ControlEngineeringeGuide-IntegratedSafety

1

Sponsored by

Integrating Emergency Shutdown Valves

With A Process Control System

Developing People: Making Operators

More Effective

5 ways to improve safety and

profitability, without disrupting operations

Process Safety What Are The Odds?

Analysis: Engineering Values From The

Top Down

Sponsor Profile 2

3

6

7

8

13

Control Engineering eGuide: Integrated Safety

http://www.abb.com/product/us/9AAC115764.aspx

2

Sponsored by

The ABB GroupABB is a global leader in power

and automation technologies that enable utility and industry customers to improve their performance while lowering environmental impact.

ABB Safety SystemsOver the past 30 years, ABB has

successfully delivered and installed safety systems in more than 55 coun-tries worldwide. We work hard with end-users to maintain and evolve existing installations, thereby maxi-mizing customer value and ensuring safe plant operation throughout the safety system lifecycle.

The Power of IntegrationThe potential and the power of integra-

tion lies in what can be achieved when information is made available, in context, to all of the devices, systems and individ-uals responsible for controlling, main-taining and managing production.

ABB’s integrated approach to safety and control is yielding more cost effective safety system (SIS) implementations while delivering significant operational benefits. ABB’s System 800xA architecture offers the flexibility of hosting both safety and process critical control applications in the same controller or on separate hardware if desired.

Either way, the user gains many of the same integration benefits, including common operator interface and engineering tools, plant-wide sequence-of-events (SOE) lists for consolidated root cause analysis, as well as centralized historian and data archiving.

Join the DiscussionSafety impacts many areas of plant

operations including profitability, security, operator effectiveness and availability to name a few.

Visit ABB’s Process Automation Insights blog to join the conversation.

Sponsor Profile

Batch and IMWorkplace(s)

System Servers

Plant Network,ERP, CMMS...

AC 800M Controller(s)

PR

OFI

BU

S (o

ptio

nally

red

und

ant)

Fieldbus

Op

tical

M

od

uleb

us

Asset Optimization Workplace(s)

Engineering Workplace(s)

Operator Workplace(s)

Safeguard400 Series

Safety High Integrity Controller(s)

Pressure Transmitter2600 T


Combined BPCS (Basic Process Control System)and Safety High Integrity Controller(s)

Positioner


Solenoid valve Solenoid valve

S800 I/O w.High IntegrityModule(s)

S800 I/O w.High IntegrityModule(s)S800L & S800 I/O

S800L & S800 I/O

S900 I/O for usein hazardousenvironments

Panel 800

System Network (optionally redundant)

Optical Modulebus(optionally redundant)

Optical Modulebus(optionally redundant)




More Effective





Top Down

Sponsor Profile


http://www.processautomationinsights.com/


3

Sponsored by

Within Process Plants, Layers Of Protection (Lop) Include Relief Valves, Rupture Disks, Dikes, And A Safety-Instrumented System (Sis). Siss Are Specially Engineered Solutions That Are Continuously Online And Expected To Instantaneously Take Action To Mitigate Any Detected Unsafe Process Events. Control Engineering Staff

But with weeks, months, or even years between unsafe events, what can be done to minimize the prob-ability of failure on demand (PFD) for some part of the SIS? The answer: select devices suitable for safety applications, engineer and install those devices using good engineering practices, apply sound maintenance practices, and test, test, test.

Improved Safety StandardsSafety standards were once

developed to satisfy the specific needs of an application, industry, and/or country. One example is the American National Standard Institute (ANSI) P-1.1-1969 standard

for defining safety requirements for pulp, paper, and paperboard mills in the U.S.

Often such standards are devel-oped as design specifications based on technologies available when the standard is released. Such standards assume system life-cycle activities, including installation, testing, and maintenance, are properly carried out—an assumption that repeat-edly has been proven wrong. (See ‘Incidents leading to improved safety standards’ sidebar.)

More recent safety stadards, such as those developed by the International Electrotechnical Commission (IEC) and Instru-mentation, Systems, and Automation Society (ISA), are based on identifying and quantifying risk, eliminating the risk when possible, and applying LOPs when risks can’t be completely eliminated to produce ‘performance-based’ standards.

IEC 61508 (Parts 1-7), Functional safety of electrical/electronic/programmable electronic safety-related systems , is an all-inclusive, performance-based standard that covers functional safety requirements for a range of industries including chemical, oil and gas, pulp and paper, non-nuclear power generation, as well as some non-process industries.

In response to feedback from early process industry adopters that IEC 61508 was cumbersome and somewhat inflexible, the IEC

committee extracted and reworded relevant sections to form IEC 61511 specifically for process industries. The result is a functional safety standard that provides process industries some degree of implementation flexibility while ensuring compliance is achieved within IEC 61508’s framework.

S84 Grandfather ClauseAngela Summers, president of

SIS-Tech Solutions and a voting member of ISA’s SP84 committee, says that ANSI/ISA S84.00.01-2004, Functional safety: Safety instru-mented systems for the process industry sector (S84-2004) matches IEC 61511 with one exception.

‘Included in S84-2004 is a grand-father clause that requires facility owner/operators to examine and document their SIS design, operation, and maintenance practices. If it’s determined the currently installed SIS provides safe operation, no system modifications are required. However, if the examination reveals the SIS is not providing adequate protection, it must be brought into compliance using the latest good engineering practices,’ says Summers.

The goal of IEC 61511 and S84-2004 is not to dictate what technology or level of redundancy must be applied. Rather, the intent of these safety standards is to ensure that the greater the process risk, the more robust the installed SIS.

Though compliance with IEC 61511 and S84-2004 remains voluntary, it is becoming the international safety system standard of choice for process industries as witnessed by the growing number of:

• Papers being presented by end-users at conferences and symposiums;

• References on process control system manufacturers’ Web sites; and

• References made by govern-ment agencies in China, India, Ireland, Italy, Norway, United Kingdom, and the United States.

One illustration of government’s awareness of S84 appeared in the $361,500 fine levied by the U.S. Labor Department’s Occupational Safety & Health Administration (OSHA) against Formosa Plastics of Illiopolis, IL. Among the 45 ‘serious violations’ alleged by OSHA, several referenced Formosa’s ‘failure to comply with recognized good engineering practices such as ANSI/ISA S84.’

(See this article online for a link to the OSHA citations document regarding Formosa Plastics.)

Where To FocusThe probability a device will fail on

demand (PFD) increases over time. However, following verification by another full-proof test that the device





More Effective





Top Down

Sponsor Profile


4

Sponsored by

is working correctly, it returns to its original reliability level. Increasing the frequency of full-proof tests lowers PFDAVG and provides two options: 1) use the same device to meet a higher safety level (SIL); 2) use a less-expen-sive device to achieve the same SIL.

When engineers and technicians begin learning about SISs, they often jump to the conclusion that triple or quadruple redundant logic solvers are required.

However, when data such as OREDA (Offshore REliability DAta) are examined, they learn that final control elements malfunction 50% of the time, sensors malfunction 42% of the time, and logic solvers malfunc-tion only 8% of the time. These facts don’t relieve anyone of the responsi-bility of selecting and installing the appropriate logic solver, but they do help emphasize the importance of considering all factors influencing SIS performance.

These factors include:

• Regular use of manual or automatwed partial-stroke valve testing can extend the time between full-proof tests

while maintaining the required PFDAVG.

• Failure rates and failure modes of components;

• Installed instrumentation;

• Redundancy;

• Voting;

• Diagnostic coverage; and

• Testing frequency.

The only way to ensure such factors are adequately addressed while avoiding over-engineering the solution is to establish good design criteria. That begins by conducting a risk analysis and determining the required safety integrity level (SIL) as defined within the IEC standard. (See ‘Demand mode of operation’ table.)

Once the required SIL is determined, the standard provides the target risk reduction factor (RRF) and the target average PFD, thus quantifying the SIS’s design criteria.

Of course, simply designing and installing an SIS to meet defined integrity numbers isn’t enough, the SIS must be maintained so that its

performance doesn’t degrade over time.

Reducing PFDThere are essentially three ways to

reduce the probability an SIS will fail on demand:

• Install double, triple, and quadruple devices;

• Increase device diagnostic coverage; and

• Increase the frequency at which devices are tested.

Today, extending diagnostic coverage is easier and more cost-effective with the abundance of devices that offer embedded diagnos-tics combined with asset manage-ment. However, when introducing such solutions as part of an SIS solution, special precautions are required.

For example, safety system experts at Exida.com examined use of multi-plexers with HART communication protocol, such as those available from Pepperl+ Fuchs, in conjunction with

Emerson Process Management’s Asset Management Solution (AMS) software to improve SIS device diag-nostic coverage.

Exida reported that the tested design can be effective in extending device diagnostic coverage andmeet many IEC 61511 requirements as long as:

• AMS software is set up with appropriate security for pass-words and privileges;

• Procedures are established and documented to ensure proper usage of the HART handheld communicator; and

• Multiplexer failure rates are accounted for in the SIS design.

• The third option for reducing PFD is to increase testing frequency for devices.

The graphic, ‘Testing frequency influences PFD AVG ‘ illustrates how more frequent full-proof testing lowers PFD AVG .

Readers should take note, however, that full-proof testing generally




More Effective





Top Down

Sponsor Profile


Exida.com

5

Sponsored by

requires the process be shutdown or bypass lines installed. With more process facilities running longer between planned shutdowns, oppor-tunities to conduct full-proof tests often aren’t available.

An alternative to full-proof testing is to partially stroke safety valves—not enough to cause process disrup-tions, but enough to verify the valve moves on demand.

The graphic ‘Benefit of partial-stroke valve testing’ illustrates how partial stroke valve testing can extend the time between full-proof test while maintaining the required PFD AVG .

Partial-Stroke Valve TestingThe three basic methods of partial-

stroke valve testing are:

• Mechanical limiting;

• Pulsed solenoid valves; and

• Position control.

Mechanical limiting is an inexpen-sive solution that involves installa-tion of a mechanical device, such as a collar, valve jack, or jammer, to limit the amount of valve travel. When these devices are being used, the safety valve is unavailable. Ensuring the valve has been returned to normal service is procedure driven.

The method of pulsing the electric signal to the safety valve’s solenoid valve is simple to implement and is very effective for on/off safety block valves. It requires limit switches (or position transmitters); adjustable, timed, pulsed outputs provided by the logic solver; and logic that forces the

solenoid valve to return to its safe position, to avoid spurious process shutdowns.

Position control is most effec-tive when using control valves and microprocessor-based ‘smart’ posi-tioners (controllers) as part of the SIS solution. Besides being able to move the valve to predetermined settings, smart positioners provide rich diagnostic coverage, such as valve travel and actuator breakaway force. Because safety valves haven’t typically been installed with posi-tioners, critics of this method cite the need for additional hardware and related installation costs as major drawbacks.

However, refining giant BP reports that after installing Metso Automation’s Neles VG800 valve controllers and ValvGuard testing and monitoring software, plant safety significantly increased and opera-tional costs were reduced. BP also reported a very short payback period.

Saudi Aramco reported similar successes on its safety valves following installation of Emerson’s FieldVue digital valve controllers.

One of the lesser-publicized benefits of increasing diagnostic coverage and/or the testing frequency of safety valves is possible elimina-tion of some safety valves. In some high-risk applications, it’s been a long-time practice to install two safety valves in series. The reason is that both valves are unlikely to fail to close on demand. However, with prudent use of redundant devices, the addition of diagnostic coverage, and increased testing frequency, some companies have eliminated one of the

two safety valves, reportedly without sacrificing safety coverage.

Demand mode of operationSafety integrity levelsTarget risk reduction factor failure on demandTarget average probability of & safety availability

NOTE: SIL 4 rated applications are not typically used in the process industries and the standard cautions that a single programmable safety system shouldn’t be used to meet SIL 4 requirements.Source: Control Engineering with data from IEC 61511-1 Table 31 (90—99%)10 to 1000.1 to 0.012 (99—99.9%)100 to 1,0000.01 to 0.0013 (99.9—99.99%)

1,000 to 10,0000.001 to 0.00014 (>99.99%)>10,000&0.0001

Incidents Preceding Im-proved Safety Standards

Pernis oil refinery, Holland - Jan. 20, 1968 (2 dead, 85 injured).

Flixborough, U.K. - Jun. 1, 1974 (28 dead, hundreds injured).

Seveso, Italy - Jul. 10, 1976 (700 injured).

Bhopal, India - Dec. 2, 1984 (2,500 dead, 100,000 injured).

Piper Alpha, U.K. (North Sea) - Jul. 6, 1998 (165 dead, 61 injured).

Source: Control Engineering




More Effective





Top Down

Sponsor Profile



6

Sponsored by

The Attitudes At The Top Of Your Company Influence Everything, For Better Or Worse.By Control Engineering Staff

Does your company value its people in the most literal sense of the word? While writing the article global process engineering (which will be in the April issue of Control Engineering), it became obvious that much manu-facturing philosophy comes from the top of an organization down, even for something as basic as safety. Some of those people in offices on ”mahogany row” are making decisions that could determine if you go home tonight in one piece. Here are two extreme examples.

Example 1: You probably heard about the Texas City BP refinery explosion in 2005 with its fatalities and injuries, not to mention the environmental impact and community disruption. After a very extensive investigation of the incident, the U.S. Chemical Safety and Hazard Investigation Board laid responsibility for this event squarely at the feet of BP management. A summary of the board’s findings was headlined : ”U.S. Chemical Safety Board concludes‘organizational and safety deficiencies at all levels of the BP Corporation’ caused March 2005 Texas City disaster that killed 15, injured 180.”

In the text of the same document, these two paragraphs sum up the grim situation, including manage-ment’s knowledge of the growing problems: ”BP acquired the Texas City refinery when it merged with Amoco in 1999. The CSB report found that‘cost-cutting in the 1990s by Amoco and then BP left the Texas City refinery vulnerable to a catastrophe.’ Shortly after acquiring Amoco, the BP group chief executive ordered an across-the-budget 25% cut in fixed spending at the corporation’s refin-eries. The impact of the cost cuts is detailed in many of the more than 20 key investigative documents the CSB made public today, including internal BP safety audits, reviews, and emails. Among other things, cost consider-ations discouraged refinery officials from replacing the blowdown drum with a flare system, which the CSB previously determined would have prevented or greatly minimized the severity of the accident.

Chairman Merritt said, ”The combi-nation of cost-cutting, production pressures, and failure to invest caused a progressive deterioration of safety at the refinery. Beginning in 2002, BP commissioned a series of audits and studies that revealed serious safety problems at the Texas City refinery, including a lack of neces-sary preventative maintenance and training. These audits and studies were shared with BP executives in London, and were provided to at least one member of the executive board. BP’s response was too little and too

late. Some additional investments were made, but they did not address the core problemsin Texas City. In 2004, BP executives challenged their refineries to cut yet another 25% from their budgets for the following year.”

Example 2: The opposite extreme of the spectrum has to be Dow Chemical Corporation. Hopefully there are many companies that share such a depth of commitment to personal and process safety. In a presentation delivered at ARC Advisory Group’s 2008 Global Manufacturer’s Forum, Margaret R. Walker, vice president, engineering solutions, technology centers, and manufacturing and engineering work process, made Dow’s global vision clear: ”You cannot compromise safety, regardless of local customs. Personal safety and process safety should be your number one priority and you should never lose that sight. There are few things more motivating to an employee than knowing the employer is making sure everything possible is being done so that they go home safely and that everyone around them is safe.”

Jerry Gipson, Dow’s director of itswe start with a safety moment. We try to personalize the message to put in each of our minds the idea of going home safely at the end of the day, but also expand it into larger stewardship that we do nothing to adversely impact the community. Back in the 1960s, when we launched our manufacturing excellence focus and embarked on some of the global

standardization efforts, that was driven by the desire to achieve differ-entiated safety performance. It was safety that got us up and going.”

Where is your company on this spectrum? I suspect most are some-where in between, but hopefully closer to Dow. That’s something you might want to think about carefully as you look at the top management of your company.

—Peter Welander, process industries editor, [email protected] , Process & Advanced Control Monthly

Analysis: Engineering Values From The Top Down




More Effective





Top Down

Sponsor Profile


mailto:[email protected]

7

Sponsored by

ABB And Dresser Masoneilan Integrate Capabilities To Improve Overall Process Safety, Emergency Valve Performance, And Availability.

ABB’s power and automation tech-nology group, announced that it will collaborate with Dresser Masoneilan, a supplier of process control valves, on an integrated process to monitor, test, and manage emergency shutdown valves (ESDV) during all operational conditions, from normal plant operations to abnormal situa-tions. These valves are crucial process elements for the oil, gas, and petro-chemical industries, as well as many other industrial processes.

”Our collaboration with industry leaders like Dresser Masoneilan helps us offer our mutual customers best-in-class safety solutions that will protect the integrity of their processes and the surrounding community,” said Luis Duran, ABB’s Americas business development manager for safety systems.

He adds that the combined solution leverages the capabilities of ABB’s 800xA High Integrity SIS (safety instrumented system) and Masoneilan’s SVI II ESD (emergency shutdown device) and PST Controller to improve overall plant safety and increase the availability of ESDV’s for optimal response of the isola-tion valve in emergency situations. This integration also simplifies safety compliance by automatically recording partial stroke test results and emer-gency shutdown events, saving time and money while increasing efficiency.

”By taking advantage of System 800xA’s integration capabilities and open standards, the user has imme-diate access to the health diagnos-tics and status of the emergency shutdown valve. This access also provides proactive management of this critical device, for instance enabling remote triggering of partial stroke tests, to ensure that it is ready to perform when needed,” said Kristian Olsson, manager of ABB’s Safety Center of Excellence. ”This immediate readiness is vital to the protection of the process, the environment, and the surrounding community in the event of an abnormal situation.”

As an integrated object within System 800xA, Masoneilan’s SVI II ESD device can be configured to perform scheduled partial valve stroke tests while remotely moni-toring and maintaining the emergency shutdown valves during normal plant operations. This minimizes the need for outages and downtime to evaluate the health and readiness of these critical process elements. The system also provides alerts and recommen-dations regarding valve status, as well as required partial stroke test and emergency shutdown signatures and documentation.

”While open standards offer great benefit for end users, it is the collabo-ration between automation vendors that provides for an ‘out-of-the-box’ solution capable of generating instant results,” said Sandro Esposito, global marketing manager digital products for Dresser Masoneilan. ”The SVI II ESD provides an excellent return on investment with its combined shutdown function, partial stroke test function and shutdown event black box into a single SIL3 certified device.”

The company says that the SVI II ESD is the latest technology in emer-gency shutdown valve automation

and the only SIL3-certified ESD certified at 4 mA with stainless steel housing. The device can be implemented using a 4-20 mA signal (analog safety demand), 0-24 Vdc (discrete safety demand) or a combi-nation of both. Standard on the device are an LCD display and explosion-proof external pushbuttons. This design architecture offers a sophis-ticated platform while being Type A (simplex device) compliant. ABB characterizes its System 800xA High Integrity as a next-generation safety system. This SIL 3 rated SIS provides the highest level of integration of safety and control on the market today, and an embedded diverse technology architecture that provides superior protection of the process, plant, personnel, and the environment while it optimizes overall process efficiency.

Edited by Peter Welander, [email protected]

Integrating Emergency Shutdown Valves With A Process Control System




More Effective





Top Down

Sponsor Profile



8

Sponsored by

Tools And Methods For Creating An Industrial Operator Workplace Ready For The Needs Of Today And Tomorrow. Improved Situational Awareness And Better Handling Of Abnormal Conditions Helps Operators Make Better Decisions And Improve Safety And Process Uptime.Hongyu Pei Breivold, Martin Olausson, Susanne Timsjo, Magnus Larsson, Roy Tanner

Process industries globally lose around $20 billion annually due to process disruptions, which represents about 5% of total production. Studies suggest 80% of these losses are preventable, and of these prevent-able losses, 40% are primarily due to operator errors. This means that the total improvement potential—if a way can be found to help avoid mistakes—totals $6.4 billion. Operator effec-tiveness is a fundamental element for sustaining the economic value of process control and management.

One place to begin the process is by empowering operators through improved situational awareness and better handling of abnormal condi-tions. Operators can then make better decisions and so improve safety and process uptime.

Striving for operator effectiveness implies facing a number of significant challenges regarding both technology and management. For instance, managing and monitoring industrial processes is characterized by inevi-table changes in technology, a dimin-ishing knowledge base due to demo-graphic changes in the workforce, and the ever-increasing complexity of operations. These factors may lead to huge cost escalations if operator effectiveness is not taken into account rigorously.

Developing an effective HMI (human machine interface) needs to look at the operator’s workflow and require-ments. A recent survey on operator effectiveness shows that this view is also shared by many of ABB’s customers.

Four pillars of operator ef-fectiveness

When designing an automation system, there are four main pillars affecting an operator’s performance:• Integrated operations• Design for high-performance• Attention to human factors, and• Operator competence.

Integrated operationsAn effective control system should

provide customers with the means to consolidate and rationalize data from various sources seamlessly.

It achieves collaboration between different computer programs and systems, supplying operators with all necessary information from any number of sources. Operators have intuitive access to actionable information and can manage views dynamically and effectively. These features reduce the time required to identify necessary actions.

Today, an operating plant may include multiple controller platforms including PLCs (programmable logic controllers), DCSs (distributed control systems), safety systems, FASs (facili-ties automation systems), and ECSs (electrical control systems) to name just a few. In addition, plant informa-tion systems such as CMMS (comput-erized maintenance management systems), ERP (enterprise resource planning), video monitoring systems, and data historians are also avail-able and contain valuable information that can support operators in their decision making.

Developing People: Making Operators More Effective




More Effective





Top Down

Sponsor Profile


9

Sponsored by

Design for high performanceMany standards organizations and

research institutes have made and continue to make valuable contri-butions to HMI philosophies. This knowledge has flowed into guidelines for interface design, ergonomics, situation awareness, and alarm management. Drawing on this as well as its own extensive expertise, ABB, along with other system designers, supports the establishment of good standards through its active partici-pation in various technical commit-tees, working groups, and scientific committees of standards-develop-ment organizations.

One key area affecting HMI devel-opment is the handling of abnormal situations. Abnormal situations are disturbances or incidents with which the control system is not able to cope of its own accord, and thus requires

operator intervention. When imple-menting a control system project, it is critical to customize the work-place layout based on the end user’s operational philosophy, and provide support for the implementation of high-performance alarm manage-ment strategies with features such as alarm shelving (operator-driven alarm suppression) and alarm hiding (condition-based alarm suppression). These features reduce the number of nuisance and noncritical alarms and so help end users meet or exceed current guidelines and standards such as EEMUA 191 and ISA SP18.2.

Ian Nimmo, abnormal situation management expert and author of ”High Performance HMI Handbook,” believes that a driving factor of high-performance design for HMIs is situ-ation awareness. He says, ”Having good situation awareness means the operator has an accurate perception

of the current condition of process and equipment, and an accurate under-standing of the meaning of various trends in the unit.”

Some of the key concepts that situation awareness reflects are color definitions and use to maximize visibility of abnormal situations. The situation awareness concept is not new. It is, however, still a matter of debate between multiple organiza-tions. One aspect being debated is the use of grayscale or cool process graphic schemes. In addition, navigation meth-odology, graphic-level definition for fast response under abnormal condi-tions, and presentation of information are used to seek to predict and avert abnormal situations completely.

One good example of situa-tion awareness as described in the ”High Performance HMI Handbook” mentioned above concerns two graphics that both embed the same information but have totally different effects on situation awareness. A graphic with a black background and an abundance of colors leads to poor situ-ation awareness even in normal situ-ations, whereas the graphic with gray scales and the sharp color for alarm depiction represents good situation awareness.

Situation awareness can make a huge impact by:

• Increasing the success rate in handling abnormal situations and returning to a normal mode of operation

• Reducing the time it takes plant operators to complete required tasks during an abnormal situa-tion, and

• Raising the incidence rate of control room operators detecting an abnormal situation prior to alarms occurring.

Attention to human factorsSystem designers need to address

attention explicitly to human factors. One main reason is that a skilled designer knows that a better working environment can reduce an operator’s stress, which in turn substantially increases the operator’s perfor-mance and effectiveness for handling abnormal situations, as well as reduces health issues and turnover of resources.

An effective operator workplace is equipped with advanced keyboards featuring hotkeys for multiclient handling, an operator desk system with motorized adjustable desk and monitor positioning, a directional sound system, and integrated dimmable lighting. Using such productive design concepts when creating control room environments has a major impact on the performance of operator teams. All these factors contribute to the enhancement of the operator environment and alertness level of control room operators.




More Effective





Top Down

Sponsor Profile


10

Sponsored by

Control room procedures are important to ensure consistency of operation. They can also support an operator in his or her activities that may be performed infrequently. An example of useful supporting mechanisms is the use of checklists to guide operators throughout the required procedures under specific circumstances.

Clear definition of job roles and responsibilities is another vital element that characterizes successful operations. This means that all the tasks an operator needs to perform should be recognized and docu-mented, including the tasks that go beyond operating in the normal mode.

In an effort to define a new standard for control rooms, or intel-ligent control centers, ABB and System 800xA have teamed with control-room furnisher CGM to create a demonstration project to empha-size an optimal control room layout with focus on human factors and ergonomics. The ”Future Operations Center” in Borås, Sweden, is the place

to visit to get the latest information about how to build the optimal control room. It covers, among others, such topics as sound, noise absorption, floor material, light control, and the color status of the process.

Operator competenceWhen operators interact with

processes, their actions often have huge business consequences, espe-cially when the process is in an excep-tional situation and operators need to understand and manage complex operations to support recovery. New technologies using simulators for advanced training can recreate the exact operator environment, including graphics and control logic. The simu-lator provides a safe and realistic environment in which process opera-tors and instrument technicians can learn how to master the process and increase their confidence.

In view of rapid technological evolu-tion, generational shifts in work-forces, and increasing complexity of

operations, there is an explicit need to address operator effectiveness directly throughout the whole life-cycle of a process-control system. To leverage the four pillars of operator effectiveness, a number of funda-mental activities are continuously going on: user-centered design and an eye to the future.

User-centered designDesigning an effective HMI requires

focusing on the control room opera-tor’s workflow and tasks. In order to achieve a good understanding of the workflow process and to obtain knowledge on how well the operator manages the significant number of operational tasks, the designer should perform operator task analyses together with operators through user

studies. The methods for user study include interviews, field studies, and observations.

Interview questions are sent to the operators before a planned interview to ensure that the users have the right profile and knowledge, and that they are well-prepared. The interview questions may be structured or unstructured, both in the form they are asked and in the way they can be responded to.

Field studies and observations represent a way to identify and prioritize operators’ goals and needs. By visiting users in their own working environ-ment and observing how they perform operational tasks, firsthand information is acquired with respect to the operators’ challenges and needs. This method is ideal for discovering incorrect or inef-ficient practices that the operators are




More Effective





Top Down

Sponsor Profile


11

Sponsored by

not aware of. Operators’ opinions should also be sought and direct feedback collected both for good practices and in areas with potential for improvement.

The collected data can then be analyzed and synthesized. The data synthesis process includes identifica-tion of the main concepts, indications from each user study, and analysis of how they relate to the improvement of operator effectiveness.

Another effective way to increase user focus is the establishment of a customer reference group (CRG) comprising customers from various domains. The purpose of the reference group is three-fold:

• Provide customers with firsthand information about ongoing and planned development projects

• Permit customers to actively influence the supplier’s develop-ment of the system’s operator interface, and

• Establish a forum for exchanging and testing ideas in user needs, trends, and future ventures in order to increase productivity and profits for customers.

Looking into the futureThe continuous progress in

software techniques related to user experience and interaction raises the need to permit existing human machine interfaces to evolve. As an example, ABB has a well-equipped user experience and interaction lab. The researchers look into the future, analyze the impact of emerging technologies, and explore efficient utilization and the reasonable combi-nation of existing and emerging technologies. In particular, ABB has just created a new research area dedicated to operator effectiveness. One of its tasks is to look at new technologies in the market and their

applications in industry domains. Examples include interaction, visual-ization, and design techniques.

Innovative ideas come from the viewpoint of centering operators’ work process and tasks to develop an effective HMI. It is common knowledge that process operation is teamwork. Different shifts need to communicate and cooperate with each other. Accordingly, to assist operators in undertaking these activi-ties, one innovative idea is a collabo-ration board, permitting operators to leave messages on real-time process displays, or using a drop-down whiteboard for sketching discussions. Such a collaboration function can serve various roles, including plant management, system management, managers, and maintenance and operation staff.

Operator effectiveness is a timeless characteristic and will always be important. Accordingly, in addition to improving operator effectiveness for the present generation of operators, it is critical to take future generations into account. Some customers are telling ABB that as the current work-force matures, operator expectations are evolving. Many operators being hired today grew up with computers and are ”digital natives.” For these new generations, visual learning is an ideal method to teach how the plant behaves. Studies of how such people operate the process show that they have more screens open than older crew members. They also ask for more customization of their screens. Newer operators tend to visualize the plant’s behavior graphically, whereas older operators seek to understand the plant in a sequential manner. System

designers should be actively moni-toring and applying future technolo-gies and design concepts to address younger generations whose operating skills are different from those of today.

The secret to operator effectiveness

Operator effectiveness is a chal-lenging area. Any company hoping to excel in this area must take a leading role in facilitating the pillars of operator effectiveness by:

1. Leveraging an automation platform that can natively promote and provide the level of integration and centralization required to promote a collabora-tive environment.

2. Providing assistance to meet standards and design philoso-phies in situation awareness and abnormal condition handling, as well as leverage an automa-tion system that has the flex-ibility to meet specific customer requirements.

3. Integrating human factors and best practices to provide the best in operator effectiveness.

4. Providing not only operator training but an environment that uses the most valuable assets and existing intellectual property to build operators’ confidence and competence.

A process manufacturer intent on developing effective operators should create an environment that provides operator effectiveness, conduct continuous activities in user-centered




More Effective





Top Down

Sponsor Profile


12

Sponsored by

design, and look into future technolo-gies and their applications in the area of operator effectiveness. This can reduce the scope for errors through more efficient use of the operator’s technological experience, quick access to relevant data in every operational situation, and assistance to opera-tors in decision-making processes. All of these imply sustained economic value.

ABB has achieved considerable success in boosting operational excellence by

focusing on operators and by providing process control interfaces that facilitate operators’ ability to make the right deci-sions during all modes of operation. It is committed to remaining at the forefront of these developments through continued research and development, helping customers achieve operational excellence.

Hongyu Pei Breivold, Martin Olausson, Susanne Timsjö, and Magnus Larsson work for ABB Corporate Research, Västerås, Sweden. Roy Tanner is with ABB Inc., Wickliffe, Ohio.

Additional Reading:Atkinson, T., Hollender, M., 2010, Operator Effectiveness, Collaborative Process Automation Systems, ISBN 978-1-936007-10-3.Hollifield, B., Oliver, D., Nimmo, I., Habibi, E., 2008, The High Performance HMI Handbook, ISBN-10: 0977896919, ISBN-13: 9780977896912, Plant Automation Services.




More Effective





Top Down

Sponsor Profile


http://www.amazon.com/Collaborative-Process-Automation-Systems-Hollender/dp/193600710X/ref=sr_1_1?s=books&ie=UTF8&qid=1310996677&sr=1-1




http://www.amazon.com/High-Performance-HMI-Handbook/dp/0977896919/ref=sr_1_1?s=books&ie=UTF8&qid=1310996710&sr=1-1






13

Sponsored by

Process industries are inherently hazardous, and maintaining safety in processes and operations has become increasingly complex and costly. But too often, companies have difficulty demonstrating a clear return on investment in their safety activities. With both safety and financial concerns being a high priority, those in the process industry sometimes struggle to reconcile them.

In 1994, the world’s regulatory environment was still reacting to the Bhopal, India gas leak that had occurred a decade before. At that time, the American Institute of

Chemical Engineers (AIChE) under-took a study to figure out how much emerging safety regulations actually cost. It concluded that, across all industry segments and plant sizes, the average U.S. industrial facility would start at 40 percent compliance and spend no less than $5.8 million over a decade to effectively achieve full safety compliance. The return on investment (ROI)? The kind that gives financial

executives gray hair: potential cost avoidance. That was 27 years ago, and process safety management has since come a long way. First, ongoing investments are thought to be far higher than the AIChE had calculated – ”up to one-third to one-half, or even more, of the capital and operating costs of the new plant handling the hazardous operations,” declares an abstract for another old study: The Real Cost of Process Safety – A Clear Case for Inherent Safety, published

in November 2003 by Process Safety and Environmental Protection, the journal of the European Federation of Chemical Engineering. But also important: the ROI is now known to be far more tangible than the ”what-if” costs of an avoided incident. Even 10 years ago, safety processes and technologies were being viewed for their impact on Overall Equipment Effectiveness (OEE) and plant effi-ciency. According to the results of a study by the Center for Chemical Process Safety, as cited in a 2001 workshop report, facilities that embed safety into their daily operations typically achieve a 5 percent produc-tivity increase, 3 percent reduction in production expenses, 5 percent reduc-tion in maintenance costs, 1 percent savings in capital expenses and 20 percent reduction in insurance costs. The timeline sends a clear message: While the cost of safety in process industries has far exceeded estimates from the dawn of the modern safety era, the benefits of safety are more tangible and substantial as well.

The simple assessment is that most companies can increase manu-facturing flexibility, profitability and overall competiveness while improving safety, with little disrup-tion and minimal capital expendi-ture. These savings arise across the process safety area, but we will focus here on those related to process automation. Many companies have paid for these potential benefits with process automation capabili-ties that now exist in-house but are

being underutilized or ignored. The trick is knowing where these poten-tial gains are hidden. Here, according to ABB Process Automation safety experts, are five areas where most companies can easily unlock improve-ments in safety and, quite possibly, profitability.

1. Utilization of existing automation

When a process is running, a well-designed automation system can deliver more reliability, repeat-ability and speed than any human being, according to David Huffman, a manager at ABB with background in chemical and process engineering. The control system can identify when processes change states, and can be programmed to act before those changes become critical. ”Chemical engineers like myself like to think you can put yourself at a steady-state process,” Huffman says. ”But trust me, you’re never at a steady state. It’s a misnomer. Processes are always changing.” Typically, an alarm management system is used to identify such changes, turning over the details of what to do about it to human operators. ”Obviously, there are times when that must happen,” Huffman says. ”But there are many other times when nothing is really going wrong. There are some changes that the automation system is capable of identifying and managing if it’s programmed properly.” As an

5 ways to improve safety and profitability, without disrupting operations




More Effective





Top Down

Sponsor Profile


14

Sponsored by

example, Huffman describes a distilla-tion process that requires the product to move through one of three drying beds. The beds are rotated through primary, secondary and regeneration modes. ”So you’re running full and at about the time you have to switch one bed offline, you find out there’s some-thing wrong with another bed and you can’t put it back into service on time.” The usual response is slowing down the distillation process while getting the troubled bed fixed. It’s a busy time for operators. ”When you start scaling down a distillation tower, it loses effi-ciency, you lose product quality, and control loops don’t perform well at the reduced-rate condition. The operator is cutting flow rates, changing tower pressure, dealing with overhead systems, boiler systems etc. The more complex the tower is, the worse it gets. And the whole time, alarms are

going off continuously.” But, Huffman continues, ”If you know this happens from time to time, you can record what the operator has to do and write a procedure around it for the automation to move the distillation process into a safer mode.” There is an advantage in speed, which reduces product waste. And automating the routine around best practices means achieving the same results, even if the event occurs when your best opera-tors are off-shift. Most companies have dozens of examples like this, Huffman says – events that happen often enough to automate, but not often enough to have confidence that every operator is always going to be adequately trained and tested. Admittedly, improving automation at this level isn’t easy or free. ”You have to go through the pain and expense of understanding your routine states,

defining them and putting in the programming code.” Many companies overlook this step when implementing a new automation system. ”There’s fatigue involved,” Huffman says. ”The company gets tired of spending money, and the people get tired of the constant change; they want to get back to a steady state too.” The good news, he says, is that it means you still have opportunity to make big improvements long after you’ve grown comfortable with an automa-tion system. Quantifiable benefits include reduced staffing, less wasted product, increased quality and faster adjustment of controls at a level of higher precision and repeatability. With respect to safety, it removes distractions from operators, making routine events out of occurrences that would previously have set off an alarm flood. Often discussed in the industry as state-based environ-ments, the discipline of improving automation across a wider array of recurring events is the subject of a new ISA committee. While ISA-106, focused on sequential process control, is a few years away from releasing its first set of standards, Huffman says the goal is to ”educate companies that processes run in states and, in order to keep them safe and profitable, it’s OK to take things out of operators’ hands and let the automation system do a lot more work. ”There are big companies that are embracing this because they are convinced it’s not only safer, but you can make money with it,” Huffman says.

2. Rationalizing alarmsHere’s a simple way to know if your

alarm management system is doing

its job well: Count the total number of alarms that the system activates during the course of a month and divide it by the number of operator hours worked during the same month.

If the total comes in at much more than 6 alarms per operator hour, then your system is running at an unnecessarily high level of risk and inefficiency. That rule of thumb (6 alarms per operator hour) is just a guideline, warns Ken Praprost, alarm management

optimization engineer at ABB. It’s far simplified from ISA-18.2, a new standard released in 2009 that addresses alarm management in process industries. ”During an ”alarm flood” period, you may get alarms at five or ten times that rate,” Praprost says. But six per hour per operator is one metric let you know if there’s a reason to go back to work on the alarm management system. In Praprost’s experience, most compa-nies deliver too many alarms, falling into three categories:

• Nuisance alarms: Those that go on and off so routinely that they eventually get ignored, like an alarm that sounds whenever process temperature rises above a threshold, even if the process generally takes care of itself before operators intervene. Praprost has frequently seen operations where there are so many standing alarms that they can only be viewed on multiple screens. ”And many of these may be for equipment that’s not even in use. The flow is zero, which sets off an alarm that the opera-tors simply have to look at.”




More Effective





Top Down

Sponsor Profile


15

Sponsored by

• Standing alarms: Those that remain in an active alarm state for a significant period of time.

• Non-alarms: Many alarms are really just events or data that someone in the organization had wanted recorded. In all three instances, operators struggle to identify important alarms, especially when alarms are not prioritized – a common condition everywhere. Fixing it can improve safety and potentially improve plant performance, Praprost says. ”If we can get the alarm system so it’s not providing useless information that operators don’t need to know, the operators can do a better job running the plant. They can avoid lost-production events simply because they didn’t pick out the right alarm from a long list of alarms that all look the same.” The main steps to improving an alarm management system are:

• Evaluate documentation and interview operators, engineers and supervisors: Investigate whether the systems operate as required and if personnel know why each alarm is triggered, precisely how to respond to it, and how easy is it to interact with the system interface.

• Performance assessment: A review of alarm data over an appropriate period of time (usually a few weeks to a month) to determine the rates, frequency of individual alarms, and response times to alarms.

• Benchmarking: Comparison of results with industry guidelines.

• Recommendations for improvement.

• Plan and implement an improvement program.

• Establish an appropriate moni-toring and review process.

”One thing we’ve learned is that people like to put an alarm on anything. If we investigate further, we can reclassify many of the alarms as events so they don’t occupy space on the list. Then we repriori-tize to identify the true high-priority items,” Praprost says. There are also strategies for dealing with nuisance alarms, vastly reducing how often they trip while assuring that they do appear when intervention is required. Evaluating such issues is a process independent of the type of system being used. While it requires some cost, it can be conducted with minimal interruption and meaningful improve-ments in the way processes are managed. It not ony brings significant improvements in plant safety; alarm rationalization can make a significant impact to the bottom line by reducing unnecessary plant trips.

3. Consider human factorsIf alarm management tends to

place too much reliance on people, human factors explore the issues created by the fact that people are the most fallible part of a safety system. Human factors typically include such areas as the design of interfaces and displays, lighting, noise management, staffing, safety-critical communications, ergonomics and, as already discussed, alarm manage-ment. ”In human factors, a key issue is that people are overloaded with

information. When something goes wrong, the system is not well-enough designed to allow time for reaction. It doesn’t direct people where to look for the information they need,” says Chris Greaves, business manager at ABB Consulting. ”While that is obvi-ously relevant to alarm management, it also applies to the other human factor areas.” As an example, Greaves says it’s common practice for work permits in a facility to be managed in the control room. ”The argument is that if people want to get work done, they need to check in with the process superintendent.” The commo-tion related to issuing work permits can be a safety distraction to opera-tors, Greaves argues, but he has seen instances where lighting was used to minimize the disruption, by dark-ening that part of the room where permits are issued when lighting is not required.

Other human-factor techniques can include providing different audible tones for different types of alarms, or automated redirection of lighting to focus on the correct displays during alarm bursts. Ventilation

– maintaining a temperature that keeps people comfortable but alert – is a common challenge in many control rooms, Greaves says. ”As with anything, you can quickly get into a project that suddenly would have people writing large checks for fancy displays and ergonomic chairs,” he notes. ”There are certainly times when that is justified and prudent, but if you’re talking about ways to improve operations and reduce safety risk, you simply cannot overlook these human factors. The control room is your last line of defense, and for many companies, it would be very easy and affordable to find multiple opportuni-ties to change the environment in a way that helps the people who work there to do a better job.”

4. Don’t purchase unnecessary redundancy

Redundancy is not equivalent to safety, and safety does not require redundancy. ”People get the two confused,” laments ABB’s Huffman. ”People get locked into thinking that if




More Effective





Top Down

Sponsor Profile


16

Sponsored by

they’re going to have a safety system, it has to have full logic solver redun-dancy, often to 3x or 4x levels, in order to be safe.” That means they have to invest in a second set of equipment that is going to require regular testing and maintenance, and if all goes well they’re never going to use it.

”It’s not a true statement” Huffman says. ”You can have single-element safety systems that can be certified up to SIL 3 levels.” When a single-processor system detects a process problem that justifies tripping the plant, then it’s designed to lead the plant through a safe shutdown. In the case of an internal fault, it will also shut down the process safely, per SIL 3 safety requirements. ”In that case,” Huffman says, ”I’ve lost the process, not because of a process problem, but because of a fault in the system. If you want to keep the process running, then redundancy is a matter of maintaining uptime, but not process safety.” Sometimes, keeping the process running is impor-tant for personnel safety, Huffman says, because certain startups and shutdowns can put people at risk. But that’s a different decision than the process safety itself. Huffman’s point is that companies pay for logic solver redundancy in cases where the investment might have more impact elsewhere, whether in other areas of safety or in operating efficiency. His recommendation is that compa-nies pay to put at least one person, who is respected at the executive level, through some level of basic safety education, such as the ISA’s EC50 course on Safety Instrumented Systems (SIS). Then use that educa-tion as part of the decision-making process around investments in safety

and process automation. Having this knowledge can help with making system selections based on key performance requirements rather than the redundancy architecture of the logic solvers.

5. Map the competence of people

One well-worn, under-attributed statistic in process safety automa-tion is that machinery is typically the cause in 10 percent of failures; the other 90 percent of the time, human error is to blame. Lack of a source for this statistic notwith-standing, few people seem to argue the point that human error is the least predictable and more common source of breakdowns in safety. With that in mind, John-Erlend Stromme, Service Manager, ABB Oil, Gas and Petrochemical Business Unit, , suggests that any company would benefit from a routine and systematic review of the way safety competence is built and maintained among its people. ”Competence is simply being aware that you are doing things right. A small mistake can start the ball rolling, and anytime we, as an industry, find ourselves looking at a major accident, it seems that’s ultimately how it started,” Stromme says. Competence, however, is not simple. It’s a combination of having the right technical knowl-edge, knowledge of work processes and experience for whatever situa-tion an individual may face. ”It’s not just knowing what you’re doing, but knowing how to follow procedures so you can avoid making an error you didn’t know about,” Stromme

says. Facets in mapping competence include documenting the type of education each worker has received, and what kind of experience, detailed to specific tasks and technologies. Requirements and certifications in specific work environments are considered as well. More difficult but equally important, he notes, is to map an individual’s attitude to reducing risk and conducting high-risk work. ”People around him will know whether he’s someone who tends to make a situation more or less safe. Whether you can get that informa-tion or not goes to the culture of the company: Do they dare to tell you,” he says, ”or do they dare not to tell you? ”When you take seriously this process of understanding the competence of each worker, as an individual, that says a lot about the importance of safety in an organization,” Stromme says. ”You’ll get the level of informa-tion that you have earned, based on past experiences that your people have. If you demonstrate an open mind and attitude – that people won’t be punished, and that information will be used to help everyone become better and safer at their job – you are already doing a very good job of reducing risk in your operation.”Summary

There is no avoiding the need to make ongoing investments in all aspects of safety: equipment, processes, systems and people. But not all investments are the same. While some require long-term planning and capital budgets, others are small and fast. And still others have already been made, and are waiting to be utilized and optimized. By focusing on these five areas:

• Increasing utilization of automation

• Decreasing utilization of alarms• Considering human factors• Understanding the role of

redundancy• Mapping the competence of

people

most process companies can unlock hidden safety improvements, and in many cases increasing operating effectiveness, without disrupting ongoing operations or making large investments.

For more information please contact:North America Customer Service Center29801 Euclid AvenueWickliffe OH 44092 1832, USA

Tel: 1 800 HELP 365(1 800 435 7365) Option 4Outside USA/Canada: +1 440 585 7804Fax: +1 440 585 5087

E-mail: [email protected]

Visit ABB’s Process Automation Insights blog to join the conversation.




More Effective





Top Down

Sponsor Profile



www.abb.com



ControlEngineeringeGuide-IntegratedSafety

Documents

Transcript of ControlEngineeringeGuide-IntegratedSafety