PROCESS CONTROL

I Alarm management strategy

by Abu Augustine, Lafarge Group, Karnan Karunakaran, Lakeside Process Controls Ltd & Jack Murray, Emerson Process Management, USA

This article describes proposed advanced alarm management strategy for cement industry operational efficiency. Proliferation of alarms is a major problem in many cement plants, making it difficult for operators to distinguish between critical events and nuisance alarms. Far too often operators are overwhelmed by a large number of alarms. When such alarm flooding occurs, operators tend to take over control of the plant from their rule based engines that can run them at a much higher level of efficiency. The unfortunate results are lower production rates, off-spec clinker, and overall decreased operational efficiency.

he implementation of advanced digital process controls in cement plants has now made it possible to intelligently classify and organise the way in which alarms are presented to the operator. Modern process control systems now not only provide an out of the box solution for general automation needs but they also have the added capability of an integrated alarm/interlock management and knowledge based system. Such advanced capability, embedded and seamlessly integrated with the standard process control system, gives the cement industry the tools they need to address the increased concerns of safety and environment, an aging work force and the need for improved operational effectiveness. For example, to prevent alarm flooding only the root cause incident and the first affected equipment may be alarmed when a sequence is triggered to shutdown by a process condition or equipment shutdown. Alarms also can be linked to a knowledge base that provides the operator with information on the root cause of the alarm and a recommendation for corrective action. This proposed approach has the potential to increase throughput, improve quality and reduce costs by significantly increasing the proportion of time in which the equipment can be run in automatic mode by rule based engines at optimal levels of efficiency.

Figure 1: control panel screen segregates alarms into primary and secondary

plant. Operators are being asked to make an increasing number of rapid and correct decisions to maintain high levels of quality and throughput. But the high levels of automation and cost pressures in the cement industry have dramatically reduced the number of people involved in running the plant. The most advanced cement producers have responded by developing rule engines that optimise operating parameters such as feed rates by smaller and more frequent changes

than operators are able to do. Rule engines are typically able to operate the plant approximately 90 per cent of the time and while they are doing so they can generally increase mill production by an average of six per cent while reducing product variation. But operators tend to trust rule engines when the plant is stable and running normally. There is no substitute for the human operator in dealing with situations where a measurement point reaches

Table 1: metrics provided by EEMUA 191

Alarm condition Average alarm rate in steady operation Alarms in 10 minutes after plant upset Average number of starting alarms Average number of shelved alarms Benchmark value less than 1 per 10 minutes under 10 under 10 under 30

Increasingly complex environment

Cement plant central control rooms are becoming more complex as they are being required to monitor and control more processes and systems for the entire
50 ICR SEPTEMBER 2008

PROCESS CONTROL

a high alarm, low alarm or some other variation. Of course the plant runs much more efficiently when it is under rule based control so the ideal situation is for an operator to quickly understand the cause of alarm and take corrective action. The vast majority of alarm situations can be readily dealt with by operators without having to take the plant out of rule based control if they quickly understand the root cause of the problem. When the operator doesnt understand the situation or what is causing the problem, there is a tendency to shut down the rule engine and move into semi-automatic or manual mode while operators try and figure out what is going on.

Figure 2: knowledge base message entry for proposed Advanced Alarm Management Strategy

Alarm management challenges

Most processes in the cement industry are highly interactive. If there is a failure of a critical asset, such as a motor tripping on overload, then the feed stops to the downstream processes. Each of the downstream processes runs out of feed so they also trip one after another. In matter of seconds, an operator may be faced with scores of cascading alarms, often of equal priority. It may take a considerable period of time to identify the root cause of the problem. Beyond that, it is often difficult to determine the severity of the problem. Is this a safety concern that justifies immediately shutting down the process or is it a simple matter that can be corrected while continuing with rule based control? The operator has to make these kinds of decisions in seconds and if he or she isnt sure then it is necessary to err on the side of safety even though this will have a negative impact on the plants operating performance. The goal of an alarm management strategy should be to organise and manage alarms so the operators can easily distinguish between critical and nuisance alarms, can quickly identify the root cause of the problem and have information at their fingertips as to what type of corrective action is needed. Accomplishing this goal requires that an alarm management strategy be developed and that this strategy be embedded into the process control system. Fortunately, the latest generation of digital process control systems such as the Emersons DeltaV digital automation system provide a complete toolset to build intelligence

into alarms based on the knowledge of the most experienced plant personnel. This built-in intelligence or knowledge base enables operators to quickly identify and understand alarms that represent real problems that require immediate attention. This intelligence can be embedded into standard control modules that process these alarms behind the scenes to manage the way in which they are presented to users.

Development of Alarm Management Strategy

Most modern process control systems already have extensive alarm management functionality and compatibility with industry standards such as EEMUA 191. This standard, outlined in a publication entitled Alarm Systems, a Guide to Design, Management, and Procurement provided by Engineering Equipment and Materials Users Association provides, among other things, recommended performance targets for alarms system measurements. Table 1 shows examples of metrics that can be applied to measure alarm system performance. However, many users are exploring ways to extend this base functionality to include integrated alarm management, interlock management, and knowledge based systems. In Emersons DeltaV, the basic building block for this alarm/interlock management and knowledge based system is a library of object oriented control modules built into the basic process automation system. Each module is powerful yet easy to configure and re-configure. Because the system is so intuitive, it can be reconfigured and kept current by any authorised plant engineer or operator. Each module is assigned to a specific plant asset pump, fan, damper motor,

kiln oxygen sensor, etc. Each module and its associated faceplate has all the attributes needed to enable the alarm/ interlock management and knowledge based system. Attributes include: basic process control for the asset asset interlock functions asset alarm functions asset knowledge base. A key element of an Advanced Alarm Management Strategy is that any process condition caused by a process upset or process parameter deviation from the target needs to be brought to the operators attention as an Alarm for Action. Alarms for Action can be classified into two categories called primary and secondary. Figure 1 shows the segregation of alarms into primary and secondary. Any alarm that can shut down the main line process equipment and eventually the entire plant can be defined under the primary category. Alarms that are caused by faults that will not trigger the shutdown of the entire plant can be classified as secondary. Primary and secondary alarms are clearly delineated and operators are expected to deal with all outstanding primary alarms before turning their attention to secondary alarms. The only exception is of course if a secondary alarm involves a safety issue. Each of the two categories of alarms is further classified into different subtypes called: Log, Advisory, Warning and Critical with Log being the least and Critical the highest priority. Alarms are displayed with the banner with the highest priority unacknowledged alarm being on top. Colours of each type of alarm are different so that operators can easily identify the severity of the alarm. Another key element of an advanced alarm management strategy is the
SEPTEMBER 2008 ICR 51

PROCESS CONTROL

Figure 3: bypass and interlock information control display

operator interface. The alarm/interlock management system operator interface is expected to address the issues of: alarm flooding root cause analysis multiple interlock categories safety and security. Further, the knowledge based system operator interface must be designed to address issues of: capturing operational lore and best practices from the senior workforce assisting other plant systems with root cause analysis providing the physical location of raised alarms. Finally, the most important element of the advanced alarm management strategy operator interface is the seamless interoperability it must have between the alarm/interlock management system, the knowledge based system, and the base process control system. In this proposed approach, the process control system provides the platform on which the knowledge base and alarm management systems are developed. So the challenge
52 ICR SEPTEMBER 2008

is not in the interfacing and intercommunication of the several systems but rather the operational philosophy and the development of control strategies that made use of these systems holistically. Figure 2 contains the proposed faceplate set for the advanced alarm management strategy showing a detailed bypass and interlock information control display, the base process control system operator faceplate display, and the knowledge base message entry display. Using this faceplate display set, each alarm can be linked to a knowledge base display that is designed to capture the expertise of experienced operators. Many of these operators are nearing retirement age and will be soon be leaving the company. Embedding their expertise into the control system makes it possible for the wisdom they have accumulated to guide future generations of operators. One purpose of the knowledge base display is to help the operator with detailed corrective actions that have a high probably of clearing the alarm. For example, when a motor gives a high amps

alarm, there is a good chance that the problem is either a bad filter or a bearing problem. Providing this information to the operator with the alarm makes it possible in many cases to check readings from other instruments in order to investigate the likely causes. This will help the operator make a correct decision as to whether the plant needs to go off rule based control. This will also save time on the part of the maintenance team by reducing or eliminating time required for troubleshooting. Figure 3 shows the bypass and interlock information control display for a single control loop. Only the root cause incident and the first affected equipment are alarmed when a sequence is triggered to shutdown by a process condition or equipment to prevent alarm flooding. This enables the operator to quickly identify the root cause of the shutdown and take immediate corrective action. For example, suppose that the bearing temperature rises above the high alarm level on a pump motor. With a conventional alarm system, this will cascade through the process and generate a huge number of alarms. With the new alarm management strategy, the original alarm is highlighted making it easy for the operator to identify the root cause. Only authorised personnel are allowed to enable, disable, suppressed, or bypass alarms from the faceplate. Suppressed alarms are identified on the faceplate by an icon. The first out fault condition is tripped to provide additional assistance in identifying the root cause of the problem. This is accomplished using the Boolean Fan Input function block in DeltaV which traps the first out cause automatically.

Interlock management strategy

Each equipments interlock condition is classified into different categories. The Start category must be met only when starting the equipment. After start-up the condition is not significant. An example is that the damper must be closed when a fan is started but after the fan is started the position of the damper is not important. The Machine interlock category requires that machine be satisfied before the interlock is removed. For example, the main drive should not operate unless the lubrication system is working. The Protect interlock category involves a situation where a condition

PROCESS CONTROL

might cause a problem with equipment. An example is when the bearing temperature or vibration level exceeds acceptable limits. The Remote category involves equipment that cannot run until a condition has been satisfied on other equipment that is not directly associated in the same process. An example is that the diverter gates must be in the proper position before starting the kiln feed system. The Process category involves process equipment organised in a cascade so that when the upstream equipment shuts down all downstream machinery must also shut down. Codes on the faceplate help the operator easily identify the type of interlock and the managing security level for the interlock bypass. The control system tracks the interlock sequence to determine the root cause. The operator can also bypass a flood of Process category alarms by switching from cascade mode to auto mode to inhibit these alarms. DeltaV allows each class of interlock to have up to four individual interlock conditions associated and up to 24 maximum interlocks per equipment. The status of the interlock/ fault condition is animated with the colour green indicating OK and the colour red showing the fault state. This provides an advance indication to the operator of when the interlock bypass can be removed because the equipment has reached the ready condition. The active interlock class is indicated with a red arrow mark highlighted to gain the operators immediate attention. The process sequence has all of the interlock conditions displayed for quick status indication of the equipment in sequence. The sequence drive has a hold button for the operator to control the progression of the sequence one step at a time. The interlock conditions are logically enabled or disabled based on the process condition or equipment status based on the process interlock parameter.

Figure 4: help screen provides guide to operators

power. The operator uses this bypass to release interlocks and enable maintenance personnel to operate the motor on-site. This type of bypass is highlighted on the control panel with a special symbol to make it obvious that the bypass needs to be removed after the motor is fixed. A drive bypass feature is used to manage equipment which operates only on a seasonal basis. For example, a coal dust handling system which does not run during the winter can be bypassed using this feature. When any discrete or analogue parameters state or value is bypassed, all of the instances where the same signal interlock is used will automatically be bypassed. For example, if a pressure switch used as an interlock in five separate locations is faulty and the decision is made to bypass it, all five locations will be bypassed. The operator also has the option of bypassing the interlock at the individual equipment level in which case only that single interlock will be bypassed.

diagrams are used to create an integrated alarm/interlock management and knowledge based system described in this article. In addition, other standard control modules in the standard set allow easy implementation of such advanced control strategies as fuzzy logic, neural networks, and model predictive control algorithms. Other features include learning algorithms embedded in each controller to calculate process models and diagnostics for every control loop in the system. These models and diagnostics are used for intelligent performance monitoring and adaptive tuning to accurately identify problems and recommend tuning improvements. These process models are stored in a database for cement industry users to evaluate performance over time and to identify potential process non-linearities and degradations, such as kiln coating, precalciner build up, and the gradual fouling of oxygen sensors.

Conclusion
This article proposes an intelligent, cement-specific, alarm and interlock management system that is seamlessly integrated with the process control system and can be implemented with legacy sensor networks. This control system expands the cement plants capability to dynamically optimise its processes to improve quality, increase throughput and reduce operating costs. The process control system provides the platform on which the knowledge base and alarm management systems are developed, simplifying the task of interfacing and inter-communications and enabling the development process to focus on operational philosophy and control and alarm management strategies. _______ I

Role of advanced process control system

An advanced process control system such as the DeltaV digital automation system provides the functionality needed to develop cement industry specific solutions such as integrated alarms, interlock management and knowledge base systems. A rich set of object oriented control modules reduces what formerly took pages of ladder logic to engineer into a simple drag and drop configuration activity. Function block diagrams are used to read in or send parameters to the physical devices and to create control strategies such as PID and motor control loops. These same function block

Bypass strategy
Interlocks and alarms can only be bypassed by authorised personnel. The bypassed signal or interlock is highlighted in the process sequence. A maintenance bypass feature is provided for quick testing and troubleshooting by a technician. For example, suppose a drive is tripping even though it is receiving
54 ICR SEPTEMBER 2008