The petrochemical industries losses have been estimated at 20 billion dollars only in the U.S. each year, and the AEM (Abnormal Events Management) has been classified as a problem that needs to be solved. Hence the alarm management is one of the aspects of great interest in the safety planning for the different plants. In the process state transitions such as startup and shutdown stages the alarm flood increases and it generates critical conditions in which the operator does not respond efficiently, then a dynamic alarm management is required [1]. Currently, many fault detection and diagnosis techniques for multimode processes have been proposed; however, these techniques cannot indicate fundamental faults in the basic alarm system [2], in the other hand the technical report "Advance Alarm System Requirements" EPRI (The Electric Power Research Institute) suggests a cause-consequence and event-based processing. In this perspective, diagnosis approaches based on complex events processing or situation recognition are interesting issues. Therefore, in this paper, a dynamic alarm management strategy is proposed in order to deal with alarm floods happening during transitions of chemical processes. This approach relies on situations recognition (i.e. chronicle recognition). As, the efficiency of alarm management approaches depends on the operator expertise and process knowledge, our final objective is to develop a diagnosis approach as a decision tool for operators. The paper is divided into 6 sections. Section 2 gives an overview on the relevant literature. The section 3 concerns the modeling of the system. The section 4 is about the chronicle principle and the temporal runs used for the chronicle design. The section 5 is devoted to the chronicle generation. Finally , an illustrative application on real data from a petrochemical plant is given section 6.
Alarm management has recently focused the attention of many researchers in themes such as:
Alarm historian visualization and analysis: A combined analysis of plant connectivity and alarm logs to reduce the number of alerts in an automation system was presented by [3]; the aim of the work presented is to reduce the number of alerts presented to the operator. If alarms are related to one another, those alarms should be grouped and presented as one alarm problem. Graphical tools for routine assessment of industrial alarm systems was proposed by [4], they presented two new alarm data visualization tools for the performance evaluation of the alarm systems, known as the high density alarm plot (HDAP) and the alarm similarity color map (ASCM). Event correlation analysis and two-layer cause-effect model were used to reduce the number of alarms in [5]. A Bayesian method has been introduced for multimode process monitoring in [6]. This type of techniques helps us to recognize alarm chattering, grouping many alarms or estimate the alarm limits in transition stages, but the time and the procedure actions are not included.
Process data-based alarm system analysis and rationalization: The evaluation of plant alarm systems by behavior simulation using a virtual subject was proposed by [7]. [8] introduced a technique for optimal design of alarm limits by analyzing the correlation between process variables and alarm variables. In 2009 a framework based on the receiver operating characteristic (ROC) curve was proposed to optimally design alarm limits, filters, dead bands, and delay timers; this work was presented in [9] and a dynamic risk analysis methodology that uses alarm databases to improve process safety and product quality was presented in [10]. In [11] the Gaussian mixture model was employed to extract a series of operating modes from the historical process data and then the local statistic and its normalized contribution chart were derived for detecting abnormalities early and for isolating faulty variables. We can see that the use of virtual subjects could be applied to probe the alarm system and using historical information about the alarm behavior for detecting abnormalities. The problem is presented when the simulation requires a lot time to probe the totally of scenarios and when we have new plants that do not contain information about historical data.
Plant connectivity and process variable causality analysis (causal methods): In the literature, transition monitoring of chemical processes has been reported by many researchers. In [12] was presented a fault diagnosis strategy for startup process based on standard operating procedures, this approach proposes behavior observer combined with dynamic PCA (Principal Component Analysis) to estimate process faults and operator errors at the same time, and in [13] was presented a framework for managing transitions in chemical plants where a trend analysis-based approach for locating and characterizing the modes and transitions in historical data is proposed. Finally, in [14] a hybrid modelbased framework was used for alarm anticipation where the user can prepare for the possibility of a single alarm occurrence. For the transition monitoring, these types of techniques are the most used in industrial processes and the hybrid model based framework could be a good representation of our system. We can observe that a causal model allows identify the root of the failures and check the correct evolution in a transitional stage. Our proposal is closer to the third type of approach and seeks to exploit the causal relationships as presented in the next sections.
3 Representation of the system
The hybrid system is represented by an extended transition system [15], whose discrete states represent the different modes of operation for which the continuous dynamics are characterized by a qualitative domain. Formally, a hybrid causal system is defined as a tuple:
Where
• # = {v i } is a set of continuous process variables which are function of time t.
Q is a set of states q i of the transition system which represent the system operation modes. The set of auxiliary discrete variables K = {K i , i = 1, ...n c } represents the system configuration in each mode q i as defined below by Conf(q i ). V Q = {V i } is a set of qualitative variables whose values are obtained from the behavior of each continuous variable v i .
• Conf(q i ):
where ⌦ is the Cartesian product and D(K i ) is the domain of K i 2 K that provides the configuration associated to the mode. i.e. the modes of the underlying multimode components (typically, a valve has two normal modes, opened and closed)
is a finite set of event types noted , where:
-⌃ is the set of event type associated to the procedure actions in a startup or shutdown stages. -⌃ c is the set of event type associated to the behavior of the continuous process variables.
• T r : Q⇥ ⌃ ! Q is the transition function. The transition from mode q i to mode q j with associated event is noted (q i , , q j ) or q i ! q j . We assume that the model is deterministic, without loss of generality i.e. whenever q i ! q j and q i ! q k then q j = q k for each (q i , q j , q k ) 2 Q 3 and each 2 ⌃.
• CSD ◆ S i CSD i is the Causal System Description or the causal model used to represent the constraints underlying in the continuous dynamic of the hybrid system. Every CSD i associated to a mode q i , is given by a graph (G c = # [ K, I). I is the set of influences where there is an edge e(v i , v j ) 2 I from v i 2 # to v j 2 # if the variable v i influences variable v j . Then, the vertices represent the variables and the edges represent the influences between variables and for each edge exists an association with a component in the system. The set of components is noted as COMP .
• Init is the initial condition of the hybrid system,
In each mode of operation, variables evolve according to the corresponding dynamics. This evolution is represented with qualitative values. The domain
) that maps the continuous values of variable v i to ranges defined by limit values (High H i and Low L i ).
dvi dt > 0 represents that the continuous variable v i is increasing and dvi dt < 0 that it is decreasing. The behavior of these qualitative variables is represented in Figure 1. by the graph
High) of the continuous variable v i , ⌃ c is the finite set of the events associate to the transitions and :
The corresponding event generator is
To obtain the causal model of a system in a given operating mode implies to collect the equations that represent the behavior of the system in this mode. The theory of causal ordering issued from the Qualitative Reasoning community can be well applied to obtain automatically the causal structure associated to a set of equations. Now, associating activation conditions to the equations extend the causal ordering to systems with several operating modes [16]. Then these activation conditions can be related in the influences of the resulting causal graph.The proposed algorithm, implemented in the Causalito software makes use of conditions that avoid recomputing a totally new perfect matching for every operating mode, thus reducing the computational cost. In this work, the Causal System Description is given by CSD = (#, I), where each influence I is labeled with:
• An activation condition indicating the modes in which it is active (or no label if it is active in all modes),
• The corresponding equation,
• The component whose behavior is expressed by the equation. In the follow section we expose the principle of the chronicle generation where concepts such as event, chronicle and temporal run are described.
Let us consider time as a linearly ordered discrete set of instants. The occurrence of different events in time represents the system dynamics and a model can be determined to diagnose the correct evolution. An event is defined as a pair ( i , t i ), where i 2 E is an event type and t i is a variable of integer type called the event date. We define E as the set of all event types and a temporal sequence on E is an ordered set of events denoted S = h( i , t i )i j with j 2 N l where l is the size of the temporal sequence S and N l is a finite set of linearly ordered time points of cardinal l. A chronicle is a triplet C = (⇠, C T , G) such that ⇠ ✓ E, C T is the set of temporal constraints. G = (N, It) is a directed graph where N represent event types of E and the arcs It represent the relationship between events 2 E, if the event 1 occurs t time units after 2 , then it exists a directed link from 1 to 2 associated with a time constraint. Considering the two events ( i , t i ) and ( j , t j ), we define the time interval as the pair ⌧ ij = [t , t + ], ⌧ ij 2 C T corresponding to the lower and upper bounds on the temporal distance between the two event dates t i and t j [17]. The idea of our proposal is to design the chronicles from the hybrid causal model of the system. Indeed the evolution of the system can be captured with temporal runs from which chronicles can be learn (See Figure 2). More precisely, the system initiates in the state q 0 and it evolves according to the transitions resulting from the events defined by the procedure actions for specific scenarios (startup/shutdown). For a given system modes q i 2 Q, the associated CSD i is used to generate the set of event types corresponding to the evolution of the continuous process variables. A run is defined by a sequence of event types ↵ 1 , ↵ 2 , ....↵ n where ↵ i 2 E generated for each scenario using the startup/shutdown procedures. These runs with time constraints permit to construct the chronicle database of the system. In this preliminary approach, time constraints are obtained by simulation.
We denote a temporal run as h R, T i where R is a run and T is the time graph of the run that includes the time constraints C T between each pair of time points where must occurs the events type. Figure 3 gives time graph examples and the possible composition of time graphs. In our approach the Figure 3: Time graphs example runs are issued from the system evolution from one operation mode to another. The interleaved sequence of event types ↵ 1 , ↵ 2 , . . . ↵ n represents the procedure actions and the behavior evolution of the process variables. The time constraints between each pair of event types are determined by simulation of the continuous behavior for each process variable, responding to the procedure actions. (5) The chronicle database used for diagnosis is composed by the entries of all the matrices {CAr k }. This chronicle database is submitted to a chronicle recognition system that identifies in an observable flow of events all the possible matching with the set of chronicles from which the situation (normal or faulty) can be assessed.
As explained previously when the system changes mode of operation, a set of event types occurs forming a run R. As this evolution is due to procedure actions. Not only a unique temporal run can occur. Hence, we need to set up the maximal number of temporal runs that it could occur in each scenario represented in the matrix (5). To obtain the chronicle in each scenario is necessary to obtain the larger time graph with as many event types and with the minimal values of the constraints. [18] proposes to determine the chronicles from the temporal runs. They define a partial order relation between two temporal runs as hR, T i h R 0 , T 0 i when the set of event types in R 0 is a subset of event type in R and the time graphs T and T 0 are related by T T 0 determining the result graph where exists a unique equivalent constraint that is the minimal. The relation expresses that the set of constraints in the time graph T 0 is a subset of constraints in T , C T (t, t 0 ) ✓ C T 0 (t, t 0 ). Therefore, we apply the composition (see Figure 3) between the time graphs in order to merge the constraints obtaining the larger and constrained time graph that represents the chronicle in that scenario. Figure 4 gives an example of a chronicle generation from a maximal temporal run. In the next section a case study is presented in 6 Case study 6.1 HTG (Hydrostatic Tank Gauging) system
In the Cartagena Refinery currently are being implemented news units and elements. In the startup stage they will need a tool to help the operator to recognize dangerous conditions. We will analyze the startup and shutdown stages in the unit of water injection. This process is a HTG (Hydrostatic Tank Gauging) system composed by the following components: one tank (T K), two normally closed valves (V 1 and V 2), one pump (P u), a level sensor (LT ), a pressure sensor (P T ), inflow sensor (F T 1 ) and an outflow sensor (F T 2 ), see Figure 5. Assuming this system as a hybrid causal model, the underlying discrete event system and the different process operation modes are described in Figure 6 where we can see a possible correct evolution for the startup procedure. The events V 1 c,o , V 2 c,o represents that the valves V 1,V 2 move from the state closed to the state opened, the events V 1 o,c ,V 2 o,c represents on the contrary the valves moving from the state opened to the state closed. The event P u f n indicates that the pump P u is turned on and the event P u n f indicates that the pump P u is turned off.
The level (L) in the tank is related to the weight (m) of the liquid inside, its density (⇢) and the tank area (A). The density (⇢) is the relationship of the pressures (P med ,P inf ) in separated points (h). Based on the global material balance, we define that the input flow is equal to the outlet flow. Then, the variation of the weight (dm(t)/dt) in the tank is proportional to the difference between the inflow (Q iT K ) and the outflow (Q oV 2 ). The differential pressure in the pump and in V 2 are specified as P P u and P V 2 . The outlet pressure in the pump (P o) is related with the outlet flow tank (Q oT K ), the revolutions per minute in the pump (RP M P u ), his capacity (C) and the radio of the outlet pipe (r). The outflow (Q oV 2 ) and inflow (Q iT K ) control are related to the percentage aperture of the valves V 1 (LV 1) and V 2 (LV 2) and differential pressures ( P V 1 , P V 2 ). In Figure 7 we can see the CSD of the system in the modes q 1 , q 5 and q 7 . For example, the mode q 1 activates the influence of Q iT K to L. The mode q 5 activates the influence of Q iT K to L and the influence of L to P o and finally the mode q 7 activates the influence of Q iT K to L, L to P o and P o to QoV 2. 7: CSD in the modes q 1 , q 5 and q 7
One of the most important steps for fault diagnosis based on chronicle recognition is to determine the set of events that can carry the system to a failure. Each situation pattern (normal or abnormal) is a set of events and temporal constraints between them; then a situation model may also specify events to be generated and actions to be triggered as a result of the situation occurrence. For a startup procedure in the example process, the set of event types ⌃ that represent the procedure actions is:
According to the causal graphs associated to the modes involved in the sequence of procedure actions (i.e q 1 , q 5 and q 7 indicated by red arrows on Figure 6), the event types of ⌃ c correspond to the behavior of the variables L,P o and Q oV 2 .
From the startup/shutdown procedures the different temporal runs are determined and these temporal runs are related to the normal and abnormal situations. The chronicle resulting from a normal startup procedure is presented in Figure 8. The model system was developed in Matlab including A preliminary method for alarm management based on automatically learned chronicles has been proposed. The proposal is based on a hybrid causal model of the system and a chronicle based approach for diagnosis. An illustrative example of an hydrostatic tank gauging has been considered to introduce the main concepts of the approach. In this paper the design of the temporal constraints of the chronicles were performed from simulation results, but further research aim to generate the chronicles from the model of the system. Learning approaches are currently considered for acquiring the chronicle base directly from the sequences of events representing the situations. For this propose the algorithm HC-DAM (Heuristic Chronicle Discovery Algorithm Modified [17]) may be used. The use of HIL (Hardware in the loop) to simulate and validate the proposal is also in our prospects.
The ECOPETROL -ICP engineers Jorge Prada, Francisco Cala and Gladys Valderrama help us to develop and validate the simulations.