HUMAN FACTORS IN ALARM SYSTEM MANAGEMENT: INFORMATION VERSUS DATA David A. Strobhar Beville Engineering, Inc.

201 West Franklin, Suite D Dayton, Ohio 45459 ABSTRACT: INFORMATION VERSUS DATA The design of process plant alarm systems requires that process upset data be translated into information for operators and supervisors. Techniques for the translation of data into useful information are discussed relative to hardwired, CRT-based, and hybrid alarm systems. The application of human information processing characteristics and human engineering principles to alarm system design and alarm management is highlighted. INTRODUCTION: The purpose of an alarm warning system has remained constant over the past few decades alarms are still present to alert a person to some event or condition. The alerting function is not one of random or spurious alerting; rather, the alerting is to prompt an action from the individual, whether it is to inspect a system or use some control. In contrast to the alarm systems consistency of function, the methods to carry out that function have changed remarkably. The advent of CRTs/VDTs (Cathode Ray Tubes/ Video Display Terminals) and distribution control systems has provided the system designer with new opportunities and ways to present alarm information. No longer is the designer forced to utilize hardwired, single-cause alarm panels. The change in control systems has also changed the role of the system user, for this discussion, the process plant operator. Operators have become more of a problem solver and less of a direct controller (1). The operators primary function is to backup the automatic control system and utilize the superior flexibility of the human information processing system to diagnose complex problems and upsets. This new type of operator can now be provided alarm data in almost unlimited quantity and format. Unfortunately, the operator, the problem solver, doesnt need data. INFORMATION OVER DATA: Data alone are essentially useless. Given just data, E.G. 291693201, making a decision would be difficult. Information is needed to make a decision. What, then, differentiates information from data? Simply, information is data with meaning or structure: Information = Data * Structure

The data 291693201 is meaningless until structure, two hyphens, is added to form 29169-3201. The structure forces the data to resemble that associated with a social security number. The information is now that the sequence of digits is most likely a social security number. The structure has not changed the data, but it has provided the person with information that can be used to make a decision or come to a conclusion. With regards to an alarm system, and alarm is to prompt an action. An action requires a decision. A decision requires information. The trick then is to ensure that process data is transformed into alarm information. HUMAN FACTORS ENGINEERING OF WARNING SYSTEMS The goal of a well-designed warning system is to prompt the operator to the intended action in the required period of time. The need for information being provided the operator is one necessary criterion, as previously discussed. However, providing information is a vague goal and must be achieved by more concrete analytical techniques. The man-machine model (Figure 1) forms the basis for the creation of alarm systems that provides information and not just data. Relative to alarm systems, the output of the model is an action related to the system in which the alarm is activated. The alarm is the input upon which the operator acts to make a decision on what output is required. This holds true for any warning system: hardwired, computer-based, or hybrid. The driving feature of the man-machine model is the output: What is the desired operator action. If no action can be defined, no alarm should be provided. Likewise, if the same action is the output for two alarms, only one alarm is needed. The information processing portion of this model is the most difficult to apply, but also the area of greatest potential gains. Information processing analysis is the definition of the structure that will transform data into information. The human information processing system has several unique characteristics that should be reflected in alarm system design. The first and perhaps most important characteristic is our limitation to mentally handle pieces of information. Our conscious, or short-term memory is restricted to seven, plus or minus two, chunks of information (2). Stress, anxiety, and tension lower that number even further. Therefore, alarm systems should not present over seven chunks of information at a time. The second characteristic provides the caveat for the first; namely, we humans like to process information in a holistic manner, combining and aggregating information into groups or patterns that result in the reduction of the total chunks of information. Using our previous example, 291-69-3201 would be processed as one chunk, not nine. These two conflicting and complimentary characteristics are what allow an operator to look at alarm panels with 300-1,000 annunciator alarms and not be overloaded. An operator can combine the alarms in manageable sized groups.

A well human engineered system will contain the structure that facilitates the aggression of alarm data into information groups. The input aspect of the model is quite simple once the output and transformation pieces have been defined. The only variables left are the assurances that the alarm is detected (visibility, conspicuity, signal/ noise ratio) and the message understood (readability, clarity, comprehensibility). Existing human factors engineering standards document the requirements for display parameters (3), (4), (5). A PRACTICAL EXAMPLE: HYBRID ALARM SYSTEM Beville Engineering undertook an analysis of a proposed Hybrid Alarm System design. The system would combine a modern distributed control system with two hardwired alarm annunciator panels. The unit where this would occur was a fluid catalytic cracking unit at an older, mid-size U.S. oil refinery. Two alternative concepts were proposed by the refinery for the two-hardwired alarm panels: (1) only critical alarms on the two panels or (2) critical alarms on one panel and non-critical alarms on the other. Either concept is valid and achievable. The task was to determine the superior concept and to structure the data in either concept, using the manmachine model, into useful information. Remember that in distributed control, the operator must search for the part of the process they wish to inspect. The operator can no longer simply scan the boards looking for anomalies. In addition, the operator is to solve complex problems and back-up the automatic control. The operator output requirements (actions) were delineated through procedural walkthroughs. Operators were queried regarding how they responded to key process upsets. Included in the walk-throughs were questions regarding the decision process the operators used to diagnose upset causes. Structure provided to alarm data by the current control room design was delineated. It was determined that the first concept proposed by the refinery (i.e., only critical alarms on the two panels) would be of greatest benefit to the control room staff. The critical panel concept would allow the chief operator and other supervisory personnel to obtain situational status at a glance without having to disturb the board operators. A critical panel concept could also provide the operators an overview of the situation and act as a cheat sheet (direct them on where to look) on which system alarms should be called-up on the CRT screen. No part of the alarm system (CRT displays, keyboards, alarm panels) is independent of any other part; therefore, it is essential that the critical panels be configured for ease of use with the CRT displays and the computer keyboard. An integrated concept was developed and shown in Figure 2. The panel columns were dedicated to a system with sub-systems in groups of four in the column.

Figure 2. Hybrid Alarm System Concept

Each group of four (sub- system) corresponded to a key on the keyboard in the same relative location. The key accessed a display showing all alarms for the sub-system. Many of the critical alarms were logically combined (OR-ed) sub-system alarms, forming a single trouble alarm. Several other features were utilized as part of the alarm system design. Pump alarms were grouped with their corresponding flow alarms, as operators indicated that upon a low flow alarm they first checked the pump alarm to see if the problem was a controller or a pump. The grouping of alarms into column-systems allowed hierarchal labeling (e.g., label the column power recovery train, and not repeat this on each alarm titled) for enhanced readability. Alarm titles were given a standardized nomenclature of item/parameter/condition (e.g., vessel/level/high) The basic approach for the Hybrid System applies to both conventional and advanced warning systems. That is, seek out the user and define (1) what are they supposed to do and (2) how will they decide to do it. Design of an alarm system to accomplish (1) and (2) is then relatively straightforward. CONCLUSION: The key to the design of an effective alarm system is to ensure that the operator is provided with information. Data are not information; rather, information is data within a structure. It is the responsibility of the alarm system designer to provide structure to the data and ensure that the operator has information. A four-step process forms the basis for ensuring proper data structure (i.e., information). The four steps are based on the model of man-machine systems and are: 1) 2) 3) 4) Define the desired action. Determine how the decision for action will be made. Structure alarm logic to support the decision. Design the physical system to transfer the information to the operator.

A well human factored and easy to use alarm system is not difficult to achieve. Simple incorporation of the job requirements and human information processing characteristics into system design produces the desired result. Minimal impact is made on project time and cost, while a significantly positive impact is made on system efficiency and safety.

REFERENCES (1) Eberts, R.A., and Schneider, W., Internalizing the System Dynamics for a Second Order System. Human Factors, 1985, 27 (4), 371-393. (2) Miller, G.A., The Magical Number Seven, plus or minus two: Some units on our capacity to process information. Psychological Review, 1956, 63, 81-97. (3) McCormick, E.J., Human Factors In Engineering and Design, McGraw-Hill, NY, 1976, 4th edition. (4) Van Cott, K., and Kinkade, R., (Eds), Human Engineering Guide to Equipment Design, U.S. Government Printing Office, 1972. (5) _______, MIL-STD-1427C, Human Engineering Design Criteria for Military Systems, Equipment and Facilities, U.S. Government Printing Office.