Document gDXyadJ8yD3La4EJrQ4BZMndQ

'/CiJLi: l 'L'S/f t Page 1 of l-l COMPUTER CONTROL SAFETY 'QUEST. IONNAMIR. E; ,^, EIVED Dear VCSA Member, ScP P ^ 1981 Computer control of PVC plants has very def benefits. However, there are some safety problems which computers introduce which are not readily apparent. The purpose of this questionnaire is to survey computer-operated plants to discover any special problems related to computers, either design or operator interface, related, and how these have been solved. 1. COMPUTER/MANUAL OPERATION A) Do you have provisions for independent computer and manual operation? __________ 1. No 2. Yes 3. Not Totally 4. Yes 5. Yes 6. Yes B) How do you isolate the computer from the plant during manual operation or when the plant is down for computer repairs? 1. The portion of the computer used for tempera ture control is kept active when the computer is in repair. No manual control is possible in other portion when computer is down. 2. A key switch which turns complete plant control into manual operation. 3. Mechanical disconnect, at I/O and at remote (air supply to valve, etc.) 4. Switch all devices to manual operation 5. There is a relay switching system that is " activated on computer failure or by manual request. This system deactivates panel push buttons during computer operation and isolates the computer I/O from the device relays during manual or panel mode. 6. Have MANUAL/AUTO switch which electrically isolates computer. Had one incident during trouble shooting of computer when switch was bypassed accidentally. Future design will consider more tangible isolation than switch. GENC 015514 Page 2 of 11 C) Have you had any problems with the computer opening valves or reactors which were out of service for maintenance? 1. No operation is possible without computer. 2. No-air is removed from solenoid operated valves when out of service. 3. Once - installed lockout on positioners. 4* One occasion due to human error. 5. No - All valves on reactors down for mainte nance are "air-failed" so that they cannot open. 6. Air supply to reactors is locked out during maintenance. D) How do you maintain operator proficiency on manual operation during long periods of computer operation? 1. No manual operation is made. 2. We do not run full production without computers. 3. Don't try. 4. Once per month each operator must operate manually for at least four hours. 5. We do not, at this time, have a specific program or method. This has not been a problem for us because our computer up time averages about 98%. 6. Schedule periods of MANUAL operation in order to maintain proficiency. 2- OPERATORS TRAINING A) How do you train new operators? 1. Through education in special lecture program and on the job training. 2. On-the-job with a background of basic theory once familiar with job. GENC 015517 Page 3 of 11 3. Some classroom and theory - mostly on the job buddy system. 4. Formal Class Room Training for approximately four weeks. Then work with existing operator for approximately two months. 5. New computer operators receive most of their training by working with experienced operators. They also spend approximately eight hours with one of the computer programmers for technical instruction about "the computer. 6. New operators are not trained on the computer until all other jobs.in plant are mastered. Training involves several weeks of on the job dual operation with experienced operator, on both MANUAL and COMPUTER modes. B) Do you have refresher training for experienced operators? 1. Yes 2. Yes - Limited to last job rotation otherwise operators are encouraged to keep current at all times. 3. Yes 4. Sometimes when operating procedures are updated. 5. We do not have regularly scheduled retraining classes for experienced operators, but retraining is done if operational performance indicates the need. 6. No C) How do you retrain after major program revisions? 1. By lecture and simulation training. 2. Process and staff engineering will assist in this effort. 3. Written, classroom, and demonstration. 4. Systems Engineer conducts training sessions. Includes practice on CRT. 5. When possible, major changes are made gradually and training classes are held to inform operators of the effects of the changes on them. GENC 015518 Page 4 of li 6. (1) 12-15 hours classroom (2) 1 to 3 days water batching D) How do you communicate minor program revisions to all operators? 1. Either by an official transmittal note or either by starting meeting of the day. 2. Memos and log book. 3. Written - notice and description. 4. Operator log book and notices. 5. This is done through operation department communication channels. (IE., instructions in supervisors instruction log). 6. Have separate log book to record all revisions. 3. FIRST-LINE SUPERVISOR TRAINING A) How do you train new supervisors? 1. By on the job training. 2. Allow upgrade system to cover vacancies. 3. A - Senior operator system leads to promotion. B - No formal method - probationary period. Both - Use outside training programs. 4. New first line supervisors are promoted from the-operators ranks and are already familiar with operation. Other training consists of familiarization with maintenance procedures, company policy, etc. 5. New supervisors do not undergo any formal training because they are all ex-computer operators. 0^ 5^ t Page 5 of 11 6. Had problems, during startup of plant because supervisors had no time for first hand solo operation of computer, following the classroom sessions. Since then, however, all new super visors selected have come from best computer operators. B) Do you have refresher training for experienced supervisors? 1. Not done usually, except on emergency training. 2. They participate in all training sessions for each unit. 3. Yes 4. Yes - Same as with operators. In addition they get refresher on supervisory skills. 5. No 6. No C) How do you retrain after major program revisions? 1. By a lecture and simulation training. 2. Process engineering will assist in this effort. 3. Same as operators. 4. Same as operators. 5. They attend the same training classes that operators attend for major changes. 6. (1) 12-15 hours classroom. (2) 1 to 3 days water batching. GENC 015520 Page 6 of xi D) How do you communicate minor program revirions to all supervisors? 1. By an official transmittal note. 2. Memos and log book. 3. Written and discussions. 4. Same as operators. 5. The same as for operators, through operation department's communication channels. 6. Separate log book to record all revisions. E) Have you had any problems with first-line supervisors losing proficiency with computer operations because of problems in other non-computer-operated parts of the plant?How are these problems overcome? 1. Very few case only. We give them refreashing education and make them supervisors. 2. No - Most first-line supervisors have only a limited working knowledge of computer operations. 3. Some refresher period and assignment with capable operators. 4. No 5. We do not attempt to keep a supervisor completely up-to-date on computer operations. We feel that with two console operators and two senior operators on,each shift, it is un necessary to keep supervisors proficient on the computer. 6. Yes - Require supervisors to spend more time in control room and place more responsibilty on outside operators. GENC 015521 Page 7. of 11 4. INFORMATION OVERLOAD A) Have you had any problems of operators being swamped with computer messages and alarms so that some are ignored?How are these problems overcome? 1. No - Only important messages and alarms are kept, so there will be no neglecting possible. 2. Yes - Use of two people helps to overcome problems when the extra person is available. 3. Yes 1. Establish higher threshold for emergency alarms. 2. Have some data indicated, not alarmed. 3. Hardwire really critical alarm. 4. Training employees. 4. Yes - Added a second operator in control room to handle all operations after the reactors. In another plant the supervisor assists the operator. 5. Yes - We are constantly working to eliminate unecessary messages and redundant alarms to reduce the amount of information being fed to the operators. 6. Yes 1. Revised program to reduce number of alarm messages. 2. Use separate printers for messages and alarms. 3. Some critical alarm messages are printed with exposed type in order to make them stand out. 5. OPERATOR COMPLACENCY A) Have you had any problems with operators relying too heavily on the computer to correct all mistakes? How are these problems overcome? 1. No - Cross checks by operators are inserted at important locations. 2. No 3. A- No B- Yes - have mandatory log sheets to record reaction to alarm. 4. No - Not since instituting manual operations once per month. 5. No 6. Yes - Diligent follow up on all incidents (major and minor) where mistakes using the computer are made. Operator making mistake is counseled and other operators are informed. GENC 015522 Page 8 of 11 6. MAJOR PROGRAM REVISION SIMULATIONS A) Do you perform any plant-scale simulations when major program revisions are made? 1. No 2. On start-up we provide dummy batches to walk through the program. 3. No- Except water batch tests. 4. No 5. No 6. Yes - Charge full batch quantities of water, VCM, and all additives except catalyst. Use catalyst solvent to simulate catalyst. Simulate alarm conditions, including emergency shortstop. Period lasts from 1 to 3 days. 7 OPERATOR/SUPERVISOR PROGRAM VARIABLE CONTROL A) Do you use an operator/supervisor control key to limit changes to program variables through the CRT? 1. No 2. Yes - Key switch 3. Yes - Many are not accessible to operators. 4. No 5. Yes 6. Have key - but do not use it. <V&6` B) How do you limit program variable changes by operating? 1. 2. Some parameters cannot be charged from CRT - engineer has to charge (key-switch). 3. Yes - written authorization and record. 4. Through directed operator CRT keyboard function. GENC 015523 Page 9 of 11 < 5- By requiring them to obtain permission and key from supervisor. 6. Program variables are changed by engineers. Have not had problems with operatiors changing program variables. Had some problems with operators tampering with FLAG changes in order to get programs to run. Educated operators to high danger of this and revised programs for better operability. 0) How do you change formulation variables, such as catalyst and suspending agents? 1. No operators are involved in recipe changes. 2. Done with consultations with process engineering group through supervisor. Engineer normally makes changes. 3. By CRT, but only as written authority. 4. Process Control Engineer or Shift Supervisor accomp-. lishes through CRT keyboard. 5. We have programs that allow operators to change the amount of ingredients used within certain limits and this is not a permanent change. Permanent changes to recipes are made by the programmers on request from the technical group. 6. Formulation page has variables which can be changed from CRT entries. The change must be input twice in order to be accepted. CRT changes are valid for one batch only. Long term formulation changes are made by engineers. 8. REACTOR CHARGE VOLUME CONTROLS A) If you have primary and secondary measurement devices on charge quantities, how do you allow operator acceptance of deviations between primary and secondary devices? 1..0nly one measurement is present. 2. Yes - Deviations are questioned by operators, and supervision makes decision. Also process engineering can be consulted. 3. Computer queries, then operator must get visual field verification before proceeding. 4. Variance limits set, but Shift Supervisor has some discretion if barely over limit. GENC 015524 Page. 10 of 11 5. We have no secondary measuring devices. 6. Deviation during charge ~ steps charge, operation must repair problem or deselect one of devices. Deselection procedures are written, with accept able limits. On some chemicals, high value is accepted, on others, low value is selected. 9. VALVE STATUS INDICATIONS 07' /V '/ A) How do you handle problems with valve status indicators, such as microswitches? Do you override the computer hold or alarm, or do'you manually adjust in the field on each batch? 2. a) We override only after"manually checked" in field, b) Adjust in field if problem persists. 3. Allow override after field inspection, then write ASAP work order. 4. Device is visually checked in the field before over riding computer hold status. Device is not operated post next work day without repair. 5. If a position indicator fails (valve in the proper position and in contact with switch) an "override" can be placed on the device by using the "supervisory key" until it can be repaired by the I & E Group. 6. Diligent maintenance is required to keep micro switches in good condition. Use override and manual field adjustment to overcome problems. Neither is an acceptable solution, but is necessary for operation. Repeat that follow up on problems must be prompt and diligent. 10. PLEASE DESCRIBE OTHER.COMPUTER-RELATED SAFETY PROBLEMS OR INCIDENTS AND HOW YOU RECOMMEND TO CORRECT THEM. 2. Operators do not always respond to computer initiated emergency type alarms - Computer print-out is reviewed duly by process engineer and recommendations made to production - Training sessions W/operators helps. 3. Preparing thorough fault-free analysis of computer operations on corporate basis. GENC 015525 Page li of 11 4. None 5. In some instances, operators in the field have resorted to manipulating the instrument to process transducers (I to P's) by hand to force a valve or device to move contrary to computer command. This is a rather simple procedure that, only involves unscrewing the cover and using a finger, nut, bolt, rock or some other object to hold the pneumatic switch in the desired position. Our solution to the problem was to make this act a severe violation of safety procedure with resulting severe penalties for violators. Since instituting this policy, we have had no futher problems. 6. GENC 015526