Rule-based reduction of alarm signals in industrial control 1

Transcription

1 Rule-based reduction of alarm signals in industrial control 1 Jonas Ahnlund, Tord Bergquist, and Lambert Spaanenburg Department of Information Technology Lund University of Technology P.O. Box 118, Lund (Sweden) Abstract The proper handling of alarms is crucial to any automated process control. In practice, many alarms are only distractive and do not represent a potentially dangerous situation. This paper presents a methodology and a computerized tool that aims to remove such nuisance alarms, a so-called alarm cleanup. This is a general, systematic approach that takes advantage of the control system s built-in functions, and is a first step to an improved overall alarm situation. By the strong reduction of the alarm count, the efficient construction of fault diagnosis and isolation models becomes feasible. In a typical case study, the number of alarms received at the remote control room of an operational bio-fueled District Heating Plant was effectively reduced by 83%. Keywords: Process Control, Fault Diagnosis, Alarm Cleanup, Expert System, Signal Processing, Multilevel Flow Model. Corresponding Author: Jonas Ahnlund Department of Information Technology Lund University of Technology P.O. Box 118 S Lund (Sweden) T F E jonas.ahnlund@it.lth.se 1 This is an extended version of the papers published at the 9th IEEE International Conference on Emerging Technologies and Factory Automation 1

2 Rule-based reduction of alarm signals in industrial control I. INTRODUCTION Industrial production is supervised by control systems that monitor analog and digital signals from the plant and check on limits for the values that are allowed for a signal - the operational limits. Whenever a signal exceeds its limits, it is an abnormality (also called novelty, outlier or fault) that should be inspected for it s probable consequences. An alarm must be generated when the process is found not to behave as expected, that is before anything critical has happened, but only when a critical event is about to happen. The alarm has to be unmistakable and there should be no more than one alarm for each cause. Where fully automated control is still far from reality, it is the operator who has to identify and handle fault situations. Complex plants produce large data quantities, which may easily flood and therefore confuse the operator. It has been reported, that the US Petrochemical industry alone already looses 10 to 20 billion dollars per year due to abnormal situations [1]. A well-designed control system with welltuned operational limits and a proper sieving of abnormalities into alarms gives the operators the possibility to efficiently monitor and control the process from a control room. There is no single solution to a badly tuned alarm system, but improvements can be made in several different areas, e.g., introduce state-based priority settings, better precision in control loops, and improved alarm handling. We concentrate on the latter and address this as alarm cleanup. Fault Detection and Isolation (FDI) paradigms have been formulated in the late eighties on basis of mathematical systems theory by Isermann [2], and covered extensively by Patton, Frank and Clark in [3]. This foundation is focused on control systems and system identification using white-box and modelbased design approaches, i.e., models are based on laws of physics rather than on data. Basically models are obtained through linearization. On-line adaptation is typically realized through Kalman-filters. In essence a detection algorithm consists of (a) model selection, (b) computation of residuals called signatures, and (c) comparison of signatures and decision-making [4]. 2

3 Over the last decade, three developments can be identified in the research related to FDI. The first development is the increasing use of neural networks as replacement and supplement in traditionally mathematical systems [5], and the application in detection [6]. The second development is the use of learning methodology for detection [7] also in combination with a traditional white-box model-based approach [8]. A third development is the increasing research on detection for processes other than those related to mathematical control systems and electrical engineering such as data-mining and Internet monitoring systems. Our approach is a mixture of the latter two directions, but primarily aims to sanitize the data set for a later modeling. General methods for reduction of nuisance alarms, i.e., alarm cleanup were first addressed as alarm sanitation [9]. Very little is written about the concept except our contributions [10][11][12]. The problem with nuisance alarms has however burdened the industry for decades and some reduction techniques have emerged from engineers dealing with these problems. The Engineering Equipment and Materials Users Association (EEMUA) have presented a comprehensive guide to design, management and procurement of alarms systems [1]. Less technical detailed guidance can be found in several publications, for instance [13]. A conventional alarm cleanup is carried out by hand and therefore both time-consuming and expensive. The alarm cleanup we suggest uses a general computerized tool and is a first step to an enhanced overall alarm situation. We take advantage of the control systems built-in functions. These functions are only applied on the alarm system and do not interfere with the operation of the process, as shown in Figure 1. The idea is to keep the methods generally applicable on any process and as user-friendly as possible. This requires some built-in-intelligence based on new research results and known algorithms in various technical and mathematical areas. The tool we propose is not integrated into a control system. Instead, it is tested as an off-line approach that examines the process in the past and then tries to predict the behavior in the future. It is based on the assumption that the process signal characteristics are stable in normal operation. In most (if not all) 3

4 industrial processes that is true. All suggested improvements from the tool have to be evaluated and accepted by personnel with process understanding before they are implemented in the control system. The use of a computerized tool is cost effective, and can be used to lay the foundation for more advanced alarm handling. The project is not yet finished, but in an early phase [10] the use of different filter functions and predictive algorithms has already proved to reduce the number of nuisance alarms at the project s test plants significantly with very little effort. In this paper we will present the methodology of such an alarm cleanup and some results from our project s test plant. Section II goes into the nature of alarm generation from the setting of operational limits, while Section III elucidates the background for different alarm handling schemes. In Section IV the alarm cleanup methodology is presented. The computerized tool is described in Section V and finally the result of an alarm cleanup at a bio-fueled District Heating Plant is presented in section VI. II. SETTING OPERATIONAL LIMITS It is not easy to make a definition of a nuisance alarm. In principle, every alarm that is not followed by an action is a nuisance, but it is mainly up to the operator to make that judgment. There are several reasons why nuisance alarms occur. Often, in the construction of a process, the main concern is the control of the process and not enough time is spent on tuning the alarm system. At the initial start-up of a new process the operators are usually flooded with alarms. This is because many alarms are activated due to too narrowly set alarm limits, and if this feature is detected many alarms can be removed by simply adjusting the alarm limits. This can on the other hand introduce silent alarms, which are signals whose alarms never activate due to too widely set alarm limits. These misleading silent alarms are difficult to find because of their absence in alarm lists and give the operators a false sense of safety. Figure 2 shows a signal with a silent lower alarm and with the upper alarm limit set too tight. At such an initial start-up the control system supplier has to fulfill certain requirements regarding the alarm system, and if there are too many alarms, their first action is to widen the alarm limits. Then, if that is not enough, time-delay is applied as a last action. This removes many nuisance alarms but has the 4

5 drawback that all alarms are equally delayed, including the true ones. Usually, nothing more is done and the operators have to bear with the remaining alarms. Reconstruction or changes to the process can also cause the alarm system to flood. Signals that earlier did not cause any nuisance, can after a minor change introduce a large number of nuisance alarms. The procedure to remove these nuisance alarms is the same as in initial start-up; widen the alarm limits and apply time-delays, and consequently the drawbacks are the same. Eventually, some of the process components start to wear down, and signals that earlier had a margin to the alarm limit may suddenly start to generate alarms. A dangerous solution would be to set the limit wider, causing a silent alarm when the component gets replaced sometime in the future. There are also a lot of alarms due to badly tuned PID-controllers or to slowly varying (inert) processes, see Figure 3. The process may work perfectly but still produce alarms and before the operator even finds out which alarm it is, the values are back to normal again. But next to these seemingly avoidable causes for nuisance alarms, there is also reason to believe that there are non-avoidable causes. It appears that in any network of individually correct functioning parts new faults can occur. This is sometimes claimed to be due to the chaotic behavior inherent to the behavior of complex systems. Often, however, the problem stems from the accidental coming together of abnormalities that are innocent by themselves. A well-known example is the July-August 1996 breakdown of the Western US Power Grid caused by two outliers in short succession [14]. Both faults did individually not exceed the operational limits; together they did. To cover such accidents by design would be computationally prohibitive, but a proper alarm is feasible. Similar observations are true for a phenomenon called feature interaction that ghosts services over large telephone networks. An alarm system that generates too many alarms brings situations where the operators do not get enough time for preventive supervision and control. Instead they react only on the alarms that are activated. An alarm that constantly activates incorrectly, may lead to the point where the operators ignore it, and thus fails to bring attention to a hazardous situation [15]. An increased workload may affect the operator with a negative stress that can deteriorate the ability to make right decisions. But a totally stress-free 5

6 workload may not be the goal of the alarm cleanup. Instead the operator s performance reaches a maximum at a certain stress-level see Figure 4. This phenomenon is known as the inverted-u or Yerkes- Dodson law [16]. There is an optimal level of arousal for the best performance of any task; lower for more difficult or intellectually (cognitive) tasks and higher for tasks requiring endurance and persistence. Therefore some alarms may actually be justified to keep the operator on his toes and the final effort to get an alarm-free process is not always worthwhile. III. ALARM HANDLING Finding the most effective approach to solve every alarm problem is a complex task and in a wide sense improvements can be found in the following categories: Enhanced over-all design of the alarm system, i.e., relevancy and redundancy of the alarm equipped signals. State-based priority settings. Better precision in control loops. Alarm analysis, i.e., classifying alarms as primary or consequential. Presenting more useful information about the alarm, the cause and the preferable action. Alarm cleanup, i.e., improved alarm handling by a systematic examination of the process signals, tuning the alarm limits and applying signal-processing methods. The problem with nuisance alarms has aggravated the industry for decades and engineers dealing with these problems have posed some reduction techniques. One way is to create some sort of a model of the process, or process parts. This results in better control and therefore fewer alarms. The drawback is that the creation of a model is time-consuming and it is not always certain that the model will hold. Furthermore, if changes are being made to the process, the model has to be revised. It has to be pointed out that the primary reason for creating a model is not to reduce the number of nuisance alarms, but to optimize the process. The consequence is however that the process noise is reduced and as a result the number of alarms is diminished. 6

7 Another way is to group alarms and introduce alarm priorities. For instance, if an alarm has been received from one process group, other alarms with lower priority from the same group are blocked. This does not stop nuisance alarms from coming, but it prevents some types of alarm floods when faults arise. In order to handle alarm floods that spread through larger parts of the process, advanced methods based on cause-consequence analysis are needed. Such methods can solve the problem of alarm floods, but require a physical description of the process. Multilevel Flow Modeling (MFM) that handles this causeconsequence relationship is described in [17][18][19]. It is a graphical language for representing the goals and intended functionality of an industrial process. There is a series of effective alarm handling algorithms that can be applied to an MFM-model once it is designed. The algorithms run on an event driven basis, so besides that the model has to be accurate, it is also depending on the correctness of the control system and the alarm limits. Alarm shelving is sometimes used in dealing with repeating alarms (see [20]) and is a facility for manually or automatically removing an alarm from the main list and placing it on a shelve list, temporarily preventing the alarm from re-occurring on the main list until it is removed from the shelf. The downside of shelving is that there is no guarantee that important alarms from a fault situation are not being removed. Often though, a repeating alarm is just a nuisance, and can be removed. One idea that has proved to be useful when dealing with nuisance alarms is to order the signals in a frequency alarm list on a regular basis. Then, all effort can be concentrated to the most alarming signals at the top of the list. This approach does not solve the alarm problems, but is an excellent way of finding problem areas. The most common way to reduce alarms is, as mentioned before, tuning the alarm limits and applying time-delays to the signal. This is not always an easy task, because of 1) the danger of degrading the supervision of the process 2) the danger that the changes confuse the operators 3) the lack of a proper decision support tool. And there are also operational issues to consider: whether the limit is a physical or a practical one, whether it is possible to exceed the limit for a short time. And if so, how long, and how 7

8 high? Taking these questions into consideration, it is obvious that a computerized alarm cleanup tool is needed. III.1 Alarm Cleanup Procedure The alarm cleanup we propose makes extensive use of signal processing methods and predictive algorithms. The main idea is to use the control system more efficiently. A software program, Alarm Cleanup Toolbox (ACT), developed by the authors at the Department of Information Technology, Lund University, visualizes the process signals and simulates the effect of different signal processing methods, thus laying a foundation for a good decision. ACT has two main features: 1) it helps with the tuning of alarm limits and 2) it searches and suggests alarm reductive algorithms to apply to the process signals. An alarm cleanup project is usually carried out in the following steps: Extract signal data during normal operation. This is the difficult part since most control systems are installed without a logging device. Extract information about the signals, such as the current alarm limits and the applied signal processing methods. Examine the control system s built-in functions and programmable capabilities. Perform an off-line analysis of the signals using ACT. Discuss and validate the suggested alarm reduction methods and implementation decisions with the operators and personnel with process knowledge. Implement the discussed improvements into the control system. The strength in this methodology is that every signal is treated individually and the effects of the different functions are examined, which makes it easy to detect improvements in the alarm system. III.2 Formalization In order to make a generally applicable tool, we need a way of deciding what a good signal processing method is. One approach is to compare different alarm reduction methods by first creating a model M E of the signal. The model is a description of all generated alarms. Then we create a model M I of the same 8

9 signal without the nuisance alarms. The best function f i is the one that minimizes the number of nuisance alarms, but keeps the true ones: min(f 1 (M E,t), f 2 (M E,t), ), 0 t t d where t d is the maximum allowed delay time. Ideally, we want the function to give us M I. If the function is a filter or an applied time-delay, the alarms can be delayed up to the time t d, see Figure 5. Tuning of the alarm limits has shown good results even with small changes. Also, this function add modest or no delay to the signal. In our experience a low-pass filter is a better choice for most signals than to apply a time-delay function [10]. The delay of the filter depends on the variation of the values in the signal. If the differences are big (i.e., a trip), then the delay in the filtered signal is short, but if the differences are small (i.e., the signal becomes stable at one level) the delay is longer, see Figure 6. In some special cases the alarm could be removed, and this is precisely the quality that is required in an alarm system. IV. THE ACT TECHNOLOGY It is obvious that a computerized tool such as ACT can be of great help to operators and control system programmers when trying to reduce the number of nuisance alarms. ACT is a general application that can be used with a wide range of control systems. Much effort has been put into the toolbox to make the user interface as intuitive and user-friendly as possible. ACT visualizes the signals in two different frames; where the upper frame shows the raw signals, and the lower shows the signals after processing methods have been adapted, see Figure 7. The user is able to instantly see the effects of the different methods and functions. It is also possible to move the signal in any direction and at any chosen section zoom in and out. An intuitive way to compare the relative effectiveness of the methods is by comparing the alarm count before and after application. The better the method is, the fewer alarms occur. Some signal statistics such as standard deviation, maximum- mean- and minimum values etc are calculated and presented to the user. 9

10 The toolbox has a number of different functions to choose from. All are easy to use, and need at most one or two parameters. For instance, for the filter functions the user do not have to type in filter parameters, but instead just enter a preferred maximum delay time in seconds. It is also possible to try combinations of functions. Some functions have shown good results in combination with other functions. For example, the difference function works very well with an IIR filter, but not with an averaging filter. Ideally, we want a function that removes all of the nuisance alarms, but keeps the true ones (with no delay). But, for all functions, there is the risk of suppressing a true alarm and thus fail to notice a fault situation. This may be the case if, for instance, the alarm limit is set too wide, the filter function is too strong or the time delay is too large. Since no computer program is able to tell the difference between an accurate and nuisance alarm, the function settings have to be carefully evaluated by personnel with process knowledge before applied into the control system. However, ACT with its graphical user interface, makes this evaluation easier. The user can see every alarm and whether it is removed or consistent with different function settings. And again, this way of thinking is based on the assumption that process signals characteristics are stable in normal operation, and that function settings based on offline data are valid in the future. But, this is the same assumption that is made in every control system for any alarm limit setting. The available functions are listed below. IIR filter An IIR (Infinite Impulse Response) filter is an efficient low-pass filter and is fairly easy to implement. The user can choose the filter order from one to five. The calculated filter parameters are displayed to the user. Averaging filter - An averaging filter is easy to implement in the control system, but is inferior to an IIR filter in terms of noise reduction. Median filter - The median filter is very efficient to remove outliers, but is difficult to implement in the control system. 10

11 Time-Delay - Time-delay is one of the most commonly used alarm reduction methods. It is available in many control systems. The function holds back the alarm for a fixed time, and if the signal does not return to normal operation within that time, the alarm is activated. Difference Function - This is a predictive function that is very useful if the signal contains controller-caused oscillations. The function examines differences in the values, and an alarm can be suppressed if the differences are decreasing or negative. This function works very well when the process signal is smooth, but has no effect if the signal is disturbed with noise. The presence of noise can, however, be removed with a low-pass filter. Therefore, this function has proved very successful when the signal is pre-processed with a filter. Dead Band Filter - Dead Band filter or hysteresis is often used to eliminate repeating or chattering alarms caused by high frequency noise from for instance vibrations. When this function is applied the alarm is arranged to be activated at one level but cleared at a different level (Figure 8). Alarm Window Function - The alarm window function combines features from both the timedelay function and the difference function. The function allows a signal to be in the alarm state for a limited time and by a bounded maximum value, without giving an alarm. The boundaries can be of three kinds: rectangle, triangle and circular as we show in Figure 9. Depending on the signal s characteristic and physical boundaries, different windows should be used. This is a useful function that reduces many nuisance alarms in slowly moving processes. To make the search for improved alarm handling easier, a number of help functions are also available. It is for instance possible to view the Fourier transformation or the correlation between signals or alarms. Alarm correlation is an efficient tool when trying to find redundancy in the alarm system. The user is also able to create new signals, for instance it is possible to create a control error signal from the difference between the output signal and the set point. Another useful function is the batch run function. When used, all the available methods (and combinations of methods) are applied to the 11

12 process signals, which results in an alarm-frequency list and overview diagrams. This is an easy way to identify the most alarming signals and to find candidates to signals with silent alarms. The most important help function is called LARA (Logical Alarm Reduction Algorithm). (A further description of LARA is found in section V). It helps the operators and control system programmers to find the most suitable processing method for all signals that are equipped with an alarm limit. Many nuisance alarms are the result of incorrect settings of the alarm limits. Based on interaction with the user, common signal statistics and knowledge of the signal, LARA propose new and hopefully better settings for the alarm limits. LARA also tries to identify signals with silent alarms, and all signals that are candidates to have silent alarms are reported to the user. V. LOGICAL ALARM REDUCTION ALGORITHM To enable a computerized generally applicable approach for alarm cleanup, an advanced function in the toolbox, LARA, classifies the process signals depending on their behavior. A good classification is essential to tailor an algorithm to the individual signal. For instance, periodic or non-periodic patterns, drift, noise, or if the signal seems to have certain values according to process-mode, all that is valuable information when looking for new possibilities to reduce alarms. Signal classification is the task to categorize time-series into a finite number of classes. The emphasis is not so much on modeling the time series as on extracting particular features that distinguish one signal from another. For instance, the signal in Figure 10 contains an outlier. Such are either the result of rapid changes in the process, for instance an opening of a valve or the start of a motor, or they are just sensor faults. If this feature can be detected then such outliers can be removed with a short median filter. On the other hand a regular averaging filter would have caused an unwanted, smoothened but wider peak. The classification is performed by a rule-based expert system that separates process signals into 14 different classes (see Figure 11) [11]. This is accomplished by studying characteristics in the signals and it differs from traditional time-series classification where a time-dependent signal would be classified either as deterministic or stochastic. While a deterministic process is classified as either linear or non- 12

13 linear, a stochastic process is first separated into stationary (time-invariant) or non-stationary, and then both these classes can be either linear or non-linear. As we know that process signals are not generated from an explicit mathematical formula, we leave the deterministic classes behind and concentrate on the stochastic ones. The most important feature for a stochastic process is whether the process is stationary. Process signals however are often slowly varying, dependent on environmental disturbances and thus not stationary. This leaves us with ad-hoc methods and a totally different classification hierarchy, based on features that we believe is more valuable in finding effective alarm reduction algorithms. During the classification the signals are grouped into four main categories: Periodic signals, which contains one or more dominating frequencies. Slowly varying signals including stationary signals, drifting signals, irregular signals like the Wiener process and irregular signals with unstable variance. Multiple steady-state signals, which can be separated into two different kinds: the stepwise stationary signal that reflects a plant operating in different modes or states, and the discontinuous signal that merely is the result of a disturbance in production or a plant trip. Signals that contain outliers. This is the only group that has just one signal class. Periodicity either belongs to physical process properties or to external chronic disturbances. The classification does not distinguish between different sources of the periodicity, thus it is still valuable information for prediction and suppression of alarms. Drift can point out the need for maintenance. Noise and unstructured disturbances cannot be prevented, but different filters can reduce their effect. Outliers are never wanted and should be filtered out or replaced. Furthermore, LARA also searches and suggests new settings for the alarm limits. It uses an estimated number of true alarms for the selected signal as input. 13

14 VI. EXPERIMENTAL RESULTS In an ongoing project with Sydkraft Värme Syd AB and Carl Bro Energikonsult AB, an alarm cleanup is carried out at a bio-fueled District Heating Plant (FFC). The goal of this project is to validate ACT and the alarm cleanup methodology, and of course reduce the number of alarms at the test plant. FFC is known as a non-problematic plant without any nuisance alarms. It is remotly controlled from the center of Malmö, Sweden, and to enable that, the plant went through an alarm cleanup procedure in Four people were involved for about 6 month and most of the effort was spent on finding proper alarm limits, time-delays and logic for alarm suppression. Their result was a reduction for approximately two thirds of the total amount of alarms. Knowing this, one might think that there is no room for further improvements, but there is. In our project we used ACT to analyze data collected from December 2002 and suggested improvements was implemented on 21 signals after discussions with the operators. At the test plant a free alarm priority was used to implement all alarm reduction methods as an own alarm system running in parallel. With all the alarms printed with timestamps and priorities in the alarm list we were able to track every single alarm to see if it was removed or unacceptably delayed. With this double bookkeeping there was also a tremendous opportunity to validate the ACT simulations. The evaluations of the results took place in the summer of Here, we will concentrate just on one signal as an example. The oxygen ratio in the boiler is an important measurement, used by the operators to control the efficiency of the process and to reduce the amount of NO x pollution. If the ratio is below 1 % an alarm is activated, but the control system is automatically increasing the amount of air into the process by gradually opening a damper for 5 % per minute. If the ratio is after five minutes still below 1 %, the fuel gas fan is turned off and an alarm with higher priority is activated. During the evaluation period the oxygen ratio gave 82 alarms if unprocessed, only once during the evaluation period did the higher prioritized alarm activate. In seven cases a low-priority alarm was active 14

15 for more than one minute. In all other cases the process was self-stabilized and no action was taken neither from the operators nor automated, from the control system. With the knowledge that there were at least 74 nuisance alarms during the period, we used ACT to evaluate different signal processing methods in order to reduce that number. In Figure 12 the common methods like time-delay, hysteresis, and averaging filter are compared to more seldom used IIR-filters of different order and the difference function. All methods are dimensioned to cause a 30 seconds timedelay. For the oxygen ratio the first-order IIR-filter removes 70 of the nuisance alarms. If we apply the difference function as well all the nuisance alarms are removed, but then the maximum time-delay cannot be guaranteed and therefore it has been judged by the operators as too aggressive for the moment. During the test period the total number of alarms from the evaluated signals was decreased from 95 to only 16, an 83% reduction. VII. CONCLUSIONS We have introduced an alarm cleanup methodology, which makes use of a software toolbox. The methodology and the toolbox functions are generally applicable to any industrial processes and it helps operators and control system programmers to tune the alarm systems. This is a time and cost effective approach to reduce the number of nuisance alarms. With the use of this toolbox the number of nuisance alarms in our projects test plants has been significantly reduced. We have also presented algorithms and signal processing methods, which has proved very useful in alarm cleanup. Two functions: the difference function and the alarm window function are new approaches to alarm reduction. Both have shown good results and both are easy to implement into control systems. A special function in the toolbox, LARA, helps the users to improve the settings of the alarm limits, and suggests better alarm reductive methods. Our methodology is not the solution to every alarm problem, but is a computerized aid to point out specific problem areas and to lay a foundation for more sophisticated alarm handling. 15

16 VIII. ACKNOWLEDGEMENTS We want to express gratitude to Professor Jan Eric Larsson for his excellent ideas and never ending support. A special thanks to Ann-Britt Östberg, Carl Bro Energikonsult AB, Johnny Pettersson, Sydkraft Värme Syd AB, Johan Söderbom, and Lars Johansson, Vattenfall Utveckling AB, for their support and belief in alarm cleanup as a concept. The project is sponsored by VINNOVA, the Swedish Agency for Innovation Systems under the project number AIS-33, and by Värmeforsk, the Swedish Thermal Engineering Research Institute under the project number P

17 IX. REFERENCES [1] EEMUA, Alarm Systems, a Guide to Design, Management and Procurement, EEMUA publication 191:1999, EEMUA, London UK, [2] Isermann, R., Process Fault Detection Based on Modeling and Estimation Methods -A Survey, Automatica, vol. 20, no. 4, pp , [3] Patton, R., P. Frank and R. Clark, Fault Diagnosis in Dynamical Systems -Theory and Application, vol. 20, Prentice-Hall, Inc., [4] Frank, P. M., Fault Diagnosis in Dynamic Systems Using Analytical and Knowledge-based Redundancy - A Survey and Some New Results, Automatica, vol. 26, no. 3, pp , [5] Narendra, K. S., and K. Parthasarathy, Identification and Control of Dynamical Systems Using Neural Networks, IEEE Transactions on Neural Networks, vol. 1, no. 1, pp. 4-27, [6] Kolvo, H. N., Artificial Neural Networks in Fault Diagnosis and Control, Control Eng. Practice, vol 2. no. 1, pp , [7] vanveelen, M., J. A. G. Nijhuis and L. Spaanenburg, Process Fault Detection through Quantitative Analysis of Learning in Neural Networks, Proceedings ProRISC 2000, Veldhoven, pp , November [8] Trunov, A. B., and M. M. Polycarpou, Automated Fault Diagnosis in Nonlinear Multivariate Systems Using a Learning Methodology, IEEE Transactions on Neural Networks, vol. 11, no. 1, pp , [9] Larsson, J. E., Simple Methods for Alarm Sanitation, Proceedings of the IFAC Symposium on Artificial Intelligence in Real-Time Control, Budapest, [10] Ahnlund, J. and T. Bergquist, Alarm Cleanup Toolbox, M. Sc. thesis, Department of Information Technology, University of Lund, Lund, [11] Bergquist T. J. Ahnlund, J. E. Larsson, and L. Spaanenburg; Signal Processing and Alarm Handling in Process Control, Proceedings of the ECCTD 03, Krakow, Poland, September,

18 [12] Bergquist T. J. Ahnlund, and J. E. Larsson, Alarm Reduction in Industrial Process Control, Proceedings of the ETFA2003, Lisbon, Portugal, September, [13] Veland, O., M. Kaarstad, L. A. Seim, and N. Fordestrommen, Principles for Alarm System Design, Institutt for Energiteknikk, Halden, Norway, [14] Amin, M., Towards Self-healing infrastructure systems, IEEE Computer Magazine, vol. 33, no. 8, pp , [15] Bliss, J. P. The Cry Wolf Phenomenon and its Effects on Alarm Responses (False Alarms), PhD dissertation, University of Central Florida, USA, [16] Robert M. Yerkes and John D. Dodson, The Relation of Strength of Stimulus to Rapidity of Habit- Formation (1908) Journal of Comparative Neurology and Psychology, 18, [17] Larsson, J. E., "Diagnostic Reasoning Strategies for Means-End Models," Automatica, vol. 30, no. 5, pp , [18] Larsson, J. E., "Diagnostic Reasoning Based on Explicit Means-End Models," Artificial Intelligence, vol. 80, no. 1, pp , [19] Larsson, J. E., "Diagnostic Reasoning Based on Means-End Models: Experiences and Future Prospects," Knowledge-Based Systems, vol. 15, no. 1-2, pp , [20] Burnell, E. and C. R. Dicken, Handling of Repeating Alarms, IEE publication 1997, IEE, London UK,

19 X. LIST OF CAPTIONS Figure 1 The control system receives signals from the plant, where some signals are used for the controlling of the plant or displayed at the operator terminals. A subset of the signals is used for the alarm system. Whenever a signal exceeds its limit, the alarm system activates. The applied signal processing methods consist of signal filtering, alarm filtering, and alarm suppression, and do not interfere with the systems ability to control the process. Figure 2 The high alarm limit is set too tight and is therefore sensitive to noise. The low alarm limit on the other hand is set too wide, and does not activate even though a plant trip occurs. Figure 3 Badly tuned PID-controllers or slow varying processes can cause alarms even in the state of normal operation. Figure 4 The performance as a function of workload (or stress) is often described by the inverted U-curve. Figure 5 An ideal function that removes all nuisance alarms is probably impossible to find. Instead, our search is for a function that minimizes the nuisance alarms and keeps the true ones. Tuning of the alarm limits and the use of low-pass filters has proved to be the best functions. Figure 6 The process signal is filtered with a low-pass first-order IIR-filter. The delay dt 2 is longer than dt 1 because the variation is smaller when the signal stabilizes. Figure 7 The toolbox s graphical user interface is intuitive and user-friendly. The different methods and functions can be tried by simply pressing the buttons (and in some cases enter a value). Figure 8 Figure 9 The elimination of repeating alarms using a dead band filter. The alarm window function holds the alarm for the time t d providing that the values stay inside the window. 19

20 Figure 10 The signal (A) contains an outlier that easily can be removed with a median filter (B.) In (C) the signal has been filtered with an averaging filter that is incapable of removing the alarm. Figure 11 Examples from each of the 14 signal classes. Signals 1 to 6 are periodic, signals 7 to 11 are slowly varying, 12 and 13 are multiple steady-state signals and signal 14 contains outliers. Figure 12 Different reduction methods affect the number of removed nuisance alarms for the oxygen ratio at FFC. The first-order IIR-filter has been implemented in the control system of the plant. 20

21 Figure 1 21

22 Figure 2 22

23 Figure 3 23

24 Figure 4 24

25 Figure 5 25

26 Figure 6 26

27 Figure 7 27

28 Figure 8 28

29 Figure 9 29

30 Figure 10 30

31 Figure 11 31

32 Figure 12 32