ASM Abnormal Situation Management Defining the way things

ASM Abnormal Situation Management Defining the way things will be.

The birth of ASM. . . • ASM grew from an initial focus on alarm management. Most sites are aware that operator overload and alarm floods are common during abnormal operations. As we analyzed the issues around alarm management, we discovered that operator problems with the alarm system were only a symptom of a general issue: – the design, implementation, and maintenance of many facilities, systems, and practices.

ASM Consortium Current Membership: BRAD ADAMS WALK ER A R C H I T E C T U R E, P. C. University Affiliates • Charter: – Research the causes of abnormal situations and create technologies to address this problem • Deliverables: – Technology, best practices, application knowledge, prototypes, metrics • History: – Started in 1994 – Co-funded by US Govt (NIST) – Budget: +$16 M USD • Current Status: – Committed through 2002 – Honeywell leadership – Expanding membership

Requirements for Safe Operation • Hazards must be recognized and Understood • Equipment must be “fit for purpose” • Systems and procedures to maintain plant Integrity • Competent staff • Emergency Preparedness • Monitor Performance In the area of alarm management most companies fail to meet these basic requirements for safe operation

A Look At Plant Operations A typical Production Profile for an Asset Intensive Facility for a calendar year. 95 days 79 days 62 days 47 days 23 days Days per Year 30 days 16 days 8 days 5 days < 60% Daily Production Target set by Enterprise 95% 100%

Factors Affecting Plant Operations Plant Operating Target Planning Constraints Plant Availability Operational Constraints Production Effectiveness Days per Year Plant Incidents Asset Utilization Plant Capacity Limit < 60% Daily Production 95% 100% Agility/Flexibility

Real Life Examples 24. 2 M 5. 8% This plant had $24. 2 M in lost capacity due to asset availability & incidents! This plant had 5. 8% in lost capacity! This plant lost $38. 5 M! And this plant lost $33. 5 M!

Site Studies have identified Plant Lost Opportunity Between 3 -15% in Lost Capacity is attributed to asset in-availability and incidents Plant Operating Target Planning Constraints Plant Availability Operational Constraints Production Management Days per Year Plant Incidents NEW EMPHASIS!! Asset Management DCS/APC/ Optimization efforts Reliability & CMMS Plant Capacity Limit < 60% Daily Production Manufacturing Execution Scheduling & ERP 95% 100%

Major Profit Potential Emphasis on plant & equipment reliability improvements and reduced incidents can result in a recovery of 3 -15% of lost capacity! Higher Plant Operating Target Fewer Planning Constraints Days per Year Fewer Operational Constraints Plant Capacity Limit < 60% Daily Production 95% 100%

The Importance of Alarm Management Improvement Project Alarm management is the proper design, implementation, operation, and maintenance of industrial manufacturing plant alarm systems. Current alarming practices are leading to Incidents Major problem is: alarm flood Standing Alarms Poor Configuration of Alarms Nuisance Alarms Technology exists to significantly contribute to effective alarm systems and provide good Situation Awareness

Alarms identified as contribution

A Case b The lightning struck just before 9: 00 AM on a Sunday. It immediately started a fire in the crude distillation unit of the refinery. The control operators on duty responded by calling out the fire brigade, and then had to divert their attention to a growing number of alarms while desperately trying to bring the crude unit to a safe emergency shutdown. Hydrocarbon flow was lost to the deethanizer in the FCCU recovery section, which fed the debutanizer further along. The system was arranged to prevent total loss of liquid level in the two vessels, so the falling level in the deethanizer caused the deethanizer discharge valve to close. This, in turn, caused the level in the debutanizer to drop rapidly and its discharge valve also closed. Heat remained on the debutanizer and the trapped liquid vaporized as the pressure rose causing the pressure relief valve to “pop” (for the first of three times) into the flare KO drum and then immediately onto the flare itself.

continued In a matter of minutes, the board operator was able to restore flow to the deethanizer. This permitted the deethanizer discharge valve to be opened, allowing renewed flow forward to the debutanizer. The rising level in the debutanizer should have caused the debutanizer discharge valve to open (by the level controller action) and allow flow on to the naphtha splitter. Although the operators in the control room received a signal indicating the valve had opened, the debutanizer, nonetheless was filling rapidly with liquid while the naphtha splitter was emptying. The operators were concentrating on the displays which focussed on the problems with the deethanizer and debutanizer, and had no overview of the process available to indicate that even though the debutanizer discharge valve registered as open, there was no flow going from the debutanizer to the naphtha splitter. b

Despite attempts to divert the excess, the debutanizer became liquid -logged about an hour later and the pressure relief valve lifted for the second time, venting to the flare via the flare KO drum. Because there were enormous volumes of gas venting, the level of liquid in the flare KO drum was rising to a very high value. About 2 -1/2 hours later, the debutanizer vented to the flare a third time AND CONTINUED VENTING FOR 36 MINUTES. The high level alarm for the flare drum was activated at this time. But with alarms going off every 2 to 3 seconds, there appears to be no evidence that alarm was ever seen. By this time, the flare KO drum had filled with liquid well beyond its design capacity. The fast-flowing gas through the overfilled drum forced liquid out of the drum’s discharge pipe. The discharge line was not designed for liquid, so the force of the liquid caused a rupture at an elbow. This released over 20 tons of highly flammable hydrocarbon.

continued The ensuing release quickly formed an ominous drifting cloud of vapor and droplets. In a matter of minutes, this cloud found its ignition source 350 feet downwind. The resulting explosion was heard 80 miles away. In the town nearest the plant, few windows still held intact panes, so overpowering was the pressure shock wave from the blast. The last fires in the refinery were eventually extinguished 2 days later. end

Interface between the organization & the individual Management Source Failure Types Workplace Functional Failure Types Organization Stylistic or Cultural Condition Tokens Precursors Unsafe Acts Errors & Violations Individual Indicators General Failure Types Top Down: Accidents Commitment Incidents Competence Near-Misses Cognizance 1 -10 hit list data collected & analyzed Proactive Design SI Projects Poor workplace design High workload Unsociable hours Inadequate training Poor perception of hazards Alarms Human Factors Near miss Auditing Du Pont Training Workspace Motivation Attitude Safety Information System Diagnostic and remedial measures Best Practices Control room design Group Factors Working Practice

Managing Abnormal Situations Anatomy of a Disaster from Operations Perspective Operational Modes: Plant States: Disaster Emergency Accident Out of Control Critical Systems: Area Emergency Response System Site Emergency Response System Physical and Mechanical Containment System Operational Goals: Minimize Impact Plant Activities: Firefighting First Aid Rescue Bring to Safe State Evacuation Safety Shutdown, Protective Systems, Abnormal Hardwired Emergency Alarms Abnormal Return to Normal Manual Control & Troubleshooting Keep Normal Preventative Monitoring & Testing DCS Alarm System Decision Support System Normal Process Equipment, Normal DCS, Automatic Controls Plant Management Systems

Unexpected Upsets Cost 3 -8% of Capacity ~ $10 Billion annually in lost production ! Plant Operating Target Planning Constraints Operational Constraints Days per Year Summarized Production Data Optimization efforts Plant Capacity Limit < 60% Daily Production 95% 100%

Major Profit Potential Higher Plant Operating Target Fewer Planning Constraints Fewer Operational Constraints Days per Year Focused efforts can result in recovery of 3 -8% of capacity Plant Capacity Limit < 60% Daily Production 95% ~ $10 Billion potential to the bottom line! 100%

Timing diagram of DIN V 19251 as applicable for a single channel SRS with ultimate self tests executed within the PST Failure Occurrence in the Process or in the Safeguarding System Failure is Detected System internal diagnostic time Time for corrective action Safe status of the Process assured Time for reaction of the Process on the corrective action Fault Tolerance Time Fault tolerance time of the process or Process Safety Time (PST) t

Reliability Requirements for Alarms No special requirements – however the alarm system should be operated engineered and maintained to the good engineering standards identified in the EEMUA Guide EMMUA Alarm Systems Guide page 17

CONCEPT 1 : RISK REDUCTION Actual remaining risk Risk to meet required Level of Safety EUC Risk Necessary minimum risk reduction [ D R ] Actual risk reduction Partial risk covered by E/E/PES SRSs Partial risk covered by Other Technology SRSs Partial risk covered by External Risk Reduction Facilities Risk reduction achieved by all SRSs & External Risk Reduction Facilities Increasing Risk

SAFETY INTEGRITY LEVELS TABLE 2: SAFETY INTEGRITY LEVELS: TARGET FAILURE MEASURES SAFETY DEMAND MODE OF CONTINUOUS/HIGH OPERATION DEMAND MODE OF INTEGRITY OPERATION LEVEL (Average Probability of failure to perform (Average Probability its design function of a dangerous (SIL) on demand) failure per year) 4 10 -5 to < 10 -4 3 10 -4 to < 10 -3 2 10 -3 to < 10 -2 1 10 -2 to < 10 -1

Reliability requirements for alarms EMMUA Alarm Systems Guide page 17

Reliability requirements for alarms EMMUA Alarm Systems Guide page 17

The Setting of a high pre-trip alarm Maximum rate of change of alarmed variable during fault Limit at which protection operates Time for operator B to respond to alarm and correct fault Abnormal Operating Region A Alarm Setting Limit of largest normal operational fluctuation EMMUA Alarm Systems Guide page 17

120 Explosion Gas Concentration (Percentage of LEL) Lower Explosive Limit (LEL) 100 Actual Gas Concentration 80 Actual trip point Normal operating Level 60 Error Measured Gas Concentration Set trip point Gas concentration prior to fault 40 20 Fault Occurs Sampling Delay Sensor Delay Error Delay Shut Down System Delay 0 0 10 20 30 40 50 60 Time after onset of fault (Seconds) 70 80

Redesign Choices • Redesign - the plant or its controls to provide greater margin between the normal operating limits & the trip limits. This is the most desirable solution but is often impractical or too expensive; • Setting within normal operating limits - setting the alam within the limits of normal operating fluctuations & accepting that spurious alarms will occur during large normal disturbances. This is ergonomically very undesirable and will tend to increase alarm rates and reduce the operator confidence in the alarm system. In effect it increases the Average Probability of Failure on Demand (PFDavg) for the alarm system as a whole; • setting nearer trip limits - setting the alarm closer to the trip limits and accepting that some fast transients will not be corrected by the operator before they reach the trip level. This will increase the production losses due to plant trips, & because there are more demands on the protection system, tend to make the plant less safe. It also implies an increase PFDavg for the alarm system. EMMUA Alarm Systems Guide page 17

Different Kinds of Events Potential Impact of Initiating Event Abrupt/Catastrophic Manageable Insidious Time

Impact of DCS Alarm System Awareness of Disturbances With typical alarm systems, orienting begins after an event creates an abnormal plant state. Potential Impact of Initiating Event Incident The extent of the problem can impact operator’s ability to be fully aware of the locations of process disturbances. As disturbances propagate the number of conditions to be aware of increases as well as the response requirements and the likelihood of missing important information. Failure is Failure Occurrence in the Process or in the Safeguarding System Point of operator awareness Correct intervention causes return to normal Detected Safe status of the Process assured Time

Impact of DCS Alarm System Management of Problems Incident Potential Impact of Initiating Event Inadequate filtering interferes with Action Alarm Floods delay Evaluation Standing Alarms interfere with Orientation Time Point of operator awareness Correct intervention causes return to normal

Impact of Good Alarm Management in Situation Awareness Potential Impact of Initiating Event • Increases likelihood of awareness of disturbances • Reduces time to awareness • Hence, reduces the average impact of initiating events Time Average shift in awareness with decision support

Impact of Protection System UN-SAFE Incident Impact of Initiating Event Trip Emergency Alarm SAFE Loss Quality High Alarm Profit Operator diagnostic time Time Process Safety Time Trip from SIS Emergency FTT High FTT= Fault Tolerance Time

No response Incorrect Potential Impact of Initiating Event Suboptimal Time Best

Impact of Decision Support System Support for Optimal Response Potential Impact of Initiating Event • Reduces errors • Decreases time to implement response • Manages side effects • Increases awareness Time

ASM Alarm Management Solutions Education for Management, Engineers, Technicians and Operators. • Alarm Performance Assessment. • Requirement for alarm optimization tools. • Alignment with Company & EEMUA Guidelines. • Alarm Rationalization. • User Interface Design. • Decision Support Activities

Alarm Management Optimization Objectives • Enhance operator effectiveness – Avoid alarm floods – Identify root causes – Eliminate nuisance alarms • Enhance profitability – Reduce variability – Maximize plant up time – Prevent damage to equipment • Reduce risk of : – Injury to personnel – Environmental incidents

Alarm Management Optimization The Process Collect Data Change Management Analyze Develop Plant Alarm Management Standards & Philosophy Identify Enhancements Implement Verify Against Standards

Alarm Management Optimization Alarm Management • Increase the effectiveness of the existing alarm system through proven methodology – Analyze existing system performance – Assist in developing an alarm strategy and educating operations staff – Rationalize existing alarm system • Recommend apply new alarm management software – User. Alert – Optimization Suite • Alarm Rationalization and Documentation • Alarm Metrics and Analysis • Advanced Alarm Handlers 100 K 2 K Before - 30 Points Account for ~ 85 % of All Alarms After - 30 Points Account for ~ 52 % of All Alarms

Optimization Suite… Alarm Rationalization • Alarm priority (class) is based on severity and level of impact and time • Available priority options in TPS: – No Action – – – Journal Print & Journal Low High Emergency

Optimization Suite… Alarm Rationalization • Recommends alarm priorities based on plant philosophy – Severity of impact – Time to respond – Trip Point • Electronically captures plant alarm management philosophy – Time to respond rules definition – Impact and severity rules definition • Apply manual priority override • Use Alarm Impact Templates • Generate EC Files (Honeywell)