Alarm management to ISA-18.2: delay, deadband, latch, acknowledge, first-out

An alarm is not a comparison

Plenty of programs contain HiAlm := Level > 80.0; and call it an alarm. That is a comparison. An industrial alarm, per ISA-18.2 (and IEC 62682), has a lifecycle: condition, delay, active, latched, acknowledged, returned, cleared. Every stage is there for a reason.

The on-delay kills chatter

A real analogue signal is noisy. If the level sits around 80%, a bare comparison produces hundreds of alarms a minute. An on-delay demands that the condition persist before it is believed:

HiDly(IN := Level >= 80.0, PT := T#2s);
HiAct := HiDly.Q;

Two seconds removes wave slosh in a tank. It does not remove an overflow.

Deadband on the return

The delay protects the way in; deadband protects the way out. In at 80%, out at 75%:

IF Level >= 80.0 THEN
  HiRaw := TRUE;
ELSIF Level <= 75.0 THEN
  HiRaw := FALSE;
END_IF;

Common practice is 2 to 5% of span. Without deadband you throw the delay away, because the signal keeps crossing the limit in both directions.

Latch and acknowledge

An alarm latches until a human has seen it. The rule you do not break:

An alarm clears only when the condition is gone AND it has been acknowledged.

The third row is the one that matters. If you clear the alarm the moment the value comes back, an event that happened at 3 a.m. is gone before the morning shift arrives.

First-out

When a pump trips, ten alarms arrive in one second and nine of them are consequences. First-out records which condition came first and locks that record until everything is clear. That is what tells you the cause instead of the symptoms.

Priority

ISA-18.2 wants priority assigned from consequence, not from how the programmer felt that day. Three or four levels is enough: critical, high, low, plus journal-only. A healthy distribution in practice is roughly 5% critical, 15% high, 80% low. If everything in your project is "high", your project has no priorities.

Too many alarms is a hazard

This is not a matter of taste. Major incidents, the 2005 Texas City refinery explosion among them, list alarm flood as a contributing factor. The ISA-18.2 targets per operator:

Every alarm with no required action is noise that buries the one that matters. If an operator does not have to do anything, it is not an alarm, it is information. Put it in the event journal and take it off the alarm list.

One more practical point

Annunciate the lamp differently for the two states: flashing for unacknowledged, steady for acknowledged-but-standing. An operator reads that across a room, which is more than can be said for a list on a screen.