ALARMING NEWS FROM INVENSYS PROCESS SYSTEMS, INC. The Foxboro I/A Series and the newly developed and highly versatile I/A Series System Message Manager working in combination to meet all of your plant s process alarm requirements whether you are a small manufacturing operation with only 40 alarms or a nuclear power plant with a demanding 40,000 alarms. Message Manager, acting as a conduit from the Control Processors (CPs) via a fast Ethernet application network, delivers alarm information to the as well as configured printers and historians, see Figure 1. Operating Message Manager redundantly guarantees that alarms will not be missed by a single failure. Message Manager also contains an alarm shower detector in the event of sudden bursts of alarms usually caused by a major plant upset. This option, if enabled, can discard those messages with the lowest priorities when the shower occurs. This is based upon three parameters; 1) the number of unacknowledged alarms, 2) the time period in which the alarms occur and 3) the threshold alarm priority. Message Manager is also the key player in reprioritization as will be discussed shortly. MM1 Control Network (CPs) MM2 Historian Figure 1. Message Manager Optional Network Configuration Printer Redundant MM Alarms can be sent to 16 destination stations which would include any configured historian and alarm printer as well as any other station that may require the alarm messages for a specialized application. The workstations not included as destinations can then access the alarms from these source workstations with s allowing each and every station on the system the capability to access the full list of alarms. In the event that a source workstation fails or is purposely taken offline, the alarms normally received by a non-destination station would be redirected to a backup workstation to maintain continuity, based upon configured parameters. The following examples highlight the value and effectiveness of this combination of systems. Let us start off with a basic scenario of a single alarm point consisting of a steady water flow continually cooling a reactor. The alarm condition is low flow or loss of flow. We will assume that if the flow becomes restricted this could result in a severe problem for Page 1 of 6
the process so we will designate it with a priority of 1; where 1 being of utmost importance (critical - highest priority) and 5 being of least importance (informational - lowest priority). The Operator in the control room is notified of a new alarm. The first indication is the sounding of a horn. The tone of the horn itself leads the Operator to conclude the type of alarm; in this case a process alarm localized to their operating system or in other cases it could be a more general plant wide alarm carrying a separate tone. Furthermore, the alarm tile tagged Low Flow to Reactor on the annunciator panel begins to flash red. Red indicates a priority 1 active alarm. The panel itself is made up of permanent static text tiles with multi color illumination capability; 3 rd party hardware. Other panels in the control room are video displays on wide screen flat monitors with constant indication of multiple alarm statuses. The fact that the tile is flashing rapidly is an indication that an unacknowledged alarm is active. Additional information about this particular alarm and any active alarm is available through the Alarm Manager Current Alarm display, see Figure 2. The Current Alarm display can be accessible from a button pick on all user displays off any of the I/A Workstations within the control room or from any remote station. This information can include the alarming block identifying name, the date and time of alarm initiation, block description, type of alarm (i.e. high absolute, low deviation, state, etc.), priority and acknowledgement condition. The original timestamp of an alarm can be maintained even after a priority change or a control system update, if so configured. All systematic response times are less than 2 seconds from alarm onset. Figure 2. Figure 3. Current Alarm Display Current Alarm Display Standard View Customized View The Operator is now well informed of the situation. The alarm is active. The horn is sounding. The tile is flashing. What is the Operators next course of action? First, the horn can be silenced by depressing either a hardwired pushbutton in the control room or by the customized Current Alarm display where the Operator can pick the Silence button, see Figure 3. Next, by first selecting the alarm and then picking the ACK button, that individual alarm will become Page 2 of 6
acknowledged. Selecting the ACK PAGE will acknowledge all of the alarms displayed on the page. The action of acknowledging the alarm will be apparent by the change of state on the alarm tile. No longer will it be flashing rapidly, but it will illuminate as solid red. A solid tile indicates that all alarms designated to that tile are acknowledged and at least one priority 1 alarm exists. Our Current Alarm display also updates with its new state. Note the differences between the generic, standard Current Alarm display, Figure 2. and a customized version, Figure 3. The standard display allows for all the required operations needed to acknowledge and respond to alarms, but the customized display is much more comprehensive. The buttons and features of the display are enhanced to provide maximum efficiency with greater purpose. Using these buttons, the Operator can be rerouted to unique applications specific to the operation, select a customized Matching feature to sort or filter for a certain class of alarms for ease of identification, access historical data, instantly get all available details of an alarm point and much more. Each of these buttons can be protected with permission classes such that an Engineer or Supervisor at a remote location cannot silence or acknowledge an alarm. This can readily be restricted as a control room Operator function only. Perhaps the Operator notifies the maintenance department of the water flow problem to which their investigation reveals a partially closed valve. Upon opening the valve the water flow is restored, the alarm condition is Returned-To-Normal (RTN) which clears the alarm tile at the same time sounding a chime which notifies the Operator of the RTN and the alarm indication is removed from the Current Alarm display. Should the alarm be RTN before it is acknowledged, the tile would flash slowly to indicate to the Operator of the unacknowledged alarm condition. A historical review of this alarm can be obtained from the Alarm History display, see Figure 4. Similar customized buttons can be configured for this display as they were for the Current Alarm display. Figure 4. Alarm History Display Customized View Let us delve deeper into the priority of our alarm. Assume for the moment that the state or mode of the plant was RUNNING, but the operation is now in the process of transitioning through the SHUTDOWN mode. This is a significant change for our water flow to reactor alarm. While in SHUTDOWN mode the priority of the alarm is not so Page 3 of 6
critical. In this case it is desired to have the alarm at a priority of 3. This is where Message Manager s reprioritization capabilities come to fruition. Message Manager constantly monitors the status of the plant. At the moment Message Manager receives a signal for a change of mode or event condition of the plant through logical conditions, all configured alarms points within its database will be reprioritized to the new priority based on that mode and event. This action of reprioritization is controlled by the mode/ event matrix. For our example above, while in the RUNNING mode the priority for the water flow is 1, but as soon as Message Manager sees a change to the SHUTDOWN mode, then the priority automatically changes to 3. If only modes are selected, then the number of modes must be less than or equal to 32. If both modes and events are selected then the product of the two must also be less than or equal to 32. Modes and events can each be made mutually exclusive such that you can only have one mode or one event at any given time. Having a non-mutually exclusive system will allow the condition of a single mode with multiple events. The system can be configured to choose which priority should be active in the case of multiple events with the events supporting different priorities for the same alarm. For example, if the plant in the RUNNING mode and there is a generator trip event active which may indicate a priority of 1 for our water flow alarm based on the matrix and there is also a coolant loss event which itself may indicate a priority of 2 for the same alarm, the system can be configured to choose either the higher priority 1 or the lower priority 2. This is a system wide setting so it would always produce a higher priority for multiple events or a lower priority for multiple events. In the case of multiple events, when one or more events clear the alarms will be reprioritized to the conditions set by the remaining mode and events. Message Manager is not limited to reprioritizing only one alarm type per control block, it can be configured to reprioritize many alarm types. In our example of the water flow to reactor alarm block, Message Manager can be configured to reprioritize the low absolute alarm point as well as the low-low absolute alarm point. Perhaps the low alarm is a priority of 2 and the low-low alarm is a priority of 1 for a particular mode and event. It can also be configured to make them the same priority; low and low-low could both be priority 1. The I/A system can further be configured to re-alarm a control block (become unacknowledged) if there is a mode or event change that presents a strictly increasing priority (i.e. from priority 2 to priority 1) or it can be set to re-alarm for simply responding to any change in priority; increasing or decreasing. Message Manager s database can be populated by importing the data as.csv (comma separated value) files through the Message Manager configurator. In there exists the reprioritization matrix where the alarm priorities are specified and a command matrix where programs, voice alarm messages in the form of.wav files and other command functions can be set active. Both function in a similar manner. Initially, the mode and event logic blocks along with the alarm shower and mutual exclusivity are configured as seen in the General tab, see Figure 5. Page 4 of 6
Figure 5. Message Manager Configuration Display In this case you can see that we have 4 modes and 6 events with its product of 24 meeting the criteria of no more than 32. The control block parameters that get changed for priority updates are listed in the Parameter Actions tab, see Figure 6. Each parameter action has an associated control block parameter and its corresponding value to set. The Action Categories tab displays each matrix for all possible combinations of priorities based on the customers alarm database and provides each one with a unique Action Category Identification. The last tab for reprioritization is the Action Trigger Table. It is here where each and every control block that is to be reprioritized is listed with the appropriate Action Category Id. Figure 6. Message Manager Configuration Tabs Once all of this information is imported into Message Manager a validation process is begun which checks internal dependencies and will report via a log with the results. Once the configuration is validated it can be finalized by setting it to automatically create the Page 5 of 6
application objects required for communication to the Foxboro I/A Series System. Alarms should be seen as useful tools to an Operator to help diagnose and resolve problems and not be the cause of problems as potential nuisances or distractions. With the systems described herein, Invensys Process System provides the means to accomplish this goal. By: David Saklad, Sr. App. Eng. 33 Commercial Street Foxboro, MA 02035-2099 USA www.foxboro.com Inside U.S.: 1-866-746-6477 Outside U.S.: 1-508-549-2424 Page 6 of 6