TOWARD AN UNDERSTANDING OF DCS CONTROL OPERATOR WORKLOAD By Christopher S. Connelly Beville Engineering, Inc.

Dayton, Ohio

The relatively new technology of Distributed Control Systems (DCS) has created a long list of new problems that must be solved and questions that must be answered. One perplexing question encountered by control system engineers is how to gauge DCS control operator workload and, more importantly, how to discern if the operators workload is excessive. The introductions of local control networks and advanced control require more sophisticated metrics of workload than simply counting control loops and using the 200 control loops per operator rule of thumb. Studies have also shows that there is little correlation between the number of control loops and many parameters used to gauge operator workload (such as moves per hour). The following paper will investigate current issues of DCS control operator workload in three main topic areas. First, the paper will briefly define factors that contribute to control operator workload and introduce a model of control operator workload. Control operator workload is a multifaceted construct affected by a host of interacting variables including the operator/control system interface (display and alarm system design), process dynamics, operator training/experience, and crew interaction. Next, the paper will briefly describe strategies that can be used to assess operator workload. Techniques used to assess workload are traditionally divided into three categories: 1) Subjective measures (NASA-TLX, developed by NASA, and SWAT, developed by the U.S. Air Force), 2) Physiological measures (heart rate and eye blink rate), and 3) Performance based measures (such as the number of control moves or alarms per hour, or where performance in measured on a secondary task that the operator completes). Also, the paper will discuss which are the easiest and most appropriate techniques to use with control operators. Finally, the paper will present a workload study of a petrochemical plant DCS control operator job. The study represents a typical control operator loading and how the workload ratings change in response to increasing job demands. The paper will define performance-based parameters which are indicative of excessive workload. Also, the paper will touch on the effects of advanced control on operator workload and will discuss strategies that the control system designer can use to reduce workload.

INTRODUCTION Todays control systems engineer is continually faced with the introduction of new technology. Two new technologies making inroads into the process control environment are Distributed Control Systems (DCS) and Local Control Networks (LCN). With the introduction of these two technologies come new ways to allocate manpower and control chemical processes. It is common today for one control operator to run several processes simultaneously. As a result of these innovative technologies, the control systems engineer is faced with new questions concerning how to best utilize the new capabilities, and how they impact the man/ machine interface. The man/ machine interface issues concern how much and what type of control responsibility the operator can safely handle. The control engineer must also resolve other issues such as, what are the limitations in the operators workload during process upsets and how can the alarm and display system be designed so that it reduces the operators workload? Often during upsets, operators report that they are overloaded by the new DCS control systems. To design an acceptable control system, the control system designer needs to know what the limitations of the operator are and must have some method by which those limitations can be measured. The human information processing system is limited in the amount of information it can process, just as the processor in a personal computer is limited in the amount of information it can process. Overloading either system, the human or the PC, will result in the systems making processing errors. Measuring the limitations of a PCs processor is fairly simple since it can be done through mechanical means. On the other hand, measuring the limitations of the human information processing system has proven to be much more difficult. Counting the number of control loops has been a practice often resorted to by many control system engineers to balance workload distribution between control operators. Lacking any other objective data, the practice intuitively makes a certain amount of sense since one would expect the number of control loops to correlate in some way to system complexity. However, when factors such as the level of advanced control, the stability of the process, crew interactions, etc., are considered, the correlation becomes much less reliable and then the merits of counting loops becomes questionable. There are, however, other methods by which operator workload and control system complexity can be measured more accurately. Fortunately for process control engineers, the problem of operator workload assessment has already been encountered by flight control system engineers. Following World War II, the instrumentation in airplane cockpits began to increase rapidly as the planes gained increasing automation and capabilities. By the time of the Vietnam War, automation had reached a level that overwhelmed many pilots, and pilots were literally dying as a result. To combat the problem, the aerospace community spent considerable time, money and effort in workload research. The result of the research was the development of workload assessment techniques that could be used to assess any type of man/ machine interface.

The techniques are in wide use in the aerospace industry and are an accepted phase of the design and evaluation process for airplane cockpits. These techniques have also been used in chemical processing plant control rooms, and can be used in any man/ machine system that uses a person to complete a control loop. The following paper investigates the current state of the art in workload assessment. First, mental workload and some of the underlying workload theories are briefly defined. Then, techniques that can be used to evaluate mental workload are reviewed. Finally the ways workload assessments can be used to help evaluate and design better control systems are examined. Two examples of workload assessment of DCS control operators are given. The scope of the paper is limited to those elements that directly affect the control systems engineer. WHAT IS MENTAL WORKLOAD? When we speak of a control operator being overloaded, what we are really talking about is the amount of mental workload the operator experiences. Mental workload generally refers to the amount of reserve processing capacity a person has while performing a task. Central to the concept of mental workload is the idea of the rate at which information is processed. A persons information processing is much like that of a parallel processing computer. The human process has several ways (also called channels) it can receive and process information, i.e., visually, auditorially, tactily, etc. A key to understanding workload is to realize that human information processing is channel capacity limited. Only a finite amount of information can be processed per unit time through each of the processing channels (visual, auditory, etc.). One experiment found that when a person must access information via a CRT, make binary decisions and respond by pressing a keyboard button, a human can reliably process 2.8 bits of information per second (Ref. 1). An accepted working model of human information processing was developed by Christopher Wickens and is known as the multiple resource model (Ref. 2). According to Wickens model, the human processing system consists of several types of information processing channels (which is analogous to a parallel processing computer), each of which is dedicated to a particular processing function (e.g., visual input, motor output). The amount of resources available for each processing function is limited and dedicated to that function. It is therefore possible to overload the processing capacity of one function without overloading the capacity of another (Ref. 3). From the Wickens multiple resource model, it can be inferred that the workload a person experiences is dependent upon the sum of all of the contributing factors. Choosing a single aspect of operator performance (such as control moves per hour) to use as a measure of workload will result in inaccurate data because it will miss all of the other factors.
Figure 1. Contributing factors to control operator workload

A model of factors that contributes control operator workload, which was developed in the context of the chemical processing plant control operator environment is contained in Figure 1. This model is based on the task and activities a control operator is likely to experience over the course of his shift. The model was compiled from information gathered in Beville Engineerings job sampling database for which a large number of control operator jobs were sampled throughout the petrochemical industry. In the model, factors that contribute to control operator workload include: display/ alarm system design, training/ experience, stability of the process, quantity of instruments, crew interaction, and performance shaping factors. For a workload assessment technique to be valid in assessing overall workload, the technique must have what is known as global sensitivity (Ref. 4). Global sensitivity refers to the workload measure being able to account for all of the variables (which are included in the model) that contribute to operator workload. It is for this reason that simply counting the number of control loops as a measure of overall workload is far from ideal. Counting control loops can help diagnose and identify contributing factors to overall workload, but it will not provide an accurate estimate of overall workload because it does not allow for many factors that contribute to workload. This is supported by an internal study conducted by Beville Engineering through its job-sampling database. The number of control loops an operator controlled was found to have little correlation with many measurable aspects of operator performance (such as number of alarms and control moves per hour, number of communications per hour, etc.). The control systems engineer can have a great influence on the amount of workload associated with a control system. However, he/she cannot have total control. Control operator workload is a complex matter because it is affected by many interacting variables. The model of control operator workload presented in Figure 1 shows that only a few of the contributing variables are under the influence of the control system designer. HOW IS MENTAL WORKLOAD MEASURED? Mental workload measures are generally classified into one of three categories: 1. Subjective Measures 2. Physiological Measures 3. Performance-Based Measures 1. Subjective Measures Subjective measurement techniques require that the subject report to the investigator the degree of workload that he experienced during a work activity or during a particular task. Subjective assessment techniques generally involve having the subject answer a series of questions and mapping the responses onto a workload rating scale. Two frequently used assessment techniques are 1) Subjective Workload Assessment Technique (SWAT), which was developed by the U.S. Air Force, and 2) NASA-Task Load Index (TLX), which was developed by NASA. Both techniques require the subject

to first do some activity, then assign a workload rating to the activity from a workload scale. The subjective measures are relatively easy to use and require a minimal amount of equipment. Subjective measures have also proven reliable in assessing workload even after a considerable amount of time elapsed between the operators experience and the rating. For example, the SWAT technique can be used to obtain workload ratings for process upsets which occurred in the past. Subjective measures are in wide use, mostly in the aerospace industry, for three basic reasons; 1) they are relatively non-intrusive, 2) they are usually inexpensive and easy to implement, and 3) they have a broad base of theoretical support. Subjective measures have repeatedly been shown to be consistent measurements of workload for given tasks (Ref. 5). 2. Physiological Measures Most often associated with physical workload, physiological measures are those that chart physiological changes (heart rate, eye blink rate, perspiration, etc.) that occur in the operator in response to system or task demands. Physiological measures can be used to judge the relative amount of cognitive workload as well. Recent studies have found that eye blink rate, respiration, heart rate, blood pressure, skin conductivity, and voice stress analysis can also be used to gauge the relative amount of mental workload (Refs. 6, 7). However, physiological measures can be intrusive and difficult to implement and are probably best suited to measuring aerobic work activities and physical workload, such as material handling. 3. Performance-Based Measures Performance-based measures assess workload through the capability of the operator to perform tasks or system functions and are probably the most widely used of the three types. A performance-based measure simply counts the number of tasks completed per unit time and compares it to the persons error rate. One type of performance-based measure is the primary task method which involves tracking parameters of the jobs demands (such as number of alarms/ hour, communications/ hour, and control changes/ hour) and comparing them against operator performance (usually his error rate). As the number of tasks increases, the operators workload increases, and his error rate will increase until it reaches an unacceptable level. Finding the upper bounds of operator workload using primary task measures is usually impractical since the indication of excessive workload would be an increased operator error rate, which is not desirable in a manufacturing setting. Another type of performance-based measure is the secondary task method. In the secondary task method, workload is estimated by doing a second task in addition to the primary task and increasing the difficulty on the primary task until the operator can no longer perform the secondary task. Secondary task measures are intrusive and difficult to conduct; because of this, the secondary measures are impractical and seldom used in an industrial setting.

Beville Engineering has found that an effective approach to workload assessment is to us a combination of subjective measure and performance-based measures. This approach is also a fairly common practice in the aerospace industry (Ref. 8). To use this approach, the researcher observes the subject completing an activity over a defined segment of time. During the observation, aspects of the operators performance are collected, such as the number of control moves, number of display changes, number of alarms, number of communications, etc. Following the observation, the operator completes the subjective workload measure in which the operator answered a battery of questions concerning the task just completed. The subjective answers are then mapped onto a workload scale. The rationale for using both subjective and performance-based measures is that the subjective measures provide a global measure of workload while the performance-based measures aid in diagnosing and isolating the contributing factors to workload. For example, the subjective measure of SWAT could be sued to find that a control board operators workload was excessive during a process start-up. Performance-based measures could then be used to find out that excessive display paging and alarm actuations were the cause of the excessive workload. EXAMPLES OF DCS CONTROL OPERATOR WORKLOAD The first workload example is a typical application of using subjective workload measures along with performance-based measures to estimate control operator workload. The second example investigates how a key parameter of operator span of control (the number of control changes per hour) changes in response to increasing job demands. Workload Example #1 In example one, an oil refinery operator was controlling a process unit with a DCS control system. Management was concerned that the operator was becoming overloaded in certain situations. Management also wanted to know if the workload was too high and what actions could be taken to alleviate the overloading. A two-part strategy was used to evaluate the position. Part one was to crate a workload profile for the process through the subjective workload measure of SWAT. The profile would allow for relative comparisons to be made for all of the phases of operation and would identify those events where overloading was occurring. In part two of the strategy, performance-based measures were used to isolate the tasks that were causing the high workload levels. In the workload profile development phase of the study, the subjective workload assessment technique, SWAT, was chosen to derive the profile. The profile was constructed by first generating a list of operating events that operators were likely to experience while controlling the process. The events included steady state examples, such as monitoring the board during normal operations, as well as off-normal examples, such as feed stock changes. Upset events, such as power failures, were also included in the

profile. The events were then rated by the operators through the use of the SWAT technique, and workload ratings for the events were then combined into a single graph to form the workload profile for the process. Figure 2 contains the workload profile for the process unit. Inspection of the workload profile reveals that there was an acceptable level of workload for the process during normal steady state operations. However, the profile also indicates that several of the upset events produced excessive levels of workload for the control operators. The SWAT rating Figure 2. Process workload profile derived using the SWAT workload assessment technique. went from a 17 during steady state to a reading of 83, which is above the accepted workload redline of 40 (the SWAT workload redline has been determined through a number of experiments that compared SWAT workload ratings and operator error rates) (Ref. 9). If the operators workload remained in the region of 40 and above for very long, or if he took on additional tasks, then he would become overloaded and his error rate would increase. To find out what was causing the excessive workload, performance-based measures were used to further evaluate operator tasks. The performance-based portion of the workload study consisted of sitting with the control operator and sampling the operators activities over the course of several days. All operationally related activities the operator performed were recorded. Examples of the type of data collected include communication activity, administrative tasks (logging), and control systems interactions (alarms, control moves, display changes, etc.). Over the course of the study, the operator encountered a variety of different operating conditions, including steady state, minor process transients (such as feed rate changes and equipment isolations), and process upsets. Figure 3 contains a comparison of the control system utilization for the process under 1) normal operations, and 2) process upsets relative to industry averages (as found in the Beville database). Examination of the figure reveals the characteristics of how the control system was configured. The operators spent an average amount of time monitoring the control system compared to others in the industry. Both the alarm actuation rate and the display change rate were
Figure 3. Control system utilization.

significantly above (more than one standard deviation) the industry averages. This indicates that the information is spread out over a large number of displays and the alarm system contains an above average number of alarms. One interesting finding was that the number of control moves per hour was roughly half that of the industry average. The reason is that the process had a fair amount of advanced control that the operators used during the sampling. In this case, the advanced control appeared to reduce the control responsibilities to half of what would normally be expected. It is interesting to note that the advanced control did not lower the amount of time the operators spent simply monitoring the control system. The advanced control system did not help the operator manage the process during process upsets. There is some indication that it could have actually hindered the operators upset response. In the initial phases of the major process upsets, the operator must first turn off the advanced control and determine the status of the equipment that was under the advanced control. While doing this, he must also attend to any alarms generated by the advanced control, further slowing down his upset response. All parameters of the operators control system interaction ramped up considerably during a charge pump/ furnace trip. Recommendations were made to correct the apparent shortcomings of the control system. An alarm objectives analysis was recommended to reduced the number of redundant alarms in the system and re-evaluate the alarm setpoints. The recommendation was also made to reduce the total number of displays and upgrade the automatic shutdowns for portions of the process. Other recommendations were made that were not control system specific. Workload Example #2 Workload example two is an examination of some of the data in the Beville Engineering database and their implications to control operator span of control. We know that humans can process a finite amount of information per unit time from experiments such as the one that found humans can reliably process 2.8 bits of information per second. But what about a much more complex system, say, for example, a chemical process with a DCS control system; how many control moves per hour can an operator be expected to reliably make?
Figure 4. Possible limitation in control operator span of control.

Figure 4 contains an example of how the operators workload can change during different phases of operation. In the figure, the number of control moves a continuous process DCS control operator makes per hour has been divided into three categories; 1) steady state operation, 2) feed stock change/ minor disturbance, and 3) process upset. Using the subjective workload assessment technique of SWAT as a point of reference, DCS control operators under steady state operation and making about 4.4 control moves per hour have been found to have a good level of workload. Operators experiencing process transients, such as feed rate changes, etc., who averaged 13.6 control moves per hour were found to have excessive levels of workload. The data in the figure suggests that there is an upper bound to the number of control moves per hour that the operator can make. Based on the data presented, it appears that if lines were extrapolated between the data points, a reasonable limit that could serve as a rule of thumb for span of control would appear to be in the area between 14 and 18 control moves per hour. The data presented are in no way meant to be an absolute standard from which workload judgments are made. They are meant to serve as a preliminary finding about what potential limitations are in the DCS operator span of control. Certainly, control moves/hour should not be used in isolation to estimate operator workload; rather, it should be used as a preliminary reference point. More research is needed in this area to further define the DCS operators span of control. METHODS AVAILABLE TO THE CONTROL ENGINEER TO LOWER OPERATORS WORKLOAD The variables that the control engineer can manipulate to affect operator workload are limited. Yet those variables, primarily the level of automation that displays system design and the alarm system design, can greatly affect control operator workload. Level of Automation Much of the recent automation effort is geared toward advanced control. For example, probably the most common advanced control application is optimizing fired furnaces since this usually has the biggest economic return. Advanced control can reduce the operators control requirements. In the first example presented in the paper, it was found that on processes that use advanced control, the control moves/ hour the operator makes can be significantly reduced. The data also indicated that the operators with advanced control spend about the same amount of time monitoring the control system compared to the process that did not utilize advanced control. However, it should be kept in mind that steady state operation is not where most workload problems exist; most workload problems occur during process transients and upsets. This would indicate that to reduce control operator workload, more resources should be put into automating the process shutdown systems. The second workload example demonstrated how the number of control moves per hour can spike up during an upset. Without proper planning, advanced control can create

higher workload swings between normal and upset process conditions. Advanced control could lead to situations where the control operator is underloaded (and at a low arousal level) during normal operations and overloaded during process upsets. A general rule of thumb might be that as the level of advanced control rises, so should the level of automation of the automatic shutdown systems. Using the second workload example as a point of reference, automatic shutdown systems should be designed so that the operator is required to make less than 18 control moves per hour. A consideration to keep in mind when designing advanced control systems is that if people do not understand what is going on behind the automatic control system, they will loose their trust in it, and they will not use the system. The Airbus A320 flight control system was blamed for three crashes, and the pilots began threatening to refuse to fly the plane. The A 320 was the first of the glass cockpits in which CRTs replaced analog gauges. A320 designers automated much of the flight control and did not provide the pilots proper feedback to let them know what exactly the control system was doing. The same situation is happening in the processing industry. A key point to remember is that you must make the boundaries of the system visible to the user; points at which the control system is limited need to be explicitly stated to the operator. Displays need to be created which convey to the operator what the control system is doing and how close the system is to its design limits. Display System Design Another variable under the control engineers influence that can affect the DCS control operators workload is the design of the display system. There are many human factors principles to be considered when computer displays are being created. Some of them include coding of information, functional grouping of information, and matching information presentation (such as trended, difference, analog or digital, etc.) to the operators informational needs. One critical point to keep in mind is that the human information processing system has many limitations. One of those limitations is that a persons short-term memory is limited to about 7 bits of information (Ref. 10). Short-term memory is analogous to a PCs RAM, but unlike a PC, you cannot plug in a few SIMMS to increase the persons short-term memory. Overloading short-term memory is one way to increase workload. To avoid overloading short-term memory, display systems need to be designed to minimize shortterm memory loading. One way to do this is to minimize the number of displays in the system and place more functionally related information on each display. People are very good at making relative comparisons but poor at memorizing large amounts of information using the same display than to have them comparing information across different displays. In the process control industry, there has been a trend to having very little information on any one display and having a large number of displays. This trend runs contrary to much of the current research. Research on the enhancement of operator situational awareness

has found that situational awareness is enhanced when the number of displays is minimized (Ref. 11). Jens Rasmussen, a leading researcher of human factors, noted that display designers often underestimate the complexity of displays that are acceptable to an expert immersed in the work context if the information in the display is properly structured (Ref. 12). There seems to be a commonly held fallacy that display density automatically means a cluttered display. Often the approach is to unclutter the displays which leads to more displays being created. This, of course, increases the load on the operators short- and long-term memory, since the operator has to remember which information was on which displays and information from display to display. This ultimately leads to the short-term memory becoming overloaded and information being lost. Another avenue to reducing short-term memory loading is to provide the operator with a single overview display that contains critical process parameters from which the operator is able to imply the general state of the process. Providing this information will increase the operators situational awareness of the process. Overviews should have alarm summary information plus key process parameters that allow the operator to infer the status of the entire process. Alarm System Design Alarms are a key to reducing the operators loading during process transients and upsets. An alarm system that has too many redundant alarms has the effect of overloading the persons short-term memory. That will, in turn, raise the operators workload. The alarm actuation rate during process upsets should be examined for excessively high actuation rates, which are usually in excess of 20 alarms per hour. The purpose of the alarms is to guide the operator to the affected areas of the process and inform the operator of the criticality of the problem. All too often alarm systems are corrupted and set up to optimize along the lines of process efficiency and/or product quality. A criterion that should be used to evaluate alarms is that each alarm should have a unique operator response. If multiple alarms exist that have the same operator response, the redundant alarms are candidates for combination or deletion. SUMMARY A primary concern of human factors engineering is to ensure that the task demands do not exceed the operators workload capacity. The growing complexity of the new control systems and added responsibilities given to operators have increased the likelihood of exceeding or approaching the limitations of many operators workload capacities. A model of DCS control operator mental workload was presented that illustrates how mental workload is multifaceted. A number of variables must be considered to estimate mental workload. Techniques have been developed to measure mental workload. Mental workload measurement is a required step in the cockpit design process in the aerospace industry.

The two workload examples provide in this paper illustrate how mental workload assessment is being used in the process control industry. Example 1 presented a typical example of workload estimation using subjective and performance-based measures. Example 2 presented an example of what appears to be a possible limitation of the DCS operators span of control. The final section of the paper points out some of the options available to the control systems engineer to reduce the control board operators mental workload. The level of automation of the process, and the configuration of the display and alarm systems can have a significant effect on the control operators workload. There is much yet to be learned about designing effective control system interfaces for the process control operator. The work presented in this paper represents only a few data points on how a DCS control operators workload changes in response to increasing job demands. Much more work needs to be done to fill in the DCS control operator workload curve.

REFERENCES 1. McCormick, E.J., and E.M. Sanders, Human Factors in Engineering and Design, (5th Edition), McGraw Hill Inc., 1982, p. 47. 2. Wierwille, W.W., and F.T. Eggemeier, Recommendations for Mental Workload Measurement in a Test and Evaluation Environment, Human Factors, 35(2), 1993, pp. 263-281. 3. Wickens, C.D., Processing Resources and Attention. In D.L. Damons (Ed.), Multiple Task Performance, London: Taylor & Francis, 1991, pp. 3-34. 4. Wierwille, W.W., and F.T. Eggemeier, Recommendations for Mental Workload in a Test and Evaluation Environment, Human Factors, 35(2), 1993, pp. 263281. 5. Vidulich, M.A., and P.S. Tsang, Assessing Subjective Workload Assessment: A Comparisonn of SWAT and the NASA Bipolar Methods. Proceedings of the Human Factors 29th Annual Meeting, 1, 1985, pp. 71-75. 6. Stern, J.A., and J.J. Skelly, The Eye Blink and Workload Considerations. Proceedings of the Human Factors 28th Annual Meeting, 2, 1984, pp. 942-944. 7. Schiflett, S.G., and G.J. Loikith, Voice Stress Analysis as a Measure of Operator Workload (TM-79-3), Patuxent Navel Air Test Center, 1980. 8. Rueb, J., and M. Vidulich, Establishing Workload Acceptability: An Evaluation of a Proposed KC-135 Cockpit Redesign, Proceedings of the Human Factors Society 36th Annual Meeting, V.1, Santa Monica, CA, 1992, pp. 17-21. 9. Reid, G., and H. Colle, Critical SWAT Values For Predicting Operator Overload, Proceedings of the Human Factors Society 32nd Annual Meeting, V. 2, Santa Monica, CA, 1988, pp. 1414-1418. 10. Miller, G.A., The Magical Number Seven, Plus or Minus Two: Some Limits on Our Capacity for Processing Information, Psychology Review, 63, 1956. 11. Endsley, M., Design and Evaluation for Situation Awareness Enhancement, Proceedings of the Human Factors Society 32nd Annual Meeting, V. 1, Santa Monica, CA 1988, pp. 96-101. 12. Rasmussen, J., Virtual Ecology of Work and System Design, CSERIAC GATEWAY, V. 3(2), March/ April 1992, p. 10.