Integration of ISA Standards for Effective Decision Support

Integration of ISA Standards for Effective Decision Support Dr. Maurice J. Wilkins VP Global Strategic Marketing Center (USMK) Yokogawa Electric Corporation Co-chair ISA101 Committee Standards Certification Education & Training Publishing Conferences & Exhibits

Profile Dr. Maurice J. Wilkins Head of Global Strategic Marketing PhD Chemical Engineer, Senior Member of ISA Member of Process Automation Hall of Fame 33 years process automation experience Chair of ISA101 HMI standard Member of ISA Standards and Practices Board Proposer and Managing Director of ISA106 Procedural Automation in Continuous Process Operations Past Chair of WBF and Tom Fisher Award Winner Worked for Exxon Chemical, Honeywell, KBC, Breakthrough Process Consulting, Millennium Specialty Chemicals, Lyondell, ARC & Yokogawa Strong expertise in leadership and team building, strategic consulting, batch control, procedural automation, APC, human factors, process analysis 2

Agenda Challenges Affecting Process Operations Incidents Can Operators Cope? Man versus Machine Operations Analysis Decision Support Standards Can Help Are Machines Better in a Crisis? 3

Refinery Losses Trend Upwards Large Property Damage Losses in the Hydrocarbon Industries (1972 2009) Source: Marsh Associates 4

Average Loss Per Major Incident Mechanical failure Operational error Unknown Process upset Natural Hazard Design error Sabotage / arson 0 25 50 75 100 Source: J & H Marsh & McLennan, Inc. Average Dollar Loss Per Major Incident by Cause Millions of Dollars Source: J & H Marsh & McLennan, Inc. At an average cost of $90 Million in losses per major incident, operational error is amongst the most expensive causes of error in production facilities BUT we can t blame the operators! 5

Operators Have Become Reactive What is the impact of running our plants by alarm? How many procedure incidents happen per year? How much does a poor HMI Cost? How many graphics do not perform? How much can an Advanced HMI save you? What is the cost? What if planes were operated by alarm? 6

Today s Control Systems Safer environment and much better graphics Central control, data historians and automated systems But far more data in a VERY configurable environment Systems can help but do today s operators get overwhelmed? 7

Alarms - Can Operators Cope? Texaco, Milford Haven (1994) In the last 11 minutes before the explosion the two operators had to recognize, acknowledge and act on 275 alarms. Three Mile Island (1979) In the case of Three Mile Island, the principle cause was human error. If human operators had not misunderstood the situation and intervened inappropriately, the automatic systems would have averted the disaster 8

Displays - Where s Waldo? What if you had to find him in a split second? 9

Here He Is!! 10

Now Try Operating a Plant the Same Way! 11

Is This a Good Operator Interface? 12

Procedure Issues BP Texas City - March 23 rd, 2005 BP s biggest refinery Isomerization Unit Raffinate splitter tower 175 ft tall Distilled and separated gasoline compounds Note: The Texas City Refinery is now owned by Marathon Petroleum 13

Procedure Issues Instrument checks not completed Faulty hard wired alarm not repaired (no work order) DCS high level alarm acknowledged and ignored liquid was over the top level tap at start up Start up procedure issues: Control valve closed in Manual (should have been at 50% in Auto per Start Up procedure) During early start up this is the only way to control splitter level Burners turned on prior to establishing rundown Heat up ramp rate 50% higher than in procedure Concern over pressures and temperatures but no clear answers 14

Consequences Several other procedures and concerns not addressed Hot liquid filled tower completely Temperature profiles indicated that the level was above the feed tray Emergency relief valves opened sending 52 gallons of hot liquid to blow down drum Hydrocarbon geysers issued from top of blow down drum Vapor cloud ignited by pick-up truck Explosion!!! 15

BP Final Report and Recommendations..the team found many areas where procedures, policies, and expected behaviors were not met Modify startup and shutdown procedures to include steps to: Note Notify personnel on all surrounding units Evacuate all non essential personnel from the unit and surrounding area Incorporate formal go/no go decision to proceed with charging feed Ensure that operating procedures include safe upper and lower operating limits, and actions to correct deviations from the operating envelope No recommendation for additional training No recommendation for procedural support (although the plant was equipped with a DCS) 16

Should We Remove the Human? In the airliner of the future, the cockpit will be staffed by a crew of two--a pilot and a dog. The pilot will be there to feed the dog. The dog will be there to bite the pilot if he tries to touch anything -- Commercial airline pilot 17

Aviation Procedures In 1935, a prototype for the Boeing B-17 Flying Fortress crashed during takeoff at Wright Field in Dayton, Ohio The cause of the crash was identified as a gust lock that was still engaged Airplane was deemed Too complicated to fly Test Pilots came up with checklists for takeoff, in flight, before landing and after landing Checklists have evolved into procedures integrated into flight systems making major contribution to aviation s safety record from checklist.com 18

Humans DO Count Qantas Flight 32 Largest commercial airliner - outbound from Singapore en route from London Heathrow to Sydney on Nov 4, 2010 One of the engines blew apart over Indonesia The pilots were inundated with 54 computer messages alerting them of system failures or impending failures With only about eight to 10 messages able to fit on a computer screen, pilots watched as screens filled only to be replaced by new screens full of warnings 19

Humans DO Count Qantas Flight 32 It was just luck that there happened to be five experienced pilots (including three captains) aboard the plane that day The flight's captain was being given his annual check ride (a test of his piloting skills) by another captain That captain was himself being evaluated by a third captain Also first and second officers, part of the normal three-pilot team Even with five pilots working flat-out, it took 50 minutes to prioritize and work through each of the messages -- necessary steps to determine the status of the plane 20

Maybe There s a Balance? Humans are doing a pretty good job, but they do it even better with the assistance of algorithms This research is really showing the power of how, when algorithms work with humans, the whole system performs better. Mary L Cummings, Associate Professor of Aeronautics and Astronautics Director, MIT Research into human-automated path planning optimization and decision support 21

Finding the Balance Automated systems Can do repetitive things over and over the same way They don t fall asleep or ignore procedures They don t panic under pressure They can respond quickly to changes in conditions BUT they can fail and they need training Humans Are perceptive Have senses Can weigh pros and cons Respond to advice from automated systems Decision Support Can we use the systems to provide better operator guidance and support? 22

Providing Informative Displays What about ways of displaying information in a way that is meaningful to an operator? Here s the result of a dog s blood test Should we be worried? How would we know? 23

Does This Help? 24

And Now? We now have a frame of reference Things are fine 25

Process Example - Column Temperature Profile 20.1 24.2 +1.1 +0.8 25.6 27.8 28.9-0.7 A good profile? Yes, this one is. Too hot at the top, too cold at the bottom Deviation or absolute numbers optionally toggled 26

Show What s Important for Operations Courtesy ASM Consortium Clear indications No unnecessary distractions Show what s working and what s not If you can see the mode it may not be the right one 27

Capturing Procedural Knowledge Much procedural knowledge is in the heads of the most experienced operators Some have been brought out of retirement to assist with startups They have their own tweaks that are often not in the SOPs or are their interpretation of an SOP Maybe a ramp is not a direct ramp but a series Always check this temperature while starting up Automated procedures can capture the knowledge of the best operator on his/her best day every day Remove shift to shift inconsistencies Ensure that a procedural operation is being conducted the same way every time Provide experience and training for junior operators 28

Aim to Capture Best Operating Practices A A Operator A s Procedure B C D Operator B s Procedure B1 C B2 D E E F F A Best-Practices Procedure B1 B2 C D1 E F D2 A Operator C s Procedure B C D1 D2 E F Capture the Best Procedure from all operator inputs Combine into a Best Practice Procedure 29

Simple Example of Adding Operator Knowledge Original SOP (Standard Operating Procedure) (1) Check base tank level LI100.PV >= 50% (2) Start pump P-101 (3) Check answer back flag (4) Confirm field operator to open hand valve HV100 Capture Operator Knowledge! <Condition icon> Check LI100.PV>=50 <Block mode setting icon> P101.MODE to AUTO <Condition icon> Check P101.PV = 2 <Confirmation icon> HV100 Open <Guidance message icon> P101 start finished Original SOP <Output to DCS icon> P101.CSV to 2 (Start) <Pause icon> Pause this sequence YES YES NO NO Know-how YES NO <Condition icon> Check P101.ALRM = NR (NR means Normal) <Alarm message icon> P101 start error Know-how <Alarm message icon> Preparation error <Output to DCS icon> FIC100.SV to 20t/h <Timer icon> Wait 10 minutes <Output to DCS icon> P101.CSV to 0 (Stop) 30

BP Texas City Revisited Was it operator overload or lack of confidence? Was there a lack of experience or supervision? Operators would not have been alone with procedural assistance Use of a procedural assistant could have helped unsure/overworked operators to take corrective action A procedural assistant could have given clear communications on: What had transpired during previous shifts Next steps according to approved safety procedures Safety hazards associated with missteps 31

Procedural Assistance Decision support from multiple aspects Although level was ignored there was enough other information Temperature information profile and feed tray Pressure information Overheating in stripper bottom Ramp rate too high The operators could not have digested all this information Procedural assistant could have triggered actions or prompts as a result of excessive liquid level Alarms Valve openings Shutdown 32

Standards Can Help Several important standards in this area: ANSI/ISA-18.2-2009 Management of Alarm Systems for the Process Industries ISA101 Human Machine Interfaces ISA106 Procedure Automation for Continuous Process Operations ANSI/ISA-88 Batch Control Effective application of these standards is already helping operators Integration of the standards with other decision support systems could provide vital help in a crisis Better design 33

ISA 101 Human Machine Interface Committee formed in 2006 to establish standards, recommended practices, and/or technical reports for designing, implementing, using, and/or managing human machine interfaces in process automation applications Committee makeup Around 200 members Producer (Supplier) 29% User 29% Integrator, Eng & Construction 31% General 11% Worldwide participation in review process Draft 3 recently finalized. Draft 4 will be the final review before ballot to be issued in June 34

Purpose of the Standard Address the design, implementation, and maintenance of human machine interfaces (HMIs) for process automation systems, to: Provide guidance to design, build, and maintain HMIs which result in more effective and efficient control of the process, in both normal and abnormal situations Improve the user s abilities to detect, diagnose, and properly respond to abnormal situations Look at the HMI holistically not just the display 35

19 HMI Definitions Console Definitions include: Console, Station Station, Pointing Device (Touchscreen) Pointing Device (Mouse) Pointing Device,? X Monitor Screen Keyboard Keyboard, Full-Screen Display Popup Display,? X? X? X Pop-up,? X Display Graphic Symbols, Graphic Symbols Graphic Elements. Graphic Elements 36

Lifecycle Approach The foundation of the standard is the Lifecycle Approach CONTINUOUS WORK PROCESSES MOC Audit Validation ENTRY ENTRY New System Major Changes New Display Display Changes SYSTEM STANDARDS DESIGN Console Design IMPLEMENT Build Displays OPERATE In Service Continuous Improvement Philosophy Toolkits Style Guide HMI System Design User, Task, Functional Requirements REVIEW Build Console Test Train Maintain Decommission Continuous Improvement Display Design Commission Qualification 37

ISA-18.2 Alarm Management Work processes for designing, implementing, operating, and maintaining an alarm system in a life cycle format Key Features: Large focus on an Alarm System Lifecycle Clear Alarm System Performance KPIs Section on compliance Alarm Philosophy what must be included Alarm System Requirements Specification Identification Rationalization Advanced Methods Complimentary to EEMUA 191 38

Alarm Management Lifecycle Philosophy Philosophy Identification Rationalization Identification Detailed Design Implementation Operation Rationalization Detailed Design Management Of Change Audit Maintenance Implementation Monitoring & Assessment Operation Management of Change Monitoring & Assessment Audit Maintenance

ISA 106 Procedure Automation Committee formed in April 2010 to establish standards, recommended practices, and/or technical reports for Procedural Automation for Continuous Process Operations Building on ISA s most successful standard to date; ISA-88 Committee makeup Around 158 members Producer (Supplier) 30% User 45% Integrator, Eng & Construction 10% General 15% Worldwide participation in review process Large user participation 40

ISA106 Input ISA-88 Part 1 NAMUR Company Practices Part 3 Proposed Part 5 Enterprise Site Area Process Cell Unit Equipment Module Control Module General and Site Recipes Master and Control Recipes Automation Object Recipe Coordination Control Recipe Procedural Control Equipment Coordination Control Equipment Procedural Control Equipment Basic Control TR 03 Recipe Procedure Presentation TR 01 S88/95 Recipe Management Production Scheduling Process Management TR 02 Machine And Unit States Recipe/ Equipment Interface Part 4 Batch Production Records Part 2 Data Structures Language Guidelines 1 ISA-95 Literature Industry Analysts ISA-84,101 & 18.2 Vendor Input

Status Recently completed the first of three Technical Reports TR #1 - Procedure Automation for Continuous Process Operations - Models and Terminology- being prepared for committee ballet. TR #2 Automated Procedure Life-cycle TR #3 Examples A Standard will be produced based upon the Technical Reports and industry feedback

Integration is Key! Operator Guidance & Decision Support ISA106 Procedures ISA101 Effective HMI ISA18.2 Alarms 43

ARE Humans Necessary in a Crisis? In times of abnormal operations, systems are configured to produce lots of data humans are not configured to handle or interpret it Presented with the right data, humans can provide the thought process in a state of abnormal operations Automated systems can guide them or even take over in an emergency AND would YOU fly in a plane without a pilot? 44

Thanks! Questions? With thanks to: Standards Certification Education & Training Publishing Conferences & Exhibits Bridget Fitzpatrick (Mustang Eng) Dawn Schweitzer (Kodak) Ian Nimmo (UCDS) Dave Emerson (Yokogawa) Marcus Tennant (Yokogawa) Leila Myers (Yokogawa)