Chronicle based alarm management in startup and shutdown stages

Abstract

The transitions between operational modes (startup/shutdown) in chemical processes generate alarm floods and cause critical alarm saturation. We propose in this paper an approach of alarm management based on a diagnosis process. This diagnosis step relies on situation recognition to provide to the operators relevant information on the failures inducing the alarms flows. The situation recognition is based on chronicle recognition. We propose to use the information issued from the modeling of the system to generate temporal runs from which the chronicles are extracted. An illustrative example in the field of petrochemical plants ends the article.

-

The petrochemical industries losses have been estimated at 20 billion dollars only in the U.S. each year, and the AEM (Abnormal Events Management) has been classified as a problem that needs to be solved. Hence the alarm management is one of the aspects of great interest in the safety planning for the different plants. In the process state transitions such as startup and shutdown stages the alarm flood increases and it generates critical conditions in which the operator does not respond efficiently, then a dynamic alarm management is required [ 1 ]. Currently, many fault detection and diagnosis techniques for multimode processes have been proposed; however, these techniques cannot indicate fundamental faults in the basic alarm system [ 2 ], in the other hand the technical report ”Advance Alarm System Requirements” EPRI (The Electric Power Research Institute) suggests a cause-consequence and event-based processing. In this perspective, diagnosis approaches based on complex events processing or situation recognition are interesting issues. Therefore, in this paper, a dynamic alarm management strategy is proposed in order to deal with alarm floods happening during transitions of chemical processes. This approach relies on situations recognition (i.e. chronicle recognition). As, the efficiency of alarm management approaches depends on the operator expertise and process knowledge, our final objective is to develop a diagnosis approach as a decision tool for operators. The paper is divided into 6 sections. Section 2 gives an overview on the relevant literature. The section 3 concerns the modeling of the system. The section 4 is about the chronicle principle and the temporal runs used for the chronicle design. The section 5 is devoted to the chronicle generation. Finally , an illustrative application on real data from a petrochemical plant is given section 6. 2

State of the art: Alarm management

Alarm management has recently focused the attention of many researchers in themes such as:

Alarm historian visualization and analysis: A combined analysis of plant connectivity and alarm logs to reduce the number of alerts in an automation system was presented by [ 3 ]; the aim of the work presented is to reduce the number of alerts presented to the operator. If alarms are related to one another, those alarms should be grouped and presented as one alarm problem. Graphical tools for routine assessment of industrial alarm systems was proposed by [ 4 ], they presented two new alarm data visualization tools for the performance evaluation of the alarm systems, known as the high density alarm plot (HDAP) and the alarm similarity color map (ASCM). Event correlation analysis and two-layer cause-effect model were used to reduce the number of alarms in [ 5 ]. A Bayesian method has been introduced for multimode process monitoring in [6]. This type of techniques helps us to recognize alarm chattering, grouping many alarms or estimate the alarm limits in transition stages, but the time and the procedure actions are not included.

Process data-based alarm system analysis and rationalization: The evaluation of plant alarm systems by behavior simulation using a virtual subject was proposed by [7]. [8] introduced a technique for optimal design of alarm limits by analyzing the correlation between process variables and alarm variables. In 2009 a framework based on the receiver operating characteristic (ROC) curve was proposed to optimally design alarm limits, filters, dead bands, and delay timers; this work was presented in [9] and a dynamic risk analysis methodology that uses alarm databases to improve process safety and product quality was presented in [ 10 ]. In [ 11 ] the Gaussian mixture model was employed to extract a series of operating modes from the historical process data and then the local statistic and its normalized contribution chart were derived for detecting abnormalities early and for isolating faulty variables. We can see that the use of virtual subjects could be applied to probe the alarm system and using historical information about the alarm behavior for detecting abnormalities. The problem is presented when the simulation requires a lot time to probe the totally of scenarios and when we have new plants that do not contain information about historical data. • CSD ◆ Si CSDi is the Causal System Description or the causal model used to represent the constraints underlying in the continuous dynamic of the hybrid system. Every CSDi associated to a mode qi, is given by a graph (Gc = # [ K, I). I is the set of influences where there is an edge e(vi, vj ) 2 I from vi 2 # to vj 2 # if the variable vi influences variable vj . Then, the vertices represent the variables and the edges represent the influences between variables and for each edge exists an association with a component in the system. The set of components is noted as COM P .

• Init is the initial condition of the hybrid system, 3.2

Qualitative abstraction of continuous behavior

In each mode of operation, variables evolve according to the corresponding dynamics. This evolution is represented with qualitative values. The domain D(Vi) of a qualitative variable Vi 2 VQ is obtained through the function fqual : D(vi) ! D(Vi) that maps the continuous values of variable vi to ranges defined by limit values (High Hi and Low Li). f (vi)qual = 8 V H >>>>>< ViiM >>>>>: ViL if if if vi

Hi ^ vi < Hi ^ _ vi vi < Li ^ ddvti > 0 ddvti < 0 Li ^ ddvti < 0 ddvti > 0 ddvti > 0 represents that the continuous variable vi is increasing and ddvti < 0 that it is decreasing. The behavior of these qualitative variables is represented in Figure 1. by the graph GVi = (VQ, ⌃ c, ) where VQ is the set of the possible qualitative states (ViL : Low, ViM : M edium, ViH : High) of the continuous variable vi, ⌃ c is the finite set of the events associate to the transitions and : VQ ⇥ ⌃ c ! VQ is the transition function. The corresponding event generator is Plant connectivity and process variable causality analysis (causal methods): In the literature, transition monitoring of chemical processes has been reported by many researchers. In [ 12 ] was presented a fault diagnosis strategy for startup process based on standard operating procedures, this approach proposes behavior observer combined with dynamic PCA (Principal Component Analysis) to estimate process faults and operator errors at the same time, and in [ 13 ] was presented a framework for managing transitions in chemical plants where a trend analysis-based approach for locating and characterizing the modes and transitions in historical data is proposed. Finally, in [ 14 ] a hybrid modelbased framework was used for alarm anticipation where the user can prepare for the possibility of a single alarm occurrence. For the transition monitoring, these types of techniques are the most used in industrial processes and the hybrid model based framework could be a good representation of our system. We can observe that a causal model allows identify the root of the failures and check the correct evolution in a transitional stage. Our proposal is closer to the third type of approach and seeks to exploit the causal relationships as presented in the next sections. 3 3.1

Representation of the system

Hybrid Causal Model

The hybrid system is represented by an extended transition system [ 15 ], whose discrete states represent the different modes of operation for which the continuous dynamics are characterized by a qualitative domain. Formally, a hybrid causal system is defined as a tuple: = ( #, D, Conf, T r, E, CSD, Init) (1) Where • # = {vi} is a set of continuous process variables which are function of time t. • D is a set of discrete variables. D = Q [ K [ VQ. Q is a set of states qi of the transition system which represent the system operation modes. The set of auxiliary discrete variables K = {Ki, i = 1, ...nc} represents the system configuration in each mode qi as defined below by Conf (qi). VQ = {Vi} is a set of qualitative variables whose values are obtained from the behavior of each continuous variable vi. • Conf (qi): Q ! ⌦ i D(Ki) where ⌦ is the Cartesian product and D(Ki) is the domain of Ki 2 K that provides the configuration associated to the mode. i.e. the modes of the underlying multimode components (typically, a valve has two normal modes, opened and closed) • E = ⌃ [ ⌃ c is a finite set of event types noted , where: – ⌃ is the set of event type associated to the procedure actions in a startup or shutdown stages. – ⌃ c is the set of event type associated to the behavior of the continuous process variables. • T r : Q⇥ ⌃ ! Q is the transition function. The transition from mode qi to mode qj with associated event is noted (qi, , q j ) or qi qj . We assume that the model is deterministic, wit!hout loss of generality i.e. whenever qi qj and qi qk then qj = qk for each (qi, qj , qk) 2 !Q3 and each! defined by the abstraction function fVQ! fVQ! : VQ ⇥

(VQ, ⌃ c) ! ⌃ c 8 Vi 2 VQ, (Vin, Vim) ! Vin, Vim 2 { ViL, ViM , ViH } 8 l+(vi) if > >< l (vi) if

h+(vi) if >:> h (vi) if

ViL ! ViM ViM ! ViL ViM ! ViH ViH ! ViM ⌃ c = Svi2 # {l+(vi), l (vi), h+(vi), h (vi)} (2) (3) (4) 3.3

Automatic derivation of the causal model

To obtain the causal model of a system in a given operating mode implies to collect the equations that represent the behavior of the system in this mode. The theory of causal ordering issued from the Qualitative Reasoning community can be well applied to obtain automatically the causal structure associated to a set of equations. Now, associating activation conditions to the equations extend the causal ordering to systems with several operating modes [ 16 ]. Then these activation conditions can be related in the influences of the resulting causal graph.The proposed algorithm, implemented in the Causalito software makes use of conditions that avoid recomputing a totally new perfect matching for every operating mode, thus reducing the computational cost. In this work, the Causal System Description is given by CSD = (#, I ), where each influence I is labeled with: • An activation condition indicating the modes in which it is active (or no label if it is active in all modes), • The corresponding equation, • The component whose behavior is expressed by the equation.

In the follow section we expose the principle of the chronicle generation where concepts such as event, chronicle and temporal run are described. 4 4.1

Chronicles

Events and chronicles

Let us consider time as a linearly ordered discrete set of instants. The occurrence of different events in time represents the system dynamics and a model can be determined to diagnose the correct evolution. An event is defined as a pair ( i, ti), where i 2 E is an event type and ti is a variable of integer type called the event date. We define E as the set of all event types and a temporal sequence on E is an ordered set of events denoted S = h( i, ti)ij with j 2 Nl where l is the size of the temporal sequence S and Nl is a finite set of linearly ordered time points of cardinal l. A chronicle is a triplet C = (⇠, C T , G) such that ⇠ ✓ E, CT is the set of temporal constraints. G = (N, It) is a directed graph where N represent event types of E and the arcs It represent the relationship between events 2 E, if the event 1 occurs t time units after 2, then it exists a directed link from 1 to 2 associated with a time constraint. Considering the two events ( i, ti) and ( j , tj ), we define the time interval as the pair ⌧ ij = [t , t+], ⌧ ij 2 CT corresponding to the lower and upper bounds on the temporal distance between the two event dates ti and tj [ 17 ]. The idea of our proposal is to design the chronicles from the hybrid causal model of the system. Indeed the evolution of the system can be captured with temporal runs from which chronicles can be learn (See Figure 2). More precisely, the system initiates in the state q0 and it evolves according to the transitions resulting from the events defined by the procedure actions for specific scenarios (startup/shutdown). For a given system modes qi 2 Q, the associated CSDi is used to generate the set of event types corresponding to the evolution of the continuous process variables. A run is defined by a sequence of event types ↵ 1, ↵ 2, ....↵ n where ↵ i 2 E generated for each scenario using the startup/shutdown procedures. These runs with time constraints permit to construct the chronicle database of the system. In this preliminary approach, time constraints are obtained by simulation. We denote a temporal run as h R, T i where R is a run and T is the time graph of the run that includes the time constraints CT between each pair of time points where must occurs the events type. Figure 3 gives time graph examples and the possible composition of time graphs. In our approach the runs are issued from the system evolution from one operation mode to another. The interleaved sequence of event types ↵ 1, ↵ 2, . . . ↵ n represents the procedure actions and the behavior evolution of the process variables. The time constraints between each pair of event types are determined by simulation of the continuous behavior for each process variable, responding to the procedure actions. An industrial or complex process P r is composed of different areas P r = {Ar1, Ar2, ...Arn} where each area Ark has different operational modes such as startup, shutdown, slow march, fast march, etc. The set CArk of chronicles Cikj for each area Ark is presented in the matrix below, where the rows represent the operating modes (i.e. O1 : Startup, O2 : Shutdown, O3 : Startuptype, O4 : Startuptype, etc) and the columns the different faults.

CArk =

O1 O2 O3 O4 . . . . . .

Oj

N f1 f2 . . . . . . fn 2 C0k1 C1k1 C2k1 . . . . . . Cik13 6 C0k2 C1k2 C2k2 . . . . . . Cik27 66 C0k3 C1k3 C2k3 . . . . . . Cik377 666 C..0k.4. . . C..1k.4. . .C. 2.k4. . . .. .. .. . . ....... . .C. .ik4.777 46 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .57

C0kj C1kj C2kj . . . . . . Cikj (5) The chronicle database used for diagnosis is composed by the entries of all the matrices {CArk}. This chronicle database is submitted to a chronicle recognition system that identifies in an observable flow of events all the possible matching with the set of chronicles from which the situation (normal or faulty) can be assessed. 5.2

Chronicle learning

As explained previously when the system changes mode of operation, a set of event types occurs forming a run R. As this evolution is due to procedure actions. Not only a unique temporal run can occur. Hence, we need to set up the maximal number of temporal runs that it could occur in each scenario represented in the matrix (5). To obtain the chronicle in each scenario is necessary to obtain the larger time graph with as many event types and with the minimal values of the constraints. [ 18 ] proposes to determine the chronicles from the temporal runs. They define a partial order relation between two temporal runs as hR, T i  h R0, T 0i when the set of event types in R0 is a subset of event type in R and the time graphs T and T 0 are related by T T 0 determining the result graph where exists a unique equivalent constraint that is the minimal. The relation expresses that the set of constraints in the time graph T 0 is a subset of constraints in T , CT (t, t0) ✓ CT 0 (t, t0). Therefore, we apply the composition (see Figure 3) between the time graphs in order to merge the constraints obtaining the larger and constrained time graph that represents the chronicle in that scenario. Figure 4 gives an example of a chronicle generation from a maximal temporal run. In the next section a case study is presented in which the chronicle generation from the temporal runs is illustrated.

Case study

HTG (Hydrostatic Tank Gauging) system

In the Cartagena Refinery currently are being implemented news units and elements. In the startup stage they will need a tool to help the operator to recognize dangerous conditions. We will analyze the startup and shutdown stages in the unit of water injection. This process is a HTG (Hydrostatic Tank Gauging) system composed by the following components: one tank (T K), two normally closed valves (V 1 and V 2), one pump (P u), a level sensor (LT ), a pressure sensor (P T ), inflow sensor (F T1) and an outflow sensor (F T2), see Figure 5.

Assuming this system as a hybrid causal model, the underlying discrete event system and the different process operation modes are described in Figure 6 where we can see a possible correct evolution for the startup procedure. The events V 1c,o, V 2c,o represents that the valves V 1,V 2 move from the state closed to the state opened, the events V 1o,c,V 2o,c represents on the contrary the valves moving from the state opened to the state closed. The event P uf n indicates that the pump P u is turned on and the event P un f indicates that the pump P u is turned off. The level (L) in the tank is related to the weight (m) of the liquid inside, its density (⇢ ) and the tank area (A). The density (⇢ ) is the relationship of the pressures (Pmed,Pinf ) in separated points (h). Based on the global material balance, we define that the input flow is equal to the outlet flow. Then, the variation of the weight (dm(t)/dt) in the tank is proportional to the difference between the inflow (QiT K ) and the outflow (QoV 2). The differential pressure in the pump and in V 2 are specified as PP u and PV 2. The outlet pressure in the pump (P o) is related with the outlet flow tank (QoT K ), the revolutions per minute in the pump (RP MP u), his capacity (C) and the radio of the outlet pipe (r). The outflow (QoV 2) and inflow (QiT K ) control are related to the percentage aperture of the valves V 1 (LV 1) and V 2 (LV 2) and differential pressures ( PV 1, PV 2). In Figure 7 we can see the CSD of the system in the modes q1, q5 and q7. For example, the mode q1 activates the influence of QiT K to L. The mode q5 activates the influence of QiT K to L and the influence of L to P o and finally the mode q7 activates the influence of QiT K to L, L to P o and P o to QoV 2. One of the most important steps for fault diagnosis based on chronicle recognition is to determine the set of events that can carry the system to a failure. Each situation pattern (normal or abnormal) is a set of events and temporal constraints between them; then a situation model may also specify events to be generated and actions to be triggered as a result of the situation occurrence. For a startup procedure in the example process, the set of event types ⌃ that represent the procedure actions is: {V 1c,o, V 2c,o, P uf n, V 1o,c, V 2o,c, P un f } (6) According to the causal graphs associated to the modes involved in the sequence of procedure actions (i.e q1, q5 and q7 indicated by red arrows on Figure 6), the event types of ⌃ c correspond to the behavior of the variables L,Po and QoV 2. ⌃ c = {l(+L), l(L), h(+L), h(L), l(+P o), l(P o), h(+P o), h(P o), l(+QoV 2), l(QoV 2), h(+QoV 2), h(QoV 2)} (7) From the startup/shutdown procedures the different temporal runs are determined and these temporal runs are related to the normal and abnormal situations. The chronicle resulting from a normal startup procedure is presented in Figure 8. The model system was developed in Matlab including the injection water process area. The continuous behavior is related to the evolution of the level L, outlet pump pressure P o and the outlet flow QoV 2 in the system. The discrete evolution is related to the event evolution of the procedures in the startup and shutdown stages. From the different failure modes of the process, the dynamic behavior of the variables is shown with a detection for the possible process states, including the normal procedure without failure. The simulation includes 3 types of startup procedures (OK, f ail1 and f ail2) with 4 types of fault modes (V1, V2, P ump and Drainopen) and 3 types of Shutdown procedure (OK, N on actived and F ail). The evolution of the continuous variables in the startup procedure without failure is shown in Figure 9. The events are generated by the program through the evolution of the differential equations, the variable conditions and the procedural actions. Recognition of the chronicles was done using the tool statef low.

Conclusion

A preliminary method for alarm management based on automatically learned chronicles has been proposed. The proposal is based on a hybrid causal model of the system and a chronicle based approach for diagnosis. An illustrative example of an hydrostatic tank gauging has been considered to introduce the main concepts of the approach. In this paper the design of the temporal constraints of the chronicles were performed from simulation results, but further research aim to generate the chronicles from the model of the system. Learning approaches are currently considered for acquiring the chronicle base directly from the sequences of events representing the situations. For this propose the algorithm HCDAM (Heuristic Chronicle Discovery Algorithm Modified [ 17 ]) may be used. The use of HIL (Hardware in the loop) to simulate and validate the proposal is also in our prospects. 8

Acknowledge

The ECOPETROL - ICP engineers Jorge Prada, Francisco Cala and Gladys Valderrama help us to develop and validate the simulations.

References

[1] S. Ferrer D. Beebe and D. Logerot . The connection of peak alarm rates to plant incidents and what you can do to minimize . Process Safety Progress , 2013 .

[2] J. Zhao J . Zhu , Y. Shu and F. Yang . A dynamic alarm management strategy for chemical process transitions . Journal of Loss Prevention in the Process Industries 30 207e218, 2014 .

[3] N. F. Thornhill M. Schleburg , L. Christiansen and A. Fay . A combined analysis of plant connectivity and alarm logs to reduce the number of alerts in an automation system . Journal of Process Control 23 839 - 851 , 2013 .

[4] I. Izadi S. L. Shaha T. Black R. Sandeep , R. Kondaveeti and T. Chen . Graphical tools for routine assessment of industrial alarm systems . Computers and Chemical Engineering 46 39 - 47 , 2012 .

[5] T. Takai M. Noda F. Higuchi , I. Yamamoto and H. Nishitani . Use of event correlation analysis to reduce number of alarms . Computer Aided Chemical Engineering , 27 , 1521e1526 ., 2009 .

Z. Ge and Z. Song . Multimode process monitoring based on bayesian method . Journal of Chemometrics , 23 , 636e650 ., 2009 .

M. Noda X. Liu and H. Nishitani . Evaluation of plant alarm systems by behavior simulation using a virtual subject . Computers & Chemical Engineering , 34 , 374e386 , 2010 .

D. Xiao F. Yang , S. L. Shah and T. Chen . Improved correlation analysis and visualization of industrial alarm data . 18th IFAC World Congress Milano (Italy) , 2011 .

D.S. Shook S.R. Kondaveeti I. Izadi , S.L. Shah and T. Chen . A framework for optimal design of alarm systems. 7th IFAC symposium on fault detection, supervision and safety of technical processes , Barcelona, Spain, 2009 .

[10] U.G. Oktem A. Pariyani , W.D. Seider and M. Soroush . Dynamic risk analysis using alarm databases to improve process safety and product quality: Part ii bayesian analysis . AIChE Journal , 58 , 826e841 ., 2012 .

[11] J. Liu and D. Chen . Non stationary fault detection and diagnosis for multimode processes . AIChE Journal , 56 , 207e219 ., 2010 .

[12] L. Boang Z. Jing and Y. Hao . Fault diagnosis strategy for startup process based on standard operating procedures . 25th Chinese Control and Decision Conference (CCDC) , 2013 .

[13] H. Vedam R. Srinivasan , P. Viswanathan and A. Nochur . A framework for managing transitions in chemical plants . Computers & Chemical Engineering , 29 , 305e322 ., 2005 .

[14] A. Adhitya S. Xu and R. Srinivasan . Hybrid modelbased framework for alarm anticipation . Industrial & Engineering Chemistry Research , 2014 .

[15] L. Travé-Massuyès R. Pons , A. Subias . Iterative hybrid causal model based diagnosis: Application to automotive embedded functions . Engineering Applications of Artificial Intelligence , 2015 .

[16] L. Travé-Massuyès and R. Pons . Causal ordering for multiple mode systems . in:. 11th International Workshop on Qualitative Reasoning , Cortona, Italy, pp. 203 - 214 , 1997 .

[17] L. Travé-Massuyès A. Subias and E. Le Corronc . Learning chronicles signing multiple scenario instances . IFAC World Congress, Le Cap, South Africa, 26 - 29 August , 2014 ; also 25th International Workshop on Principles of Diagnosis (DX- 2015 ), Graz (Austria) , 9 - 11 September., 2014 .

[18] Bruno Guerraz and Christophe Dousson . Chronicles construction starting from the fault model of the system to diagnose . DX04 15th International Workshop on Principles of Diagnosis . Carcassonne (France)., 2004 .