Keywords

1 Introduction

1.1 Generational Differences in Control Rooms

Industries like chemical, manufacturing, oil and gas, and energy involve multiple simultaneous processes. When multiple systems converge on a large scale, the process control facility may be said to be a plant, with designations as diverse as a chemical plant or a power plant. Typically each plant requires a control room as a central place to coordinate and control processes. While a control room may feature significant automation, operators still oversee the process from the control room, ensuring normal production and monitoring for anomalies, including threats to safety. Safety considerations become paramount, as a system malfunction can lead not only to equipment damage but also to harm to the environment or people at or near the plant.

Control room technology requires remote sensors and actuators, which rely primarily on electrical-mechanical components. While plants were possible without these technologies, the centralized control room was enabled with the advent of electrical gauges and switches in the 1920s [1]. Large ships are good examples of the emergence of control rooms. Steamboats brought the separation of engine room below deck and the bridge above deck. The captain or pilot set the speed and direction of the engine using the engine order telegraph, in which the captain’s setting was mirrored in the engine room. Changes to the dialed position were accompanied by audible bells in the engine room to alert the engineers that they needed to change the engine speed or direction. Status indications between the engine room and bridge were also possible through telegraph, telephone, or intercom. As remote sensors and remote-controlled switches became available, the bridge was equipped with gauges to allow direct monitoring and provide direct control over the engine or other facets of the ship. The role of the ship’s engineer shifted from that of control and maintenance of the engine to primarily maintenance of the engine. The control room eliminated the need for redundant personnel to relay status or control information.

1.2 Analog Control Rooms

Beginning in the 1940s, analog control rooms began to take root. The term analog is used to describe the human-system interaction used by the operators and may not necessarily apply to the technologies behind the board. Several standard characteristics of the centralized control room emerged. These included:

  • One-for-one arrangement. In traditional analog control rooms, each instrument or indicator is directly wired to an equivalent sensor, and each control is directly wired to an actuator in the plant. There are no shared conduits or channels of information, and there is no aggregation of information or controls.

  • Simple indicators. These indicators provide information about a single parameter like pressure level, flow rate, or temperature. Alternately, they may represent simple on-off logic like the status of charging pump or an alarm setpoint. The defining characteristic of these indicators is that they do not combine information from multiple sensors that would require computational logic or mathematical functions. Operators must integrate multiple indicators to assess the state of the plant.

  • Stand-at-the-boards operation. While simple control boards were possible from a seated position, as additional instrumentation and controls (I&C) became available, it became necessary to expand the real estate of the boards vertically upward and horizontally outward. This arrangement eventually necessitated standing for some operations. The placement of some instrumentation higher vertically allowed monitoring supervision from across the control room.

  • Triple-layer design. As noted, the control boards grew from operation for a seated to a standing position. A standard control layout evolved from this practice in which controls tended to be mounted low on the boards, often in a desk-like horizontal benchboard configuration. Above the desktop, a vertical panel comprises the second layer containing key instrumentation required for monitoring and control decisions. Finally, higher up the boards were found alarm lights. In this manner, immediately required information was close to eye level of the standing operator, and controls were within arm’s reach. Information such as alarms, needed only at the level of catching the operator’s attention, was placed high on the boards.

  • Setpoint alarms. With remote sensors came the technology for setpoint alarms. These alarms were triggered when a particular measured entity reached a particular threshold, e.g., when a pipe exceeded the maximum recommended operating pressure. The threshold setpoint activated a light in the control room, which either contained a label near it or was placed in a lightbox with illuminated text upon activation. Additional features like audible alarms, flashing alarms, and silence buttons were added to the configuration, but the alarms continued to be based on the simple threshold setpoints.

  • Simple controls. These controls are tied to a single function, usually equivalent to an on-off switch to activate a motor that in turn opens or closes a valve or pumps fluids. Typically, a control does not activate a series of sequential controls nor perform simultaneous parallel control actions. These simple controls may feature electrical or mechanical lockouts to prevent erroneous activation (e.g., turning on a pump to remove fluid when another pump is injecting fluid), and they may feature auto-stop for when a particular state (e.g., full valve open) is achieved. The controls may also feature two-factor confirmation such as when two buttons are required to be pressed simultaneously to close the circuit for emergency shutdown. In the latter case, because the consequences are high (e.g., cost of lost production or potential loss of equipment by sudden shutdown), the lockout serves to safeguard against inadvertent activation.

  • Manual operation. Mechanical safety actuations like pressure relief valves, shear points, and electrical fuses were possible, but the control room did not feature automation. The plant was controlled entirely by the operator. A characteristic of much of process control is the achievement of steady state operations, which require minimal adjustment by the operator. However, plant transients might require extensive adjustments in prescribed sequences.

  • Procedures. While procedures may not be part of the physical characteristics of the control room, they were increasingly required to support operations and maintain the plant within a known safety envelope, especially during transient conditions where the sequence or prioritization of particular actions was important. Eventually, e.g., in nuclear power plant control rooms, procedures became such an integrated part of the control room that special places were set aside to house the procedures within or around the control panels.

  • Command-and-control crew operation. As the complexity of the plant process grows, the need for multiple operators likewise increases. As such, complex plants often required more than one operator. When there are multiple operators, there may be a supervisor to orchestrate actions and maintain process overview while operators monitor and control subsystems. Thus, while an individual operator may be involved in the minutia of controlling one particular system, the supervisor maintains situation awareness for the overall process. In some arrangements, the supervisor may also be in charge of issuing directives to the operators, establishing a command-and-control arrangement. Many plants have adopted a threeway communication protocol in which the supervisor issues a command or request, the operator repeats it back, and the supervisor confirms the operator has correctly understood the communication.

These features are not mutually exclusive, nor are they a template that is found in all analog control rooms. They simply serve as a reference set of features commonly observed in analog control rooms.

1.3 Digital Control Rooms

The introduction of digital technologies to the human-system interfaces within control rooms has fundamentally changed the features and functions of control rooms. Digital control rooms may feature [2]:

  • Multipurpose displays and soft controls. A distributed control system (DCS) features one or more displays with input capability such as a mouse, trackpad, or touchscreen [3]. These displays may, in the architecture of the DCS, be toggled between different system function screens. As such, it is not necessary to have all information displayed simultaneously across the boards, as a single display can present distal information at one physical location. The input device likewise features remote control from a single location by providing virtual or soft controls tied to the particular screen on the display.

  • Information integrative indicators. Automation may take the form of information automation and control automation. Information automation combines disparate information that operators would otherwise have to gather and assemble to draw a conclusion or maintain overview. With the highly distributed nature of information in analog control rooms, operators often needed to ping-pong back and forth to maintain situation awareness of processes. Digital displays can consolidate information that would otherwise be widely dispersed across the boards. Moreover, digital displays can provide aggregate views that support the operators, e.g., custom trend displays of key parameters or calculations of composite measures (e.g., overall loss of cooling rate given a failed cooling water pump) that would normally be performed manually by operators or technical support staff in the control room.

  • Complex or automated controls. As noted, digital controls no longer require a physical switch on the control boards, as they can be controlled remotely through the DCS using soft controls available on the screens dedicated to each system in the plant. The control functions do not need to be linked to a single action, and it is possible to combine a chain of actions for each soft control. In some plants, for example, it is possible to have single-button startup or shutdown sequences without the need for ongoing human intervention. These features are a form of automation; it is also possible to have full automation for large facets of plant operations.

  • Console or workstation operation. Digital control rooms often forgo panels because of the space efficiency and convenience of consolidating I&C on the DCS displays. With the advent of DCS workstations, the need to stand at the boards is diminished, and the workstations are often designed for seated operators. Some backup panels may be retained for safety in the event of DCS failure, but most DCS architectures feature redundant hardware and the ability to pull up any screens from any display. Thus, in the event of failure of one operator workstation, the operator could simply go to a backup workstation and resume the full range of process control for the plant.

  • Overview displays. The triple-layer design of analog control boards is no longer required when most monitoring and control take place from a desk. However, because digital monitoring information is localized to the individual operator, it is desirable to have a shared frame of reference in the control room. Overview displays, in particular large overview displays [4], provide a way to monitor overall plant status that may not be possible with system-specific screens. The overview displays also enable troubleshooting between operators and supervisors in the control room by ensuring all parties have the same visual information during group discussions. Overview displays do not generally allow control actions and therefore serve only the function of providing visual indicators to aid operators.

  • Advanced alarm systems. By adding control logic beyond the simple alarm thresholds found in analog alarms, it is possible to add significant functionality to alarms. For example, it is possible to exercise state dependence, by which only alarms relevant to a particular mode of operation are enabled. This feature overcomes the problem of alarms for steady state operations activating during startup or shutdown. Further, it is possible to implement alarm grouping, such that only a single alarm activates when a whole group of interrelated alarms might activate otherwise. Because process control often involves a sequence of activities, failure in one part causes a cascade of failures and corresponding alarms, which can result in an alarm flood that obscures the root fault. Other advanced alarm features include prioritized alarms that indicate severity to allow operators to take quick action in the event of multiple faults, prognostic and predictive alarms that anticipate faults, and advanced visual alarms that depict the fault in such a manner that the operator is able unambiguously to see the fault in context.

  • Single operator control. Whereas analog control rooms often required multiple operators performing actions under direction of a supervisor, DCS technology provides the operator with the ability to perform actions independently. Features such as computer-based procedures eliminate the need for a supervisor to coordinate procedures. Additional features like automation reduce the need for constant operator vigilance and may reduce the need for multiple operators. Thus, advanced digital control rooms often yield a greatly reduced crew complement, sometimes resulting in only a single operator to oversee a large plant.

As with analog control rooms, it must be noted there is no prototypical digital control room, and different features will likely be present for each particular implementation. An important consideration for digital control rooms is that they chronologically are newer and have benefitted from the nascence of human factors engineering applications in control rooms [5]. Human factors has resulted in improved design to the flow of activities in the control room, presentation of information to operators, and workflow of the operators. The marriage of automation technology, advanced visualization capabilities, and human factors optimization have resulted in significantly improved control rooms compared to their predecessors.

1.4 Control Rooms in U.S. Nuclear Power Plants

Idaho National Laboratory (INL) is engaged in human factors research in support of control rooms for the U.S. energy sector. Much of this work centers on nuclear power plant applications, where there is a twofold mission to modernize the control rooms of existing plants [6] and to develop new control room concepts for advanced reactor designs like small modular reactors [7].

The existing U.S. fleet of commercial nuclear power reactors is aging, and many plants are drawing to the end of their original 40-year operating license. While some utilities have chosen not to extend the license of a plant and commence decommissioning, in the vast majority of cases, the utilities that operate the plants are choosing to apply to the U.S. Nuclear Regulatory Commission to extend the operating license by another twenty years. The initial operating period was fully anticipated, and utilities stockpiled replacement parts to ensure safe and reliable operation. Replacing worn or broken components with equivalent components also ensured that the plants successfully operated within their original licensing basis without potentially requiring license amendments to accommodate the introduction of new technology. With license extensions, the plant may find itself nearing the end of useful life for existing equipment or at the point where the cost of refurbishment or like-for-like replacement parts exceeds the cost of new equipment. At this point, the utility is confronted with the unique problem of finding new equipment that serves the same function as existing equipment and determining if the new equipment fundamentally changes the conduct of plant operations such that a license amendment might be required.

INL supports efforts to modernize nuclear power plant main control rooms, featuring a stepwise, system-by-system upgrade path [8]. This path results in a hybrid control room consisting of a mix of analog-mechanical and digital I&C. Although the term digital island is sometimes used pejoratively to describe the introduction of limited digital systems into existing analog control rooms, the first DCSs introduced to the control boards are an important stepping stone toward fully digital control rooms. The feasibility of performing a large-scale control room replacement is explored in [9], and nuclear utilities indicate that they are unlikely to be able to replace the entire control room at one time due to loss of revenue during the extended outage required for such a control room replacement [10]. Instead, the utility undertakes a gradual upgrade process, typically consisting of one system or board per refueling outage. INL has designed the Guideline for Operational Nuclear Usability and Knowledge Elicitation (GONUKE) [11] to provide a process suitable for design and evaluation of new digital systems that are introduced to the control boards.

An analogous design transformation can be seen in commercial airplane cockpits, which have seen the significant introduction of new digital controls. Initial efforts resulted in the insertion of retrofitted multifunction displays into the cockpit to replace existing analog I&C. In most cases, the multifunction displays added avionics functionality to aid the pilot, from digital pitch and roll data, to navigation functions, to weather and airspace, to autopilot, to collision avoidance systems. Retrofitted cockpits offer different levels of digitization, from hybrid avionics to completely digital glass cockpits.

Control rooms for new nuclear power plants subscribe to many of the features indicted in Sect. 1.3 of this paper. There exist some regulatory barriers to full adoption of all features found in other industries. For example, the heavy emphasis on safety has resulted in the requirement to maintain crew staffing levels analogous to analog control rooms. Additionally, the need for transparency in control logic has resulted in minimal intelligent or autonomous control. Examples of three generations of nuclear control rooms are depicted in Fig. 1.

Fig. 1.
figure 1

Three generations of nuclear power plant control rooms (top to bottom: EBR-1, the first nuclear power plant with an all analog control room; recently decommissioned San Onofre Nuclear Generating Station, with a hybrid analog-digital control room; HAMMLab at Halden Reactor Project, a fully digital advanced control room concept).

Full size image

2 The Need for New Visualization in Control Rooms

The previous sections provide extensive background on the different types of control rooms. Conventional analog control rooms, such as those commonly found in nuclear power plants, represent information in a parallel fashion, typically with a one-to-one mapping of sensors to indicators. This design approach requires extensive control room real estate, especially for complex control system processes. As digital control systems, such as those found in modern control rooms for electrical grids or gas distribution networks, have begun to replace analog I&C, they have afforded the opportunity to use common displays across all systems, thereby providing a smaller footprint in the control room. The approach often uses a nested navigation scheme, whereby control operators have on-screen windows for particular subsystems.

Both approaches represent tradeoffs. For analog control rooms, operators must scan across control panels to maintain their plant overview, a complex process that demands the operators to integrate and track multiple simultaneous indicators. This disadvantage is offset by the ability to see all information at once, thereby minimizing the danger that critical indicators will be hidden in nested windows. In contrast, for digital control systems, the operators are able to avail themselves of optimized displays, including key parameter displays. However, having information consolidated on single windows may result in loss of situation awareness by these operators, as critical windows must often be toggled back and forth, thereby reducing the overview the operator may have of the larger process being controlled.

The shift to digital control rooms is inevitable, whether performed as a stepwise upgrade process or as a complete control room replacement. Successful deployment of digital technology in control rooms requires effective ways to display crucial indicator information to operators in order to allow them to monitor plant status and diagnose problems. To combat the loss of situation awareness inherent in nested displays in process control, designers of DCSs have developed overviews, often displayed as large overview displays, viewable by multiple operators across the control room. The challenge with such displays is they do not inherently reduce the problem of information overload that confronts the operator of a complex system. Design techniques for representing information in an intuitive manner help to reduce the workload in processing key information, but they do not necessarily reduce the overall amount of information the operator must monitor and process in parallel. The danger is that the operator may miss an important change in a key parameter because of the large number of visible indicators. If such is the case, eventually an alarm will indicate once the parameter moves out of acceptable bounds, but this alarm may come only at the point when remediation is necessary. Thus, the key operator role of monitoring and preventing upsets is not realized.

Several design philosophies have been created for control room visualizations, including ecological interface design (EID) [12, 13], information rich design (IRD) [14], and high performance human-machine interface (HMI) principles [15].

  • EID is a design approach that strives to present the operational constraints in a natural manner for key process parameters. This approach specifically capitalizes on the complex interactions inherent in process control systems by focusing on how to provide operators with sufficient context embedded within a parameter to understand what that parameter is doing and determine where the safe operating bounds are for that parameter.

  • IRD aims to create high information density displays without overloading the operator. The basic design concept consists of muted or so-called dullscreen displays in which only important information is made salient through color. This approach is optimized for process control in that it allows a large number of process variables to be displayed concurrently.

  • Finally, there is high performance HMI. Both EID and IRD produce uniquely identifiable displays. High performance HMI is not so much a single set of design principles as it is a process to infuse a systematic design across the control room. The key elements are adopting a style guide based on human factors principles and deploying that style guide consistently to design or redesign the control room.

EID, IRD, and high performance HMI are not incompatible approaches, and it is possible to use elements of all three approaches in concert. These approaches have yielded effective digital control rooms, but they represent a very small set of the possibilities for control room design. In the remainder of this paper, we present a novel approach to visualizing process control indicators.

3 RevealFlow

3.1 Design for Change Detection

Change blindness [16] occurs when people fail to detect a change in visual stimuli. Change blindness may occur when changes in the visual stimuli are not salient enough to detect, but it may also occur even when the changes are sufficiently salient. A person may be focused elsewhere during key changes, a person may undertake eye movement (i.e., visual saccade) during changes, a person may be overloaded in terms of the number of items concurrently attending, or a person may simply experience perceptual overload. Change blindness and the related concept of inattentional blindness are regarded as sources of error in control room operations [17]. For example, an operator may miss a key plant indicator because he or she is not attending to that part of the boards. In an analog control room, where there may be limited trend displays, the change may, in fact, not be obvious until it reaches a critical level such as an alarm state. Periodic surveillance of key indicators to expected levels helps to minimize the opportunity for such initial misses to generate any consequence to the plant, but such surveillance does not guarantee catching missed changes in parameters.

One of the major tasks of operators is to monitor and detect changes to the plant process. In the case of intended transients to the plant like startup or shutdown, the operator ensures that parameters change at the expected rates and to the expected magnitudes. A key indicator like differential rotor temperature that is too high during startup, for example, has the potential to damage turbomachinery. As another example, a flow rate that suddenly changes in an unexpected manner could be indicative of a leak or blockage in the system. A safety alarm will notify when levels are beyond specified setpoint thresholds, but the operator can play a crucial role in early detection of anomalies in the process. When an operator recognizes a trend toward an anomaly, he or she can intervene before the fault becomes a serious threat to safety, the plant, or the process.

Curiously, despite the centrality of change detection to operators, process control solutions have neither reliably nor effectively helped highlight changes to plant indicators. A proactive display strategy is necessary to help operators maintain process oversight while detecting key changes in indicators. Here, we introduce the RevealFlow visualization framework, an approach that accentuates the operators’ ability to detect changes in the process. RevealFlow consists of four guiding principles:

  1. 1.

    For process monitoring, changes are equally important to steady states. Most control room indicators provide the current state in a numeric depiction, either as an alphanumeric value or as a graphical representation of that value. However, it is often not the current magnitude of the indicator but rather the change in the magnitude that is of interest to the operator.

  2. 2.

    Changes should be apparent at all times. A plant undergoes fluctuations, and these dynamics are important for the operator to be able to see at all times. Changes should be highlighted on the display in a manner that allows them to stand out from steady state values. Small fluctuations within a deadband should be ignored. Larger changes should be visible with their salience proportional to the magnitude of the change. These changes, once highlighted, should remain prominent.

  3. 3.

    Changes occur in historical context. To represent change, it is important to show how the indicator has changed over a period of time. Essentially, changes must be trended visually. Note that trending a change is slightly different than trending an indicator’s value. Change trending captures the derivative of the dynamics vs. simply the history of the indicator.

  4. 4.

    Changes escalate, but their cause does not. A complex process may feature many interconnected systems that can result in a chain reaction when one part of the process is disrupted. Similar to an alarm flood, it is possible that these changes, when simultaneously active, may overwhelm the operator’s ability to detect the most important changes. Process control is “big data,” and preventing information overload requires process information filtering. As such, RevealFlow recommends emphasizing first-out changes and those changes that are of highest priority to the plant.

It should be noted that these principles represent a design philosophy, not a prescriptive design style guide. A translation of these principles into example designs for process control systems is provided in the next section.

3.2 Examples of RevealFlow

RevealFlow is being implemented in the Computerized Operator Support System (COSS) [18], a digital operator aid that provides ongoing process monitoring in control rooms. Currently, COSS is installed in the Human Systems Simulation Laboratory [19], a full-scope nuclear power plant control room simulator facility at INL. COSS consists of a DCS with an advanced HMI frontend and intelligent process diagnosis (PRODIAG) system backend [20]. PRODIAG acts as a detection engine to determine changes to modeled parameters. Confluence equations serve to provide unit-neutral metrics of change ideally suited to process monitoring. RevealFlow represents an effort on behalf the authors to provide a usable visual representation in the COSS HMI for the change monitoring in PRODIAG.

The visualization scheme borrows from EID and IRD. A simple example is provided in Fig. 2. As currently envisioned in COSS, RevealFlow begins with a dullscreen visual outline of key parameters. Light-colored indices are displayed as grey graphs arranged along a functional piping and instrumentation outline. As indicators change, they are highlighted on the graphs such that they become readily visible to the operators. A greyscale gradation to the steady state of the indicator allows the operator to see the change over time, while a color highlight indicates an alarm state. RevealFlow is able to address the issue of large data visualization by only highlighting changes. When integrated across an overview display, the RevealFlow graphical elements create a muted backdrop for in-range indicators, only drawing attention to important changes. Gradual, slow drift changes are greyscale and less salient, while rapid shifts are highlighted with color.

Fig. 2.
figure 2

Three examples of RevealFlow bar graphs indicating an elevated state relative to the setpoint (left), a low alarm state (middle), and a normal state (right). The greyscale gradation allows a temporal trail, which represents time information trending not typically represented outside line graphs. An arrow overlaid on the graph draws attention to changing indicators. On the far right, there is a pie chart illustrating the concurrent change in three related systems.

Full size image

4 Conclusions

Existing control rooms—whether analog, hybrid, or digital—represent strategies for capturing plant process data for monitoring by the plant operators. Rarely do these strategies help operators focus on arguably the most important aspect of the plant processes, namely those processes that are experiencing change, especially those with rapid shifts. RevealFlow presents a design approach centered on simplifying the display of information to highlight process dynamics rather than process states. RevealFlow is being implemented in COSS, and new graphical visualizations are ongoing. The culmination of RevealFlow will be the evaluation of the effectiveness of the RevealFlow designs benchmarked against other control room technologies. It is hypothesized that RevealFlow will simplify monitoring of complex processes. RevealFlow therefore represents a significant shift in concept of operations and will require extensive evaluation to ensure the efficacy of the design principles. Change is constant in process control; perhaps RevealFlow will prove a worthy change to control rooms.