Bainbridge Revisited: Human Factors 40 Years On
Imagine, operators operating with confidence. The highly influential Bainbridge 1983 paper on automation of industrial processes discussed how despite having systems in place for automatic control, human operators are still required for manual intervention in some modes of operation. But, with most loops in automatic, how to ensure operators are experienced for manual intervention without human error? Several capabilities to help operators were discussed. How has new technological ingenuity including Industry 4.0 automation beyond classic automation helped human factors in the past 40 years? To what extent are plants now doing what the paper suggested? And what more can we do today? 28 April is the SafeDay - the World Day for Safety and Health at Work by the UN International Labour Organization (ILO) so like in previous years I’d like to share some of my recommendations on how to improve occupational safety and health in plants by providing personnel with new automation tools. Here are my personal thoughts:
Italics from the Bainbridge paper
Automation Operator Challenge
The paper “Ironies of Automation” was written around the time of transitioning from Industry 2.0 into Industry 3.0, as plants migrated from single loop controllers in a control panel requiring lots of manual intervention to DCS and computers with monitors (“VDU”) for a greater level of automation taking away many manual tasks. This change raised human factor concerns. Let’s revisit as we now transition from Industry 3.0 to Industry 4.0.
We can guess that the new human-centered tools such as OTS, VR, high-fidelity simulators, pervasive sensing, alarm management, golden batch profile, and human‐centered operator graphics etc. we have today may be a result of the paper saying such solutions are needed.
The paper discusses how automation does not completely replace human operators. Even today, 40 years later, although normally not manned remote autonomous offshore platforms may go months without human visits, we still have supervisory operators in a central onshore location. This explains the increased interest in human factors among engineers.
The paper goes into how some modes of operation like startup is rare and some conditions are unpredictable (e.g. failure of electronic systems and instrumentation) so the cost of the additional automation for those cannot be justified, so these tasks are not automated. It is expected operators can do these manually. The paper discusses how a human operator is expected to take over in abnormal conditions and operate manually in situations which the automation could not handle such as an equipment failure.
Partial Automation Challenge
The paper notes an automation system leaves the operator to do the tasks which the designer of the system could not automate – which is understandable given the automation available in 1983. Today I recommend additional automation tools now available such as state-based control (a form of procedural automation), Real-Time Modeling System (RTMS) for batch equipment scheduling, wireless sensors, and actuators so we can do better. These additional automation tools are now providing support for operators performing manual tasks. This new kinds of automation not available in 1983 now performs tasks not possible 40 years ago which makes work for operators easier and thus reduce human factor incidents. Some plants are already deploying this to gain the capabilities the paper suggests. Wireless is not part of the functional safety SIF. Wireless sensors are used for operator situational awareness.
Reduced Operator Hands-on Challenge
The other challenge discussed in the paper is that when control loops are normally in automatic, operators may not get the practice and “feel” for each loop to run a loop in manual when such a situation arises. The later part of the paper suggests simulator practice. See further down.
Situational Awareness – Process State
The paper notes operators need the capability to see the current state of the process and the plant state to manually intervene when necessary. This is about situational awareness, keeping the operator “in the loop” so to speak – the control loop running in automatic without manual operator intervention, but keeping the operator informed, “in the know”. I recommend deploying sensors to collect this additional situational information. In many cases it is about replacing mechanical gauges with wireless sensors – sense every corner of the plant: pervasive sensing. The process engineers and operators know which measurements are needed. The I&C engineers can deploy the required sensors and route the data to the operator consoles. The additional information assists operators, reducing mistakes. Many plants are gradually rolling out sensors to gain the capabilities the paper suggests.
Reduced Supervisor Hands-on
The paper also notes supervisors also need to practice manual operations to take over when the automation like a sensor in a control loop fails. The later part of the paper suggests simulator practice. See further down.
The paper notes operators need the capability to see what the correct behavior of the process should be in order to tell if it is progressing as it should or not. The paper suggests special training or special displays for example in batch processes where the variables have to follow a particular trajectory in time. I recommend batch analytics with “golden batch profile” and “dynamic time warping” etc. The batch profile information makes work easier for operators and helps avoid errors. Some plants are already deploying such displays like the paper suggests.
Operator Confidence
The paper reminds us operators switch the process to 'manual' when they don’t trust the automation. I have seen operators put loops in manual if the automatic control is not doing a good job, such as because the control loop is poorly tuned or poorly designed, for instance disturbances and load changes not measured and therefore not included in the control strategy. When operators must juggle multiple loops in manual, mistakes will be made. I recommend additional sensors and actuators on the process, included in the control strategy, plus software like those listed earlier. Again, the process engineers know which measurements should be part of the control strategy. With that, more loops are left in automatic for longer.
The paper notes a high coherence of process information (a complete picture of the state of the process) and high process controllability result in low levels of stress and workload. Again an element of situational awareness to form a complete picture. I recommend additional sensors for situational visibility along with valves for throttling to enable automatic control or operators to act manually, enabling the operator to operate with confidence.
Conversely, the paper notes actions which cannot be made directly on the operator interface (operator must go to the field) results in high stress and workload (particularly in inclement weather). High levels of stress lead to errors. I recommend actuators to be put in place to be able to open and close valves and louvers from the operator workstation. Additional automation reduces operator stress and workload making the plant safer.
The new information and actuation capability make work easier for operators thereby reducing mistakes. Many plants already have wireless sensor network infrastructure in place enabling sensors to be deployed to gain the capabilities the paper suggests.
Situational Awareness – Control System State
The paper suggests alarm analysis to reduce alarm flooding and confusion. I recommend alarm management software and an alarm rationalization exercise for this.
The paper asks how the operator knows control is working correctly to take over if it is not. This is another angle on situational awareness. I recommend additional sensors to monitor additional variables in the continuous process or batch to enabling the operator to quickly assess the situation and to spot process variables outside limits such as temperature profiles and for predicting an off-spec batch. A workshop with process engineers and operators is a good way to uncover what additional measurements are required.
Recommended by LinkedIn
I also recommend NAMUR NE107-compliant smart instrumentation with self-diagnostics to detect failure of smart sensors and smart valves. If a device has failed, or somebody is working on the device, or the device needs maintenance, or device operates outside its limits, this must be flagged (NAMUR NE107) to the operator. This is important to safety as failure in a control loop create risks such as overpressure. Make sure to put NE107 in the requirement specifications for all your instrumentation going forward.
The paper notes it would be a problem if displays are no longer available in an emergency. I recommend redundancy of operator workstations and networks ensuring displays are available which is already common practice today.
The paper suggests systems should fail obviously (detected failures / overt failures) and further suggests automation to monitor unusual variable movement to detect system failure. This is pervasive sensing for situational awareness. I recommend additional sensors be deployed to detect process anomalies. The measurements required are unique to each plant so operators and process engineers get together to identify where sensors shall be deployed. This is safer than undetected failures / covert failures.
Further I recommend controllers and field instruments with self-diagnostics. If the control system does not support HART protocol communication pass-through from smart instruments, consider fitting critical instruments with a WirelessHART adapter.
The new information assists operators and thus reduces errors. Most plants have already deployed one or more of these solutions as the paper suggests.
Multiple Failure Modes and Manual Procedures
The paper notes the operator needs the capability to see the current state of the system (plant, production) before taking over to manually stabilize the process. Yes, another case of situational awareness requiring pervasive sensing. I recommend additional sensors for the missing measurements. The process engineers and operators know which measurements are missing.
The paper suggests a high-fidelity simulator for operators to practice frequently. And that procedure practice scenarios must cover all categories of failure. I recommend a virtual process model (a ‘digital twin’ of the physical process) for operators to practice safely in the safety of a classroom environment without affecting the actual process. For control room console operators an operator training simulator (OTS) just like the real control system and operator workstation is used and can be laid out just like the control room. This is just like full-fledged flight simulators for pilot training are laid out just like the flight deck / cockpit. Operators can practice taking over operation manually in an abnormal situation like an equipment failure. Plants are large and complex with many control loops and equipment to simulate, and many failure mode procedures to practice. Modelling the entire plant and all procedures may not be practical. Do not implement all units and all procedures at once. Start with the more critical plant units and procedures.
For field operator (as opposed to control room console operators) training I recommend virtual reality (VR) including a virtual model of the physical plant environment (also part of the ‘digital twin’). Again for field operators to practice safely in the safety of a classroom environment without affecting the actual process.
So it is not a single solution to solve all problems. The new information and training make work easier for field operators helping them reduce mistakes out in the field. Many plants are already deploying additional sensors but the simulators the paper suggests are not as common.
Dynamic Upsets
Further, the paper suggests simulator practice in a high-fidelity simulator to help operators maintain manual skills. Additionally, the paper suggests using dynamic simulators which accurately mimics the process. I recommend that when previously unknown faults are discovered, they are added to the simulator procedure scenario library.
I also recommend simulation models be built based on first principles (1P) allowing simulation and practice of procedures for scenarios which have not been experienced in reality (no real historical data available to train a statistical regression model). Beyond practicing known faults, simulators teach operators problem solving skills they can later apply in real life when faced with an unknown fault.
The training makes work easier for operators in turn reducing mistakes in the field. Some plants already have a simulator like the paper suggests.
Human Error
The paper notes human operators need to obtain enough feedback to correct their own errors and suggests feedback should be designed in for operators get adequate feedback on their own actions. I recommend the relevant sensors for feedback be deployed. Work with operators to understand for which manual actions they require better feedback. Include process engineers to advise which measurements provide timely feedback. The new information enable operators to spot and correct their own mistakes making their job easier. Many plants have the required infrastructure for wireless sensors so additional sensors to see the consequences of operator actions can easily be deployed to gain the capabilities the paper suggests.
Operator Pressure
Finally the paper notes “humans working without time-pressure can be impressive problem solvers”, so freeing up operators so they can work without time-pressure to solve problems. This is important for safety. The paper concludes resolving operator difficulties requires even greater technological ingenuity beyond classic automation. Clearly the paper has been very impactful because plants are now doing what the paper suggested. Plants are incorporating capabilities for alarm management, batch analytics, remote valve actuation, self-diagnostics, simulator training, pervasive sensing, and state-based control like the paper suggests. To this end, plants are deploying software, actuators, smart instruments, high-fidelity dynamic training simulator, and wireless sensors. If not already, your plant should start now. If already, continue to invest further.
Action Plan: Closing Automation Gaps
Here’s an action plan for which you can allocate a person responsible, date of completion, budget, and other resources:
Lead the way. Schedule a meeting for 28 April, SafeDay, or today. Share this essay with your safety manager now. Well, that’s my personal opinion. If you are interested in digital transformation in the process industries click “Follow” by my photo to not miss future updates. Click “Like” if you found this useful to you and to make sure you keep receiving updates in your feed and “Share” it with others if you think it would be useful to them. Save the link in case you need to refer in the future.