1

Sponsor Profile Process Safety What Are The Odds? Analysis: Engineering Values From The Top Down Integrating Emergency Shutdown Valves With A Process Control System Developing People: Making Operators More Effective 5 ways to improve safety and profitability, without disrupting operations

2 3

Control Engineering eGuide: Integrated Safety

13

Sponsored by

Sponsor Profile
Sponsor Profile Process Safety What Are The Odds? Analysis: Engineering Values From The Top Down Integrating Emergency Shutdown Valves With A Process Control System Developing People: Making Operators More Effective 5 ways to improve safety and profitability, without disrupting operations The ABB Group
ABB is a global leader in power and automation technologies that enable utility and industry customers to improve their performance while lowering environmental impact.

The Power of Integration

The potential and the power of integration lies in what can be achieved when information is made available, in context, to all of the devices, systems and individuals responsible for controlling, maintaining and managing production. ABBs integrated approach to safety and control is yielding more cost effective safety system (SIS) implementations while delivering significant operational benefits. ABBs System 800xA architecture offers the flexibility of hosting both safety and process critical control applications in the same controller or on separate hardware if desired.

Either way, the user gains many of the same integration benefits, including common operator interface and engineering tools, plant-wide sequence-of-events (SOE) lists for consolidated root cause analysis, as well as centralized historian and data archiving.

ABB Safety Systems

Over the past 30 years, ABB has successfully delivered and installed safety systems in more than 55 countries worldwide. We work hard with end-users to maintain and evolve existing installations, thereby maximizing customer value and ensuring safe plant operation throughout the safety system lifecycle.

Join the Discussion

Safety impacts many areas of plant operations including profitability, security, operator effectiveness and availability to name a few. Visit ABBs Process Automation Insights blog to join the conversation.

Plant Network, ERP, CMMS... System Servers Batch and IM Workplace(s) Asset Optimization Workplace(s) Engineering Workplace(s)
System Network (optionally redundant)

Operator Workplace(s)

AC 800M Controller(s) Panel 800

Fieldbus
Optical Modulebus (optionally redundant)

Combined BPCS (Basic Process Control System) and Safety High Integrity Controller(s) S800 I/O w. High Integrity Module(s)

Safety High Integrity Controller(s) Safeguard 400 Series S800 I/O w. High Integrity Module(s)

Optical Modulebus (optionally redundant)

Positioner S800L & S800 I/O

PROFIBUS (optionally redundant)

Sponsored by

Optical Modulebus

S800L & S800 I/O

Solenoid valve

Solenoid valve

S900 I/O for use in hazardous environments

Pressure Transmitter 2600 T

Pressure Transmitter 2600 T

Pressure Transmitter 2600 T

Sponsor Profile Process Safety What Are The Odds? Analysis: Engineering Values From The Top Down Integrating Emergency Shutdown Valves With A Process Control System Developing People: Making Operators More Effective 5 ways to improve safety and profitability, without disrupting operations

Process Safety What Are The Odds?

Within Process Plants, Layers Of Protection (Lop) Include Relief Valves, Rupture Disks, Dikes, And A Safety-Instrumented System (Sis). Siss Are Specially Engineered Solutions That Are Continuously Online And Expected To Instantaneously Take Action To Mitigate Any Detected Unsafe Process Events.
Control Engineering Staff But with weeks, months, or even years between unsafe events, what can be done to minimize the probability of failure on demand (PFD) for some part of the SIS? The answer: select devices suitable for safety applications, engineer and install those devices using good engineering practices, apply sound maintenance practices, and test, test, test. for defining safety requirements for pulp, paper, and paperboard mills in the U.S. Often such standards are developed as design specifications based on technologies available when the standard is released. Such standards assume system life-cycle activities, including installation, testing, and maintenance, are properly carried outan assumption that repeatedly has been proven wrong. (See Incidents leading to improved safety standards sidebar.) More recent safety stadards, such as those developed by the International Electrotechnical Commission (IEC) and Instrumentation, Systems, and Automation Society (ISA), are based on identifying and quantifying risk, eliminating the risk when possible, and applying LOPs when risks cant be completely eliminated to produce performancebased standards. IEC 61508 (Parts 1-7), Functional safety of electrical/electronic/ programmable electronic safetyrelated systems , is an all-inclusive, performance-based standard that covers functional safety requirements for a range of industries including chemical, oil and gas, pulp and paper, non-nuclear power generation, as well as some non-process industries. In response to feedback from early process industry adopters that IEC 61508 was cumbersome and somewhat inflexible, the IEC committee extracted and reworded relevant sections to form IEC 61511 specifically for process industries. The result is a functional safety standard that provides process industries some degree of implementation flexibility while ensuring compliance is achieved within IEC 61508s framework. Though compliance with IEC 61511 and S84-2004 remains voluntary, it is becoming the international safety system standard of choice for process industries as witnessed by the growing number of: Papers being presented by end-users at conferences and symposiums; References on process control system manufacturers Web sites; and References made by government agencies in China, India, Ireland, Italy, Norway, United Kingdom, and the United States.

S84 Grandfather Clause

Angela Summers, president of SIS-Tech Solutions and a voting member of ISAs SP84 committee, says that ANSI/ISA S84.00.01-2004, Functional safety: Safety instrumented systems for the process industry sector (S84-2004) matches IEC 61511 with one exception. Included in S84-2004 is a grandfather clause that requires facility owner/operators to examine and document their SIS design, operation, and maintenance practices. If its determined the currently installed SIS provides safe operation, no system modifications are required. However, if the examination reveals the SIS is not providing adequate protection, it must be brought into compliance using the latest good engineering practices, says Summers. The goal of IEC 61511 and S84-2004 is not to dictate what technology or level of redundancy must be applied. Rather, the intent of these safety standards is to ensure that the greater the process risk, the more robust the installed SIS.

One illustration of governments awareness of S84 appeared in the $361,500 fine levied by the U.S. Labor Departments Occupational Safety & Health Administration (OSHA) against Formosa Plastics of Illiopolis, IL. Among the 45 serious violations alleged by OSHA, several referenced Formosas failure to comply with recognized good engineering practices such as ANSI/ISA S84. (See this article online for a link to the OSHA citations document regarding Formosa Plastics.)

Improved Safety Standards

Sponsored by
Safety standards were once developed to satisfy the specific needs of an application, industry, and/or country. One example is the American National Standard Institute (ANSI) P-1.1-1969 standard

Where To Focus
The probability a device will fail on demand (PFD) increases over time. However, following verification by another full-proof test that the device

4
is working correctly, it returns to its original reliability level. Increasing the frequency of full-proof tests lowers PFDAVG and provides two options: 1) use the same device to meet a higher safety level (SIL); 2) use a less-expensive device to achieve the same SIL. When engineers and technicians begin learning about SISs, they often jump to the conclusion that triple or quadruple redundant logic solvers are required. while maintaining the required PFDAVG. Failure rates and failure modes of components; Installed instrumentation; Redundancy; Voting; Diagnostic coverage; and Testing frequency. performance doesnt degrade over time. Emerson Process Managements Asset Management Solution (AMS) software to improve SIS device diagnostic coverage. Exida reported that the tested design can be effective in extending device diagnostic coverage andmeet many IEC 61511 requirements as long as: AMS software is set up with appropriate security for passwords and privileges; Procedures are established and documented to ensure proper usage of the HART handheld communicator; and Multiplexer failure rates are accounted for in the SIS design. The third option for reducing PFD is to increase testing frequency for devices.

Sponsor Profile Process Safety What Are The Odds? Analysis: Engineering Values From The Top Down Integrating Emergency Shutdown Valves With A Process Control System Developing People: Making Operators More Effective 5 ways to improve safety and profitability, without disrupting operations

Reducing PFD
There are essentially three ways to reduce the probability an SIS will fail on demand: Install double, triple, and quadruple devices; Increase device diagnostic coverage; and Increase the frequency at which devices are tested.

Today, extending diagnostic coverage is easier and more costeffective with the abundance of devices that offer embedded diagnostics combined with asset management. However, when introducing such solutions as part of an SIS solution, special precautions are required. However, when data such as OREDA (Offshore REliability DAta) are examined, they learn that final control elements malfunction 50% of the time, sensors malfunction 42% of the time, and logic solvers malfunction only 8% of the time. These facts dont relieve anyone of the responsibility of selecting and installing the appropriate logic solver, but they do help emphasize the importance of considering all factors influencing SIS performance. These factors include: Regular use of manual or automatwed partial-stroke valve testing can extend the time between full-proof tests The only way to ensure such factors are adequately addressed while avoiding over-engineering the solution is to establish good design criteria. That begins by conducting a risk analysis and determining the required safety integrity level (SIL) as defined within the IEC standard. (See Demand mode of operation table.) Once the required SIL is determined, the standard provides the target risk reduction factor (RRF) and the target average PFD, thus quantifying the SISs design criteria. Of course, simply designing and installing an SIS to meet defined integrity numbers isnt enough, the SIS must be maintained so that its For example, safety system experts at Exida.com examined use of multiplexers with HART communication protocol, such as those available from Pepperl+ Fuchs, in conjunction with

The graphic, Testing frequency influences PFD AVG illustrates how more frequent full-proof testing lowers PFD AVG . Readers should take note, however, that full-proof testing generally

Sponsored by

5
requires the process be shutdown or bypass lines installed. With more process facilities running longer between planned shutdowns, opportunities to conduct full-proof tests often arent available. An alternative to full-proof testing is to partially stroke safety valves not enough to cause process disruptions, but enough to verify the valve moves on demand. The graphic Benefit of partialstroke valve testing illustrates how partial stroke valve testing can extend the time between full-proof test while maintaining the required PFD AVG . solenoid valve to return to its safe position, to avoid spurious process shutdowns. Position control is most effective when using control valves and microprocessor-based smart positioners (controllers) as part of the SIS solution. Besides being able to move the valve to predetermined settings, smart positioners provide rich diagnostic coverage, such as valve travel and actuator breakaway force. Because safety valves havent typically been installed with positioners, critics of this method cite the need for additional hardware and related installation costs as major drawbacks. However, refining giant BP reports that after installing Metso Automations Neles VG800 valve controllers and ValvGuard testing and monitoring software, plant safety significantly increased and operational costs were reduced. BP also reported a very short payback period. Saudi Aramco reported similar successes on its safety valves following installation of Emersons FieldVue digital valve controllers. One of the lesser-publicized benefits of increasing diagnostic coverage and/or the testing frequency of safety valves is possible elimination of some safety valves. In some high-risk applications, its been a long-time practice to install two safety valves in series. The reason is that both valves are unlikely to fail to close on demand. However, with prudent use of redundant devices, the addition of diagnostic coverage, and increased testing frequency, some companies have eliminated one of the two safety valves, reportedly without sacrificing safety coverage. Demand mode of operation Safety integrity levels Target risk reduction factor failure on demand Target average probability of & safety availability NOTE: SIL 4 rated applications are not typically used in the process industries and the standard cautions that a single programmable safety system shouldnt be used to meet SIL 4 requirements. Source: Control Engineering with data from IEC 61511-1 Table 3 1 (9099%) 10 to 100 0.1 to 0.01 2 (9999.9%) 100 to 1,000 0.01 to 0.001 3 (99.999.99%) 1,000 to 10,000 0.001 to 0.0001 4 (>99.99%) >10,000 &0.0001

Sponsor Profile Process Safety What Are The Odds? Analysis: Engineering Values From The Top Down Integrating Emergency Shutdown Valves With A Process Control System Developing People: Making Operators More Effective 5 ways to improve safety and profitability, without disrupting operations

Incidents Preceding Improved Safety Standards

Pernis oil refinery, Holland - Jan. 20, 1968 (2 dead, 85 injured). Flixborough, U.K. - Jun. 1, 1974 (28 dead, hundreds injured). Seveso, Italy - Jul. 10, 1976 (700 injured). Bhopal, India - Dec. 2, 1984 (2,500 dead, 100,000 injured). Piper Alpha, U.K. (North Sea) - Jul. 6, 1998 (165 dead, 61 injured). Source: Control Engineering

Partial-Stroke Valve Testing

The three basic methods of partialstroke valve testing are: Mechanical limiting; Pulsed solenoid valves; and Position control.

Mechanical limiting is an inexpensive solution that involves installation of a mechanical device, such as a collar, valve jack, or jammer, to limit the amount of valve travel. When these devices are being used, the safety valve is unavailable. Ensuring the valve has been returned to normal service is procedure driven. The method of pulsing the electric signal to the safety valves solenoid valve is simple to implement and is very effective for on/off safety block valves. It requires limit switches (or position transmitters); adjustable, timed, pulsed outputs provided by the logic solver; and logic that forces the

Sponsored by

Sponsor Profile Process Safety What Are The Odds? Analysis: Engineering Values From The Top Down Integrating Emergency Shutdown Valves With A Process Control System Developing People: Making Operators More Effective 5 ways to improve safety and profitability, without disrupting operations

Analysis: Engineering Values From The Top Down

The Attitudes At The Top Of Your Company Influence Everything, For Better Or Worse.
By Control Engineering Staff Does your company value its people in the most literal sense of the word? While writing the article global process engineering (which will be in the April issue of Control Engineering), it became obvious that much manufacturing philosophy comes from the top of an organization down, even for something as basic as safety. Some of those people in offices on mahogany row are making decisions that could determine if you go home tonight in one piece. Here are two extreme examples. Example 1: You probably heard about the Texas City BP refinery explosion in 2005 with its fatalities and injuries, not to mention the environmental impact and community disruption. After a very extensive investigation of the incident, the U.S. Chemical Safety and Hazard Investigation Board laid responsibility for this event squarely at the feet of BP management. A summary of the boards findings was headlined : U.S. Chemical Safety Board concludesorganizational and safety deficiencies at all levels of the BP Corporation caused March 2005 Texas City disaster that killed 15, injured 180. In the text of the same document, these two paragraphs sum up the grim situation, including managements knowledge of the growing problems: BP acquired the Texas City refinery when it merged with Amoco in 1999. The CSB report found thatcost-cutting in the 1990s by Amoco and then BP left the Texas City refinery vulnerable to a catastrophe. Shortly after acquiring Amoco, the BP group chief executive ordered an across-the-budget 25% cut in fixed spending at the corporations refineries. The impact of the cost cuts is detailed in many of the more than 20 key investigative documents the CSB made public today, including internal BP safety audits, reviews, and emails. Among other things, cost considerations discouraged refinery officials from replacing the blowdown drum with a flare system, which the CSB previously determined would have prevented or greatly minimized the severity of the accident. Chairman Merritt said, The combination of cost-cutting, production pressures, and failure to invest caused a progressive deterioration of safety at the refinery. Beginning in 2002, BP commissioned a series of audits and studies that revealed serious safety problems at the Texas City refinery, including a lack of necessary preventative maintenance and training. These audits and studies were shared with BP executives in London, and were provided to at least one member of the executive board. BPs response was too little and too late. Some additional investments were made, but they did not address the core problemsin Texas City. In 2004, BP executives challenged their refineries to cut yet another 25% from their budgets for the following year. Example 2: The opposite extreme of the spectrum has to be Dow Chemical Corporation. Hopefully there are many companies that share such a depth of commitment to personal and process safety. In a presentation delivered at ARC Advisory Groups 2008 Global Manufacturers Forum, Margaret R. Walker, vice president, engineering solutions, technology centers, and manufacturing and engineering work process, made Dows global vision clear: You cannot compromise safety, regardless of local customs. Personal safety and process safety should be your number one priority and you should never lose that sight. There are few things more motivating to an employee than knowing the employer is making sure everything possible is being done so that they go home safely and that everyone around them is safe. Jerry Gipson, Dows director of itswe start with a safety moment. We try to personalize the message to put in each of our minds the idea of going home safely at the end of the day, but also expand it into larger stewardship that we do nothing to adversely impact the community. Back in the 1960s, when we launched our manufacturing excellence focus and embarked on some of the global standardization efforts, that was driven by the desire to achieve differentiated safety performance. It was safety that got us up and going. Where is your company on this spectrum? I suspect most are somewhere in between, but hopefully closer to Dow. Thats something you might want to think about carefully as you look at the top management of your company. Peter Welander, process industries editor, PWelander@cfemedia.com , Process & Advanced Control Monthly

Sponsored by

Sponsor Profile Process Safety What Are The Odds? Analysis: Engineering Values From The Top Down Integrating Emergency Shutdown Valves With A Process Control System Developing People: Making Operators More Effective 5 ways to improve safety and profitability, without disrupting operations

Integrating Emergency Shutdown Valves With A Process Control System

ABB And Dresser Masoneilan Integrate Capabilities To Improve Overall Process Safety, Emergency Valve Performance, And Availability.
ABBs power and automation technology group, announced that it will collaborate with Dresser Masoneilan, a supplier of process control valves, on an integrated process to monitor, test, and manage emergency shutdown valves (ESDV) during all operational conditions, from normal plant operations to abnormal situations. These valves are crucial process elements for the oil, gas, and petrochemical industries, as well as many other industrial processes. Our collaboration with industry leaders like Dresser Masoneilan helps us offer our mutual customers best-in-class safety solutions that will protect the integrity of their processes and the surrounding community, said Luis Duran, ABBs Americas business development manager for safety systems. He adds that the combined solution leverages the capabilities of ABBs 800xA High Integrity SIS (safety instrumented system) and Masoneilans SVI II ESD (emergency shutdown device) and PST Controller to improve overall plant safety and increase the availability of ESDVs for optimal response of the isolation valve in emergency situations. This integration also simplifies safety compliance by automatically recording partial stroke test results and emergency shutdown events, saving time and money while increasing efficiency. By taking advantage of System 800xAs integration capabilities and open standards, the user has immediate access to the health diagnostics and status of the emergency shutdown valve. This access also provides proactive management of this critical device, for instance enabling remote triggering of partial stroke tests, to ensure that it is ready to perform when needed, said Kristian Olsson, manager of ABBs Safety Center of Excellence. This immediate readiness is vital to the protection of the process, the environment, and the surrounding community in the event of an abnormal situation. As an integrated object within System 800xA, Masoneilans SVI II ESD device can be configured to perform scheduled partial valve stroke tests while remotely monitoring and maintaining the emergency shutdown valves during normal plant operations. This minimizes the need for outages and downtime to evaluate the health and readiness of these critical process elements. The system also provides alerts and recommendations regarding valve status, as well as required partial stroke test and emergency shutdown signatures and documentation. While open standards offer great benefit for end users, it is the collaboration between automation vendors that provides for an out-of-the-box solution capable of generating instant results, said Sandro Esposito, global marketing manager digital products for Dresser Masoneilan. The SVI II ESD provides an excellent return on investment with its combined shutdown function, partial stroke test function and shutdown event black box into a single SIL3 certified device. The company says that the SVI II ESD is the latest technology in emergency shutdown valve automation and the only SIL3-certified ESD certified at 4 mA with stainless steel housing. The device can be implemented using a 4-20 mA signal (analog safety demand), 0-24 Vdc (discrete safety demand) or a combination of both. Standard on the device are an LCD display and explosionproof external pushbuttons. This design architecture offers a sophisticated platform while being Type A (simplex device) compliant. ABB characterizes its System 800xA High Integrity as a next-generation safety system. This SIL 3 rated SIS provides the highest level of integration of safety and control on the market today, and an embedded diverse technology architecture that provides superior protection of the process, plant, personnel, and the environment while it optimizes overall process efficiency. Edited by Peter Welander, pwelander@cfemedia.com

Sponsored by

Sponsor Profile Process Safety What Are The Odds? Analysis: Engineering Values From The Top Down Integrating Emergency Shutdown Valves With A Process Control System Developing People: Making Operators More Effective 5 ways to improve safety and profitability, without disrupting operations

Developing People: Making Operators More Effective

Tools And Methods For Creating An Industrial Operator Workplace Ready For The Needs Of Today And Tomorrow. Improved Situational Awareness And Better Handling Of Abnormal Conditions Helps Operators Make Better Decisions And Improve Safety And Process Uptime.
Hongyu Pei Breivold, Martin Olausson, Susanne Timsjo, Magnus Larsson, Roy Tanner Process industries globally lose around $20 billion annually due to process disruptions, which represents about 5% of total production. Studies suggest 80% of these losses are preventable, and of these preventable losses, 40% are primarily due to operator errors. This means that the total improvement potentialif a way can be found to help avoid mistakes totals $6.4 billion. Operator effectiveness is a fundamental element for sustaining the economic value of process control and management. One place to begin the process is by empowering operators through improved situational awareness and better handling of abnormal conditions. Operators can then make better decisions and so improve safety and process uptime. Striving for operator effectiveness implies facing a number of significant challenges regarding both technology and management. For instance, managing and monitoring industrial processes is characterized by inevitable changes in technology, a diminishing knowledge base due to demographic changes in the workforce, and the ever-increasing complexity of operations. These factors may lead to huge cost escalations if operator effectiveness is not taken into account rigorously. Developing an effective HMI (human machine interface) needs to look at the operators workflow and requirements. A recent survey on operator effectiveness shows that this view is also shared by many of ABBs customers. It achieves collaboration between different computer programs and systems, supplying operators with all necessary information from any number of sources. Operators have intuitive access to actionable information and can manage views dynamically and effectively. These features reduce the time required to identify necessary actions. Today, an operating plant may include multiple controller platforms including PLCs (programmable logic controllers), DCSs (distributed control systems), safety systems, FASs (facilities automation systems), and ECSs (electrical control systems) to name just a few. In addition, plant information systems such as CMMS (computerized maintenance management systems), ERP (enterprise resource planning), video monitoring systems, and data historians are also available and contain valuable information that can support operators in their decision making.

Four pillars of operator effectiveness

When designing an automation system, there are four main pillars affecting an operators performance: Integrated operations Design for high-performance Attention to human factors, and Operator competence.

Sponsored by

Integrated operations
An effective control system should provide customers with the means to consolidate and rationalize data from various sources seamlessly.

9
Design for high performance Sponsor Profile Process Safety What Are The Odds? Analysis: Engineering Values From The Top Down Integrating Emergency Shutdown Valves With A Process Control System Developing People: Making Operators More Effective 5 ways to improve safety and profitability, without disrupting operations
Many standards organizations and research institutes have made and continue to make valuable contributions to HMI philosophies. This knowledge has flowed into guidelines for interface design, ergonomics, situation awareness, and alarm management. Drawing on this as well as its own extensive expertise, ABB, along with other system designers, supports the establishment of good standards through its active participation in various technical committees, working groups, and scientific committees of standards-development organizations. One key area affecting HMI development is the handling of abnormal situations. Abnormal situations are disturbances or incidents with which the control system is not able to cope of its own accord, and thus requires operator intervention. When implementing a control system project, it is critical to customize the workplace layout based on the end users operational philosophy, and provide support for the implementation of high-performance alarm management strategies with features such as alarm shelving (operator-driven alarm suppression) and alarm hiding (condition-based alarm suppression). These features reduce the number of nuisance and noncritical alarms and so help end users meet or exceed current guidelines and standards such as EEMUA 191 and ISA SP18.2. Ian Nimmo, abnormal situation management expert and author of High Performance HMI Handbook, believes that a driving factor of highperformance design for HMIs is situation awareness. He says, Having good situation awareness means the operator has an accurate perception of the current condition of process and equipment, and an accurate understanding of the meaning of various trends in the unit. Some of the key concepts that situation awareness reflects are color definitions and use to maximize visibility of abnormal situations. The situation awareness concept is not new. It is, however, still a matter of debate between multiple organizations. One aspect being debated is the use of grayscale or cool process graphic schemes. In addition, navigation methodology, graphic-level definition for fast response under abnormal conditions, and presentation of information are used to seek to predict and avert abnormal situations completely. One good example of situation awareness as described in the High Performance HMI Handbook mentioned above concerns two graphics that both embed the same information but have totally different effects on situation awareness. A graphic with a black background and an abundance of colors leads to poor situation awareness even in normal situations, whereas the graphic with gray scales and the sharp color for alarm depiction represents good situation awareness. Situation awareness can make a huge impact by: Increasing the success rate in handling abnormal situations and returning to a normal mode of operation Reducing the time it takes plant operators to complete required tasks during an abnormal situation, and Raising the incidence rate of control room operators detecting an abnormal situation prior to alarms occurring.

Attention to human factors

System designers need to address attention explicitly to human factors. One main reason is that a skilled designer knows that a better working environment can reduce an operators stress, which in turn substantially increases the operators performance and effectiveness for handling abnormal situations, as well as reduces health issues and turnover of resources. An effective operator workplace is equipped with advanced keyboards featuring hotkeys for multiclient handling, an operator desk system with motorized adjustable desk and monitor positioning, a directional sound system, and integrated dimmable lighting. Using such productive design concepts when creating control room environments has a major impact on the performance of operator teams. All these factors contribute to the enhancement of the operator environment and alertness level of control room operators.

Sponsored by

10
operations, there is an explicit need to address operator effectiveness directly throughout the whole lifecycle of a process-control system. To leverage the four pillars of operator effectiveness, a number of fundamental activities are continuously going on: user-centered design and an eye to the future. studies. The methods for user study include interviews, field studies, and observations. Interview questions are sent to the operators before a planned interview to ensure that the users have the right profile and knowledge, and that they are well-prepared. The interview questions may be structured or unstructured, both in the form they are asked and in the way they can be responded to. Field studies and observations represent a way to identify and prioritize operators goals and needs. By visiting users in their own working environment and observing how they perform operational tasks, firsthand information is acquired with respect to the operators challenges and needs. This method is ideal for discovering incorrect or inefficient practices that the operators are

Sponsor Profile Process Safety What Are The Odds? Analysis: Engineering Values From The Top Down Integrating Emergency Shutdown Valves With A Process Control System Developing People: Making Operators More Effective 5 ways to improve safety and profitability, without disrupting operations

User-centered design
Designing an effective HMI requires focusing on the control room operators workflow and tasks. In order to achieve a good understanding of the workflow process and to obtain knowledge on how well the operator manages the significant number of operational tasks, the designer should perform operator task analyses together with operators through user

Control room procedures are important to ensure consistency of operation. They can also support an operator in his or her activities that may be performed infrequently. An example of useful supporting mechanisms is the use of checklists to guide operators throughout the required procedures under specific circumstances. Clear definition of job roles and responsibilities is another vital element that characterizes successful operations. This means that all the tasks an operator needs to perform should be recognized and documented, including the tasks that go beyond operating in the normal mode. In an effort to define a new standard for control rooms, or intelligent control centers, ABB and System 800xA have teamed with control-room furnisher CGM to create a demonstration project to emphasize an optimal control room layout with focus on human factors and ergonomics. The Future Operations Center in Bors, Sweden, is the place

to visit to get the latest information about how to build the optimal control room. It covers, among others, such topics as sound, noise absorption, floor material, light control, and the color status of the process.

Operator competence
When operators interact with processes, their actions often have huge business consequences, especially when the process is in an exceptional situation and operators need to understand and manage complex operations to support recovery. New technologies using simulators for advanced training can recreate the exact operator environment, including graphics and control logic. The simulator provides a safe and realistic environment in which process operators and instrument technicians can learn how to master the process and increase their confidence. In view of rapid technological evolution, generational shifts in workforces, and increasing complexity of

Sponsored by

11
not aware of. Operators opinions should also be sought and direct feedback collected both for good practices and in areas with potential for improvement. The collected data can then be analyzed and synthesized. The data synthesis process includes identification of the main concepts, indications from each user study, and analysis of how they relate to the improvement of operator effectiveness. Another effective way to increase user focus is the establishment of a customer reference group (CRG) comprising customers from various domains. The purpose of the reference group is three-fold: Provide customers with firsthand information about ongoing and planned development projects Permit customers to actively influence the suppliers development of the systems operator interface, and Establish a forum for exchanging and testing ideas in user needs, trends, and future ventures in order to increase productivity and profits for customers. applications in industry domains. Examples include interaction, visualization, and design techniques. Innovative ideas come from the viewpoint of centering operators work process and tasks to develop an effective HMI. It is common knowledge that process operation is teamwork. Different shifts need to communicate and cooperate with each other. Accordingly, to assist operators in undertaking these activities, one innovative idea is a collaboration board, permitting operators to leave messages on real-time process displays, or using a drop-down whiteboard for sketching discussions. Such a collaboration function can serve various roles, including plant management, system management, managers, and maintenance and operation staff. Operator effectiveness is a timeless characteristic and will always be important. Accordingly, in addition to improving operator effectiveness for the present generation of operators, it is critical to take future generations into account. Some customers are telling ABB that as the current workforce matures, operator expectations are evolving. Many operators being hired today grew up with computers and are digital natives. For these new generations, visual learning is an ideal method to teach how the plant behaves. Studies of how such people operate the process show that they have more screens open than older crew members. They also ask for more customization of their screens. Newer operators tend to visualize the plants behavior graphically, whereas older operators seek to understand the plant in a sequential manner. System designers should be actively monitoring and applying future technologies and design concepts to address younger generations whose operating skills are different from those of today.

Sponsor Profile Process Safety What Are The Odds? Analysis: Engineering Values From The Top Down Integrating Emergency Shutdown Valves With A Process Control System Developing People: Making Operators More Effective 5 ways to improve safety and profitability, without disrupting operations

Looking into the future

The continuous progress in software techniques related to user experience and interaction raises the need to permit existing human machine interfaces to evolve. As an example, ABB has a well-equipped user experience and interaction lab. The researchers look into the future, analyze the impact of emerging technologies, and explore efficient utilization and the reasonable combination of existing and emerging technologies. In particular, ABB has just created a new research area dedicated to operator effectiveness. One of its tasks is to look at new technologies in the market and their

The secret to operator effectiveness

Operator effectiveness is a challenging area. Any company hoping to excel in this area must take a leading role in facilitating the pillars of operator effectiveness by: 1. Leveraging an automation platform that can natively promote and provide the level of integration and centralization required to promote a collaborative environment. Providing assistance to meet standards and design philosophies in situation awareness and abnormal condition handling, as well as leverage an automation system that has the flexibility to meet specific customer requirements.

2.

3. Integrating human factors and best practices to provide the best in operator effectiveness. 4. Providing not only operator training but an environment that uses the most valuable assets and existing intellectual property to build operators confidence and competence. A process manufacturer intent on developing effective operators should create an environment that provides operator effectiveness, conduct continuous activities in user-centered

Sponsored by

12
design, and look into future technologies and their applications in the area of operator effectiveness. This can reduce the scope for errors through more efficient use of the operators technological experience, quick access to relevant data in every operational situation, and assistance to operators in decision-making processes. All of these imply sustained economic value. ABB has achieved considerable success in boosting operational excellence by focusing on operators and by providing process control interfaces that facilitate operators ability to make the right decisions during all modes of operation. It is committed to remaining at the forefront of these developments through continued research and development, helping customers achieve operational excellence. Hongyu Pei Breivold, Martin Olausson, Susanne Timsj, and Magnus Larsson work for ABB Corporate Research, Vsters, Sweden. Roy Tanner is with ABB Inc., Wickliffe, Ohio.

Additional Reading:

Sponsor Profile Process Safety What Are The Odds? Analysis: Engineering Values From The Top Down Integrating Emergency Shutdown Valves With A Process Control System Developing People: Making Operators More Effective 5 ways to improve safety and profitability, without disrupting operations

Atkinson, T., Hollender, M., 2010, Operator Effectiveness, Collaborative Process Automation Systems, ISBN 978-1-936007-10-3. Hollifield, B., Oliver, D., Nimmo, I., Habibi, E., 2008, The High Performance HMI Handbook, ISBN-10: 0977896919, ISBN-13: 9780977896912, Plant Automation Services.

Sponsored by

13

Sponsor Profile Process Safety What Are The Odds? Analysis: Engineering Values From The Top Down Integrating Emergency Shutdown Valves With A Process Control System Developing People: Making Operators More Effective 5 ways to improve safety and profitability, without disrupting operations

5 ways to improve safety and profitability, without disrupting operations

Process industries are inherently hazardous, and maintaining safety in processes and operations has become increasingly complex and costly. But too often, companies have difficulty demonstrating a clear return on investment in their safety activities. With both safety and financial concerns being a high priority, those in the process industry sometimes struggle to reconcile them.
In 1994, the worlds regulatory environment was still reacting to the Bhopal, India gas leak that had occurred a decade before. At that time, the American Institute of Chemical Engineers (AIChE) undertook a study to figure out how much emerging safety regulations actually cost. It concluded that, across all industry segments and plant sizes, the average U.S. industrial facility would start at 40 percent compliance and spend no less than $5.8 million over a decade to effectively achieve full safety compliance. The return on investment (ROI)? The kind that gives financial executives gray hair: potential cost avoidance. That was 27 years ago, and process safety management has since come a long way. First, ongoing investments are thought to be far higher than the AIChE had calculated up to one-third to one-half, or even more, of the capital and operating costs of the new plant handling the hazardous operations, declares an abstract for another old study: The Real Cost of Process Safety A Clear Case for Inherent Safety, published in November 2003 by Process Safety and Environmental Protection, the journal of the European Federation of Chemical Engineering. But also important: the ROI is now known to be far more tangible than the whatif costs of an avoided incident. Even 10 years ago, safety processes and technologies were being viewed for their impact on Overall Equipment Effectiveness (OEE) and plant efficiency. According to the results of a study by the Center for Chemical Process Safety, as cited in a 2001 workshop report, facilities that embed safety into their daily operations typically achieve a 5 percent productivity increase, 3 percent reduction in production expenses, 5 percent reduction in maintenance costs, 1 percent savings in capital expenses and 20 percent reduction in insurance costs. The timeline sends a clear message: While the cost of safety in process industries has far exceeded estimates from the dawn of the modern safety era, the benefits of safety are more tangible and substantial as well. The simple assessment is that most companies can increase manufacturing flexibility, profitability and overall competiveness while improving safety, with little disruption and minimal capital expenditure. These savings arise across the process safety area, but we will focus here on those related to process automation. Many companies have paid for these potential benefits with process automation capabilities that now exist in-house but are being underutilized or ignored. The trick is knowing where these potential gains are hidden. Here, according to ABB Process Automation safety experts, are five areas where most companies can easily unlock improvements in safety and, quite possibly, profitability.

1. Utilization of existing automation

When a process is running, a well-designed automation system can deliver more reliability, repeatability and speed than any human being, according to David Huffman, a manager at ABB with background in chemical and process engineering. The control system can identify when processes change states, and can be programmed to act before those changes become critical. Chemical engineers like myself like to think you can put yourself at a steadystate process, Huffman says. But trust me, youre never at a steady state. Its a misnomer. Processes are always changing. Typically, an alarm management system is used to identify such changes, turning over the details of what to do about it to human operators. Obviously, there are times when that must happen, Huffman says. But there are many other times when nothing is really going wrong. There are some changes that the automation system is capable of identifying and managing if its programmed properly. As an

Sponsored by

14
defining them and putting in the programming code. Many companies overlook this step when implementing a new automation system. Theres fatigue involved, Huffman says. The company gets tired of spending money, and the people get tired of the constant change; they want to get back to a steady state too. The good news, he says, is that it means you still have opportunity to make big improvements long after youve grown comfortable with an automation system. Quantifiable benefits include reduced staffing, less wasted product, increased quality and faster adjustment of controls at a level of higher precision and repeatability. With respect to safety, it removes distractions from operators, making routine events out of occurrences that would previously have set off an alarm flood. Often discussed in the industry as state-based environments, the discipline of improving automation across a wider array of recurring events is the subject of a new ISA committee. While ISA-106, focused on sequential process control, is a few years away from releasing its first set of standards, Huffman says the goal is to educate companies that processes run in states and, in order to keep them safe and profitable, its OK to take things out of operators hands and let the automation system do a lot more work. There are big companies that are embracing this because they are convinced its not only safer, but you can make money with it, Huffman says. its job well: Count the total number of alarms that the system activates during the course of a month and divide it by the number of operator hours worked during the same month. If the total comes in at much more than 6 alarms per operator hour, then your system is running at an unnecessarily high level of risk and inefficiency. That rule of thumb (6 alarms per operator hour) is just a guideline, warns Ken Praprost, alarm management optimization engineer at ABB. Its far simplified from ISA-18.2, a new standard released in 2009 that addresses alarm management in process industries. During an alarm flood period, you may get alarms at five or ten times that rate, Praprost says. But six per hour per operator is one metric let you know if theres a reason to go back to work on the alarm management system. In Praprosts experience, most companies deliver too many alarms, falling into three categories: Nuisance alarms: Those that go on and off so routinely that they eventually get ignored, like an alarm that sounds whenever process temperature rises above a threshold, even if the process generally takes care of itself before operators intervene. Praprost has frequently seen operations where there are so many standing alarms that they can only be viewed on multiple screens. And many of these may be for equipment thats not even in use. The flow is zero, which sets off an alarm that the operators simply have to look at.

Sponsor Profile Process Safety What Are The Odds? Analysis: Engineering Values From The Top Down Integrating Emergency Shutdown Valves With A Process Control System Developing People: Making Operators More Effective 5 ways to improve safety and profitability, without disrupting operations
example, Huffman describes a distillation process that requires the product to move through one of three drying beds. The beds are rotated through primary, secondary and regeneration modes. So youre running full and at about the time you have to switch one bed offline, you find out theres something wrong with another bed and you cant put it back into service on time. The usual response is slowing down the distillation process while getting the troubled bed fixed. Its a busy time for operators. When you start scaling down a distillation tower, it loses efficiency, you lose product quality, and control loops dont perform well at the reduced-rate condition. The operator is cutting flow rates, changing tower pressure, dealing with overhead systems, boiler systems etc. The more complex the tower is, the worse it gets. And the whole time, alarms are going off continuously. But, Huffman continues, If you know this happens from time to time, you can record what the operator has to do and write a procedure around it for the automation to move the distillation process into a safer mode. There is an advantage in speed, which reduces product waste. And automating the routine around best practices means achieving the same results, even if the event occurs when your best operators are off-shift. Most companies have dozens of examples like this, Huffman says events that happen often enough to automate, but not often enough to have confidence that every operator is always going to be adequately trained and tested. Admittedly, improving automation at this level isnt easy or free. You have to go through the pain and expense of understanding your routine states,

Sponsored by

2. Rationalizing alarms
Heres a simple way to know if your alarm management system is doing

15
Standing alarms: Those that remain in an active alarm state for a significant period of time. Non-alarms: Many alarms are really just events or data that someone in the organization had wanted recorded. In all three instances, operators struggle to identify important alarms, especially when alarms are not prioritized a common condition everywhere. Fixing it can improve safety and potentially improve plant performance, Praprost says. If we can get the alarm system so its not providing useless information that operators dont need to know, the operators can do a better job running the plant. They can avoid lost-production events simply because they didnt pick out the right alarm from a long list of alarms that all look the same. The main steps to improving an alarm management system are: Evaluate documentation and interview operators, engineers and supervisors: Investigate whether the systems operate as required and if personnel know why each alarm is triggered, precisely how to respond to it, and how easy is it to interact with the system interface. Performance assessment: A review of alarm data over an appropriate period of time (usually a few weeks to a month) to determine the rates, frequency of individual alarms, and response times to alarms. Benchmarking: Comparison of results with industry guidelines. Recommendations for improvement. Plan and implement an improvement program. Establish an appropriate monitoring and review process. information. When something goes wrong, the system is not well-enough designed to allow time for reaction. It doesnt direct people where to look for the information they need, says Chris Greaves, business manager at ABB Consulting. While that is obviously relevant to alarm management, it also applies to the other human factor areas. As an example, Greaves says its common practice for work permits in a facility to be managed in the control room. The argument is that if people want to get work done, they need to check in with the process superintendent. The commotion related to issuing work permits can be a safety distraction to operators, Greaves argues, but he has seen instances where lighting was used to minimize the disruption, by darkening that part of the room where permits are issued when lighting is not required. Other human-factor techniques can include providing different audible tones for different types of alarms, or automated redirection of lighting to focus on the correct displays during alarm bursts. Ventilation maintaining a temperature that keeps people comfortable but alert is a common challenge in many control rooms, Greaves says. As with anything, you can quickly get into a project that suddenly would have people writing large checks for fancy displays and ergonomic chairs, he notes. There are certainly times when that is justified and prudent, but if youre talking about ways to improve operations and reduce safety risk, you simply cannot overlook these human factors. The control room is your last line of defense, and for many companies, it would be very easy and affordable to find multiple opportunities to change the environment in a way that helps the people who work there to do a better job.

Sponsor Profile Process Safety What Are The Odds? Analysis: Engineering Values From The Top Down Integrating Emergency Shutdown Valves With A Process Control System Developing People: Making Operators More Effective 5 ways to improve safety and profitability, without disrupting operations

One thing weve learned is that people like to put an alarm on anything. If we investigate further, we can reclassify many of the alarms as events so they dont occupy space on the list. Then we reprioritize to identify the true high-priority items, Praprost says. There are also strategies for dealing with nuisance alarms, vastly reducing how often they trip while assuring that they do appear when intervention is required. Evaluating such issues is a process independent of the type of system being used. While it requires some cost, it can be conducted with minimal interruption and meaningful improvements in the way processes are managed. It not ony brings significant improvements in plant safety; alarm rationalization can make a significant impact to the bottom line by reducing unnecessary plant trips.

4. Dont purchase unnecessary redundancy

Redundancy is not equivalent to safety, and safety does not require redundancy. People get the two confused, laments ABBs Huffman. People get locked into thinking that if

3. Consider human factors

If alarm management tends to place too much reliance on people, human factors explore the issues created by the fact that people are the most fallible part of a safety system. Human factors typically include such areas as the design of interfaces and displays, lighting, noise management, staffing, safety-critical communications, ergonomics and, as already discussed, alarm management. In human factors, a key issue is that people are overloaded with

Sponsored by

16
theyre going to have a safety system, it has to have full logic solver redundancy, often to 3x or 4x levels, in order to be safe. That means they have to invest in a second set of equipment that is going to require regular testing and maintenance, and if all goes well theyre never going to use it. Its not a true statement Huffman says. You can have single-element safety systems that can be certified up to SIL 3 levels. When a singleprocessor system detects a process problem that justifies tripping the plant, then its designed to lead the plant through a safe shutdown. In the case of an internal fault, it will also shut down the process safely, per SIL 3 safety requirements. In that case, Huffman says, Ive lost the process, not because of a process problem, but because of a fault in the system. If you want to keep the process running, then redundancy is a matter of maintaining uptime, but not process safety. Sometimes, keeping the process running is important for personnel safety, Huffman says, because certain startups and shutdowns can put people at risk. But thats a different decision than the process safety itself. Huffmans point is that companies pay for logic solver redundancy in cases where the investment might have more impact elsewhere, whether in other areas of safety or in operating efficiency. His recommendation is that companies pay to put at least one person, who is respected at the executive level, through some level of basic safety education, such as the ISAs EC50 course on Safety Instrumented Systems (SIS). Then use that education as part of the decision-making process around investments in safety and process automation. Having this knowledge can help with making system selections based on key performance requirements rather than the redundancy architecture of the logic solvers. says. Facets in mapping competence include documenting the type of education each worker has received, and what kind of experience, detailed to specific tasks and technologies. Requirements and certifications in specific work environments are considered as well. More difficult but equally important, he notes, is to map an individuals attitude to reducing risk and conducting high-risk work. People around him will know whether hes someone who tends to make a situation more or less safe. Whether you can get that information or not goes to the culture of the company: Do they dare to tell you, he says, or do they dare not to tell you? When you take seriously this process of understanding the competence of each worker, as an individual, that says a lot about the importance of safety in an organization, Stromme says. Youll get the level of information that you have earned, based on past experiences that your people have. If you demonstrate an open mind and attitude that people wont be punished, and that information will be used to help everyone become better and safer at their job you are already doing a very good job of reducing risk in your operation. Increasing utilization of automation Decreasing utilization of alarms Considering human factors Understanding the role of redundancy Mapping the competence of people

Sponsor Profile Process Safety What Are The Odds? Analysis: Engineering Values From The Top Down Integrating Emergency Shutdown Valves With A Process Control System Developing People: Making Operators More Effective 5 ways to improve safety and profitability, without disrupting operations

5. Map the competence of people

One well-worn, under-attributed statistic in process safety automation is that machinery is typically the cause in 10 percent of failures; the other 90 percent of the time, human error is to blame. Lack of a source for this statistic notwithstanding, few people seem to argue the point that human error is the least predictable and more common source of breakdowns in safety. With that in mind, John-Erlend Stromme, Service Manager, ABB Oil, Gas and Petrochemical Business Unit, , suggests that any company would benefit from a routine and systematic review of the way safety competence is built and maintained among its people. Competence is simply being aware that you are doing things right. A small mistake can start the ball rolling, and anytime we, as an industry, find ourselves looking at a major accident, it seems thats ultimately how it started, Stromme says. Competence, however, is not simple. Its a combination of having the right technical knowledge, knowledge of work processes and experience for whatever situation an individual may face. Its not just knowing what youre doing, but knowing how to follow procedures so you can avoid making an error you didnt know about, Stromme

most process companies can unlock hidden safety improvements, and in many cases increasing operating effectiveness, without disrupting ongoing operations or making large investments. For more information please contact: North America Customer Service Center 29801 Euclid Avenue Wickliffe OH 44092 1832, USA Tel: 1 800 HELP 365 (1 800 435 7365) Option 4 Outside USA/Canada: +1 440 585 7804 Fax: +1 440 585 5087 E-mail: NAService_info@us.abb.com www.abb.com Visit ABBs Process Automation Insights blog to join the conversation.

Summary

Sponsored by

There is no avoiding the need to make ongoing investments in all aspects of safety: equipment, processes, systems and people. But not all investments are the same. While some require long-term planning and capital budgets, others are small and fast. And still others have already been made, and are waiting to be utilized and optimized. By focusing on these five areas: