All at Sea: An Ergonomic Analysis of Oil Production Platform Control Rooms.
Dr Guy H. Walker, Steve Waterfield MSc & Dr Pauline Thompson
Institute for Infrastructure and the Environment (IIE),
School of the Built Environment, Heriot-Watt University, Edinburgh, EH14 4AS
ABSTRACT
Control rooms on offshore production platforms are the focal point for their safe and efficient operation. Following the Piper Alpha disaster in 1988 a sizeable body of safety literature was generated covering the ergonomic issues then in play. More than twenty years have passed since that time and significant changes have occurred to how control rooms are manned and the technology now in use. As the North Sea oil industry in the UK enters a new phase in its life cycle, and becomes subject to unprecedented production and cost pressures, it is time to revisit these issues. This paper reports on an ergonomic survey covering approximately a third of all North Sea control rooms. The focus is on the adaptive capacity of the highly experienced control room operators and the current challenges to that capacity. Areas of concern include the support provided for dealing with non-routine events, the persistent issue of ‘alarm overload’, the flexibility and control of current SCADA systems, the use of control rooms for non-related tasks and personnel, and the possible role of non-technical skills training.
Keywords: Control room design, surveys, systems ergonomics
INTRODUCTION
Background and Context
UK oil production is centred in the North Sea. It encompasses a region to the North East of the Shetland Islands, the East Shetland Basin, then South to an area off the coast of Norfolk with an Eastern boundary abutting the UK Continental Shelf. Offshore oil installations in this area are remote (up to 180 miles offshore) with high hazard potential. High pressure flammable and volatile materials are present and many hazardous operations, such as drilling, need to be carried out in a limited space. Many installations have a large number of people living in close proximity to these hazards and staff normally fly in and out by helicopter. As such, there are major potential hazards to both life and the environment and clear safety issues. Indeed, if these installations were onshore they would be designated as top tier COMAH (Control of Major Accident Hazards) sites.
In broad terms nearly all of the off shore installations have common facilities of relatively simple engineering design. Most production platforms incorporate systems and infrastructure for oil, gas and water separation, gas dew point conditioning, gas compression and export, crude oil export and produced water disposal. The focal point for the monitoring and control of these processes, and the accompanying safety systems, is the control room. This is one of the key interfaces at which humans in these systems are able to intervene in the large scale mechanical and technical processes, an interface whose importance has been highlighted by notable accidents such as Piper Alpha, Texas City and Three Mile Island. Clearly, ergonomics issues are important in getting this interface right, but ergonomics issues are modified by a number of features unique to the users of the control room and to the context they find themselves in.
The first is that oil has been extracted from the North Sea in bulk since only the mid-1970s and from the outset it was without precedent in the UK. As a result, many of the founding principles emerged as a series of ‘bolt-ons’ from other sectors. For example, the installations were at sea so there was a prominent marine aspect. The installations were also challenging to construct, so there was a prominent civil engineering aspect. The installations were also heavily focussed around well and drilling technology, so this too dominated. Put simply, the main technical challenge was on getting the facilities in place and in production, and expertise from these and similar backgrounds dominated in the design process.
The second issue is the disconnect between the on and off-shore context. Effectively the situation is one of a large number of people living in close proximity to a hydrocarbon drilling and processing operation with no easy means of escape should an emergency occur. It is extremely unlikely that onshore planning regulations would allow population centres to be as close to such plants as is effectively the case offshore, and COMAH regulations do not apply. Likewise, the UK Health and Safety Executive (HSE) had no direct jurisdiction until the late 1980’s (after the Piper Alpha disaster; Cullen, 1990), the industry being managed previously by shipping and maritime agencies.
The third issue is lifecycle. Many valuable works on the ergonomics of offshore control rooms were published in the aftermath of Piper Alpha (e.g. Rundmo 1992a, b, 1993, 1996; Rundmo & Hestad & Ulleberg, 1998; Flin et al., 1996 etc.) when the industry was approximately fifteen to twenty years old. At the time of writing the industry is approximately forty years old and several significant developments in control room design have emerged since then, including greater degrees of automation and more advanced Supervisory Control and Data Acquisition (SCADA) systems.
In summary, the offshore industry is characterised by a very distinct design legacy, an unusually high hazard context, a different set of standards compared to on-shore installations, and has been subject to developments in control room design that have not been significantly revisited from an ergonomics point of view since the flurry of published work post-Piper Alpha. This paper aims to explore these issues by providing an up to date survey of control room ergonomics, comparing on and off-shore locations and leveraging the new ergonomics knowledge that has also emerged in the previous twenty years.
Evolution of the Control Room
Off shore control rooms describe a ‘classic’ trajectory from local automatic control to Supervisory Control and Data Acquisition (Kragt, 1992). In the early period of the off-shore oil industry, control rooms were usually basic monitoring stations with instruments only giving indications of measured values in the field. First generation control rooms slowly evolved into having pneumatic or electro-pneumatic instrumentation that allowed local automatic control of the more critical parts of the processes, usually supported by large annunciator panels. In this case each instrument needed a discreet set of components and wiring to convey the information to and from the control point to the end element, which meant that each control loop was a single entity and could only carry out its specific ‘hardwired’ function. Despite the inevitable crudities and inefficiencies of hard wired controls and annunciator panels they did embody some (usually inadvertent) ergonomic advantages. For example, operators could get a very quick appreciation of the state of the plant simply by the amount of light being given off by the panel. The relative lack of automation required the operators to continuously engage with the control systems, thereby helping them to track the dynamics of evolving situations (Kaber & Endsley, 2004; Moray, 2004; Stanton, Chambers & Piggot, 2001; Norman, 1990) which, in turn, was facilitated by ‘hard-wired’ controls that provided a relatively simple and direct action-feedback loop (e.g. Norman, 1990; Zubof, 1988; Stanton & Marsden, 1996). The disadvantage, of course, was the reliance placed on operator vigilance, the implications of high workload, the need to maximise process efficiency and the relatively small scale of operations that one (or a few) operators could manage at any one time (Kragt, 1992). As such, during this period basic overview SCADA (Supervisory Control and Data Acquisition) systems began to appear. These took in data from a wider range of systems and sensors and allowed trends of certain parameters to be followed more closely. These systems were not capable of full remote control and this situation remained until the late 1980s. As a ‘proof of concept’ and a demonstration of technological capability, however, these early SCADA systems were successful and ultimately led to second and third generation control rooms.
Second and third generation control rooms made use of the widespread availability of microcomputers and distributed control systems (DCSs) and began to emerge in off-shore locations from the late 1980’s onwards. The human interaction with these systems shifted from annunciator panels and hard-wired controls to computer screens and keyboards, creating new ergonomic possibilities but removing others. The wider range of activities these systems now interfaced with also required greater degrees of team working, again, creating new opportunities for coordination and cooperation but requiring this of personnel traditionally used to lone-working. In other safety critical industries, such as aviation, this issue has been recognised and initiatives such as Crew Resource Management (CRM) and training in ‘non-technical skills’ have been in existence for some time (e.g. Cooper, White & Lauber, 1980).
On the one hand, second and third generation systems represented a ‘step change’, but on the other hand they were a ‘bolt on’: they did not completely replace elements from the annunciator panels or all hard-wired controls, thus in many cases the control room that emerged was a hybrid of new and legacy equipment. Operators, due in large part to their domain experience, were required and seemingly able to adapt to this new situation. In third generation systems even greater centralisation is possible. The situation today is that control of an offshore plant can be assumed from an on-shore location meaning that unmanned, remotely operated installations are now common.
The modern production platform control room is now, in theory, a high tech SCADA centre with efficient and capable computer systems and a wealth of information available to the control room operator, as shown in Figure 1. The SCADA system can keep track of individual control circuits, alerting the operator to failure of components long before they cause further problems. The primary task of the system is to continuously control the production process, which it can do for extended periods of time without any human input. These technological changes have inevitably changed the role of the control room operator, altering their workload, their perception of system states and requiring them to work as part of a larger distributed team. It has also changed the role of the local control room. It is still in place in offshore locations, still important for plant safety, equipped with a mixture of legacy and new equipment, and because of increased automation is increasingly used for additional purposes.
Figure 1 – Typical offshore control room
Ergonomic Issues
The trajectory traced by first, second and third generation offshore control rooms is a familiar one. Hollnagel and Woods (2005) describe it as a self-reinforcing complexity cycle. The cycle begins with new technology creating a perceived deficiency in an existing system. SCADA, for example, ‘affords’ new functionality like remote control, greater efficiency and reduced costs compared to hardwired controls and annunciator panels. This apparent lack of capability is answered by expanding the systems’ functionality by ‘bolting on’ the extra capability. This, in turn, creates a new and more complex system that has been pushed “back to the edge of the performance envelope” (Woods & Cook, 2002, p.141). A characteristic of this self-reinforcing cycle is that the user is often left “with an arbitrary collection of tasks and little thought may have been given to providing support for them” (Bainbridge, 1982, p. 151). As a result, human adaptability is required in order for these systems to work as intended which, in turn, creates new ‘opportunities for malfunction’. Hollnagel and Woods clarify this point: “by this we do not mean just more opportunities for humans to make mistakes but rather more cases where actions have unexpected and adverse consequences” (2005, p. 5). The response to situations such as these is to change the functionality of the system again, from second to third generation control rooms for example, thus completing the self-reinforcing cycle shown in Figure 2.
Figure 2 – Hollnagel and Woods (2005) self-reinforcing complexity cycle
The implied task for the human operators is to track the dynamics of this evolving context. This situation is again a familiar one. A well-worn maxim in Ergonomics is that ‘it is easier to twist metal than it is to twist arms’ (e.g. Sanders & McCormick, 1992), in other words, it is easier to adapt a system to its user than to insist on adapting users to a system. At one level this represents the definition of Ergonomics itself, i.e. ‘matching products, systems, artefacts, infrastructures and environments to the capabilities and limitations of humans’. When interpreted literally, however, it tends to presuppose that users do not change and that the system (and user) can be seen in isolation from their environment. An alternative way of viewing the ‘twisting metal versus arms’ dialectic is to see it as an almost necessarily antagonistic process, such that there is “reciprocal evolutionary change” (Kelly, 1994, p. 74), or a little of both metal and arm twisting. Users have their ‘arms twisted’ by having to adapt to a new system, in turn, the system has a little more of its ‘metal bent’ to suit new needs that arise from this adaptation, which creates more new needs, more arm twisting and more metal bending, projecting forward in a co-evolutionary spiral until the original system becomes very different from its original form. Indeed, when surveying the evolutionary timeline of off-shore control rooms it is clear that it says as much about what the control room has done to users as the users have done to the control room. Both have become locked into a single system, “Each step of co-evolutionary advance winds the two antagonists more inseparably, until each other is wholly dependent on the other’s antagonism. The two become one” (Kelly, 1994, p. 74; Licklider, 1960). Because of this there is a great danger of ‘ergonomic-naivety’: it becomes very easy to identify ergonomic shortcomings when compared to various ‘normative’ standards, but that is to miss entirely the contextual features of the system and the expertise of the users, both of which are vital to effective and sensible ergonomic interventions.