CONTROL OPERATOR OVERLOAD: IDENTIFICATION AND PREVENTION

David A. Strobhar

Beville Engineering, Inc. 201 West Franklin Street, Suite D

Dayton, OH 45459 (937) 434-1093

INTRODUCTION The control operator has become an increasingly critical element in the safety and operation of most processing facilities. The use of distributed control systems has both increased the operators span of control and focused the control responsibilities onto him. No longer is an entire crew watching the board and ready to help out. The modern control operator is on his own to respond to plant disturbances. Assurance that the control operator will not become overloaded during an upset condition and will be able to perform his duties is a critical issue. The distributed control system allows an almost limitless amount of information to be presented to the operator, information that must be processed or overlooked. The distributed control system also allows the operators span of control to be increased, with proximity of the unit or size of the control boards no longer a factor in how much a control operator can handle. In order to assure that the operator will not be overloaded, it is necessary that operator loading be measured and that the factors contributing to overload be identified and eliminated from the system. This paper summarizes data on control operator performance from field studies at more than thirty processing plants and references it to theoretical principals in human factors engineering. NATURE OF HUMAN PERFORMANCE Human performance has very few absolutes. A given level of performance in a machine system can be obtained through various combinations of the following:

Selection (Who is chosen to do the tasks?) Training (What are the skill and knowledge levels of the individual?) Motivation (How well do they want to do, are their circadium rhythms disrupted?) Supervision (Have the goals been well established, individual empowered?) Task allocation (Are the tasks appropriate for human control?) The interface between man and the machine/process (workstation, alarms,

displays) Similarly, improvement in performance can be obtained by improving any one variable. Or, poor characteristics of one variable can be compensated by superior characteristics of another.

There are, however, absolutes in human characteristics, particularly in the human information processing system. Since the role of a board operator is primarily that of information processing, these characteristics become key factors in the cause and prevention of operator overload. Two of the key characteristics are human short-term memory limitations and mental workload demands. Information processing tasks will place demands on both short-term memory and mental workload. This is colloquially described as workload. When the demands become excessive, the probability of operator error increases dramatically, and the human sub-system, the operator, becomes overloaded. Human short-term memory limitations make the human information processing capacity limited. Short-term memory is limited to about seven chunks of information. A person cannot retain in his short-term memory, or consciousness, much more than seven distinct chunks of information. While this is an often overstated principle, it has profound implications on board operator performance. Since distributed control can present almost limitless amounts of information, the operators short-term memory can quickly become overloaded. This phenomenon is particularly evident in the processing of alarm information. A fluid catalytic cracking unit at a small refinery experienced a failure of one of the slide valves separating the reactor from the regenerator. The resulting incident at one point resulted in 300 alarms actuating in a ten-minute period. The information on the alarms was shown on a CRT screen sequentially by time of actuation. Needless to say, the operator could not process any more alarm information at this point and the alarm system had simply become a nuisance. Fortunately, the operator knew the problem. However, it would be unlikely that the operator could have detected a second independent problem using the alarm system. This type of example is typical of DCS operators, who routinely say that the alarm system is useless during an upset. Even if the capacity limitation of short-term memory is not overloaded, there must be sufficient mental resources to act upon the information. This is the second key consideration of human information processing. Demands on mental resource requirements are theorized to be task dependent and vary with the individual. The task characteristics are the complexity of the task, the time constraints required to perform the task, and the stress of the task (or consequences of error). A prime attribute of human involvement in systems is that people rarely shut down in an overloaded situation. We continue to perform, but our error rate increases dramatically. High mental resource demands reflect this phenomenon. Tasks requiring over 40% mental workload can be handled by a person. However, the longer that level of mental resource demand is maintained, the greater probability of operator error. The configuration of the distributed control system has a major interaction with short-term memory and mental workload. If information is spread out over multiple display pages, the operator may have to hold the information in short term memory while accessing another display, increasing the potential for a capacity bottleneck. Display

paging uses mental resource, reducing the availability for other applications and increasing the potential for operator error. As is evident, calculation of human error rates independent of the design of the distributed control system will be fraught with errors. OPERATOR WORKLOAD ANALYSIS Determination of operator workload must be done for both steady state and off-normal operation. The demands of each are different, but both are important. The importance of evaluating off-normal situations (i.e., upsets) is obvious. Steady state evaluation is important in that it is the precursor for the upset situation, it provides insight into upset characteristics that are not easy to obtain in an upset, and it reflects cumulative demands on the board operator. Steady State Analysis Determination of board operator loading for steady state analysis requires determination of time spent on job related tasks and the number of tasks performed. The board job in most processing plants is highly reactive, creating a system-paced job. Likewise, demands other than those imposed by the process (maintenance requirements, outside operator interactions, administrative, SPC) must be accounted for in the overall operator workload. Beville Engineering determines the steady state operator loading through calculation of a busyness factor, reflecting both task duration and frequency. Figure 1 shows a plot of board operators steady state demands, reflecting the task duration and task frequency. Figure 1. Steady State Operator Workload

The plot shows the results of almost fifty data samples of refinery board operators. The vertical plot is the number of tasks per hour the operators performed. The horizontal plot is the percentage of the sample time (four hours) spent directly on job related tasks. The diagonal lines represent equivalency curves reflecting mean time between tasks (MTBT) for varying numbers of tasks and levels of direct time. The lower the MTBT, the busier the operator. Increasing workload is reflected in increasing direct time, increasing numbers of tasks, and in the resulting decrease in MTBT. The point labeled Job #1 in the figure was analyzed because management felt the operator to be overloaded. As the figure clearly shows, managements perception was valid. However, a subsequent analysis of the data indicates that much of the loading resulted from an alarm actuation rate four times the industry average and a communication rate with outside operators also significantly above the industry average. Altering the alarm actuation rate and communication rate would change the loading to that identified as Job #1a. Off-Normal Analysis The use of task duration and frequency is insufficient for off-normal analysis, both because the duration has a ceiling effect (there are no breaks in an upset) and the data are obtained through observations, which arent amenable to the unplanned nature of upsets. Therefore, a different approach has to be utilized. Beville uses the Subjective Workload Assessment Technique (SWAT), developed by the U.S. Air Force, to measure off-normal workload. SWAT requires the rating of off-normal events by operators, which are then mapped to a scale of mental workload demands. Figure 2 shows the result of such an analysis for board operators at a major refinery. The figure shows the mental workload demands for 16 events, with the operators rating each event for working with an experienced crew and an inexperienced crew. As can be seen from the figure, Tasks 4, 5, 6, 7 and 14 utilize more than the 40% mental workload. Prolonged events of this nature will have an increasing probability of operator error.

Figure 2. Example of Upset Workload Analysis

Inspection of the figure also shows the impact of experience or training on workload demands. Tasks 1, 2, and 4 all imposed significantly less workload on the board operator when an experienced or well-trained crew was working the unit. DESIGNS TO REDUCE WORKLOAD If an operator overload situation is possible, what can be done to minimize the probability or lower the workload? The impact of enhanced training was quite clear from the SWAT profile. However, configuration of the operator-process interface offers great potential to reduce workload demands. In particular, properly structuring the alarm and display system is a prime opportunity to reduce the potential for the operator to become overloaded. Enhancing alarm presentation is simple in concept. First, ensure that each alarm prompts a unique operator action. This means that there should be no alarms for which the operator takes no action and that there are not multiple alarms that all prompt the same behavior. Simple application of this principle to a variety of processing plants has reduced the number of points that can alarm by 70%. The result is a ratio of alarms to controllers of less than 3:1. Second, provide qualitative information on alarm importance by system. Alarms need to be prioritized and the operator provided indication on the status of all alarms on various systems in the plant. This usually requires creation of common trouble alarms for all the alarms in each system, indicating the priority of the alarms by color and position. This type of qualitative presentation allows the operator to process large numbers of alarms with little demand on the information processing system. Improvement of the display system can be done through ensuring that the display system is compact. A compact display system will reduce the amount of paging and load on short-term memory demands. Creating a compact display system requires that the display be build for a qualified operator. A qualified operator knows the hardware he is controlling; therefore, extraneous information on what is on a pipe, or the number of trays in a tower, or the number of exchangers in an exchanger bank need not be shown on a graphic display. The resulting savings in space can be used for real information, with again a potential reduction in the number of displays by 70%. Enhancing the alarm and display system reduces workload for both normal and off-normal operation. Normal operation is improved due to a reduction in the number of tasks the operator must perform, i.e., fewer alarms to respond to and less pages that must be accessed. Upset response is improved because with less pages more time is available to correct the problem, less mental resources are utilized, and the complexity of the problem is reduced due to proper grouping of the information. The alarm status indicators allow chunking of the alarm information so that the alarm system is actually useful to the operator during an upset.

SUMMARY Overloading the control operator is a justified concern in the processing industry. Inherent limitations in the human information processing system create the potential for operator overload and error. Examination of operator task frequencies and durations can indicate when steady state loading is becoming excessive. Excessive mental workload for off-normal situations can be ascertained through mental workload assessment techniques such as SWAT. Redesign of the operator-process interface, the alarms and the displays, has significant potential to reduce the probability of an operator becoming overloaded.

NOTES

1. G.A. Miller, The magical number seven, plus or minus two: some limits on our capacity for processing information, Psychological Review, 63 (1956)

2. G.B. Reid, C.A. Shingledecker, and F.T. Eggemeier, Application of conjoint measurement to workload scale development, in Proceedings of the Human Factors Society 25th Annual Meeting (1981)

3. G.B. Reid, and H.A. Coole, Critical SWAT values for predicting operator overload, in Proceedings of the Human Factors Society 32nd Annual Meeting (1988)