each cause of
disturbance.

State-based alarm hiding removes unnecessary alarms

Optimizing operator workload improves effectiveness,
especially during critical situations, this is a key function of
alarm hiding and alarm shelving.

6 Alarm Management for power generation

 Consistent alarm-response navigation gives fast access to
essential information
Should a situation become urgent, the operator needs support
to shorten the time from the alarm occurring to finding the root
cause and taking corrective action. S+ Operations alarm
management provides this support with direct access from
the alarm message to all available, alarm-related information.

When an alarm is triggered and operators need specific

information on what that particular part is and does, as well
as how they should react, they are just one click away from the
faceplate, graphic display, operating manual or live video
image.

Implementation of the alarm system

S+ Operations alarm list
Since operators are an essential part of the alarm system,
operator training is an essential activity during system
Alarm grouping replaces long lists implementation and/or during bigger rationalization audits.
The aim of alarm grouping is not unlike that of alarm hiding and The alarm philosophy document should describe how testing
alarm shelving; to reduce the number of events listed, thereby and training have to be documented and which modifications
helping operators handle key tasks with their full, undistracted will require retesting and/or retraining.
attention.
Modern alarm management - bringing together safety and
A group alarm is a single alarm that is presented instead of effectivity
several individual alarms. The individual alarms are generally Working with a user friendly alarm management system like S+
related to a common process unit or a similar operator Operations improves an operator’s ability to navigate, analyze
response. By minimizing the number of alarm list entries that and act in a timely and correct manner. Knowing at once what
have to be read and assessed, alarm grouping helps operators an alarm means and how best to deal with it, increases plant
work more effectively. availability and thereby productivity. As well as helping secure
the investment made in the facility, this also protects the
In addition, alarm grouping also lets operators understand the individuals working there and the surrounding environment.
implications of a particular alarm for the process section under
S+ Operations alarm list
their control; not only that an alarm has been triggered for a
designated tank, but also the risk of leakage from that tank, for
example. By both reducing the number of alarms and making
them more informative, alarm grouping helps operators
concentrate on taking the correct counter-measures to prevent
or reduce damage from occurring.

In alarm systems that lack this function, the success of damage

limitation has often depended on an individual operator’s ability
to ‘piece together’ the information from several simultaneous
alarms plus their experience of what this means for the process.
With S+ Operations, piecing together a large string of individual
alarms is no longer necessary.

Alarm Management for power generation 7

Contact us

Dr. Carsten M. Beuthel

3BUS095593REVB EN US Letter Power Generation 0412

© Copyright 2012 ABB
All rights reserved. Specifications subject to change without notice. Pictures,
ABB AG schematics, and other graphics contained herein are published for illustration purposes
Power Generation only and do not represent product configurations or functionality.
User documentation accompanying the product is the exclusive source for functionality
Kallstadter Straße 1 descriptions.
68309 Mannheim, Baden-Württemberg Symphony is a registered or pending trademark of ABB S.p.A.

Germany

Email: [email protected]