Audit of human-machine interface and information presentation - Alvheim FPSO

The audit was performed in Marathon’s offices at Hinna in Stavanger.

The audit was particularly focused on auditing Marathon’s work to safeguard good screen image design and verifying alarm system functionality and alarm presentation on Alvheim FPSO in relation to relevant regulatory requirements and recognised standards.

Favourable HMI conditions (human-machine interaction) can reduce the probability of human error in the control room.

The audit was performed through presentations, interviews with project personnel and review of relevant governing documents.

Furthermore, we received a presentation of screen image design on the Alvheim FPSO training simulator and a review of Marathon’s simulator training plans.

Marathon facilitated the audit well and the involved parties contributed in an open and positive manner.

Background
The background for the audit is the PSA’s 2010 prioritisation relating to follow-up of technical and operational barriers to prevent the occurrence and development of major accidents.

In this context, the regulations require there to be systems and procedures for mapping barrier functionality, including routines for regular verification of barrier performance (barrier soundness) to ensure that the barriers are functional and effective at all times.

The manner in which process information and alarms are presented, together with the control room operator’s surveillance and management of the facility through the operator interface, constitute significant barriers for preventing and limiting dangers and incidents. The follow-up of HMI conditions will therefore be an important element in ensuring that the aforementioned barriers function effectively and as intended at all times.

The audit focused on following up Marathon’s work on correcting the non-conformity in relation to Section 20 of the Facilities Regulations relating to man-machine interface and information presentation.

This non-conformity, which was identified by the PSA in 2007, pointed out deficiencies connected to information presentation in screen images and graphical user interfaces in the control room on Alvheim FPSO.

Marathon has received, following application, an exemption deadline of 1 April 2010 to correct the non-conformities.

Furthermore, Marathon itself has identified weaknesses in the human-machine interface and information presentation in the control room on Alvheim FPSO in connection with reviewing the flare incidents in 2009.

The regulatory basis for the audit includes Sections 1 and 2 of the Management Regulations relating to risk reduction and barriers, respectively, and Section 20 of the Facilities Regulations relating to man-machine interface and information presentation.

Purpose
The purpose of the audit was to have Marathon’s work toward meeting regulatory requirements in this area presented and demonstrated, in addition to following up measures following the two flare incidents on Alvheim FPSO in January 2009.

The audit had four main themes:

• Execution of the upgrade project, including clarification of responsibilities, roles, mandate and execution of the respective activities.
• Screen image design on the operator stations and information presentation on other graphical user interfaces, including large screens.
• Alarm presentation in the control room and verification of the alarm system’s functionality in relation to regulatory requirements and recommended guidelines.
• Status of actions following the flare incidents in January 2009.

Result
Marathon has, in cooperation with the involved players (Maersk, Apply Sørco, Human Factors Solutions, Kongsberg and Petrolink), performed an extensive improvement project in connection with HMI, alarm and information presentation in the control room on Alvheim FPSO.

Our impression is that the project work has been closely followed up by Marathon management and the company seems to have actively taken the necessary resource actions to meet the project’s goals of favourable HMI conditions in the control room on Alvheim FPSO.

We find that the performed project work is based on regulatory requirements and recognised standards for HMI, screen image design and alarm presentation.

According to “HMI Verification & Validation (V&V) Report” carried out by Human Factors Solutions, a few circumstances have been identified which warrant modification work beyond the non-conformity deadline of 1 April 2010. These are conditions which Marathon will address and follow up.

The project execution has been much more extensive than initially anticipated. Substantial work remains before the non-conformity is corrected.

During the audit, one non-conformity was identified in relation to regulatory requirements for barrier follow-up and one improvement item relating to employee participation.

Marathon provided a briefing on the status of actions following the flare incidents in 2009. We have no comments regarding the presented material.

Non-conformities

Barrier management: Adequate performance requirements and routines for regular measurements of HMI quality in the control room had not been established.

Basis:

• Adequate measurable performance requirements were not established in relation to key circumstances relating to the control room personnel’s work situation, HMI and alarm presentation in the control room to safeguard effective barriers against accident incidents.
• The alarm philosophy document established some performance goals (“guidelines for performance”) for the alarm system. The performance goal (“Repeating alarms: Target < 20% of alarms shall be repeated every 5 minutes both in normal and disturbance modes of the plant”) does not seem to be precisely worded and complicates testing and measurements. If this goal can be interpreted as allowing up to every fifth alarm to be repeated, it is not considered very ambitious.
• It was unclear how Marathon had quality-assured the alarm philosophy document and committed itself to meet these performance goals. As an example of deficient quality assurance, reference is made to the alarm philosophy document where it becomes evident that the definitions used “... are as defined in NPD (PSA); Principles for alarm systems YA 710/711”. For example, this is not true for the term “Suppression”.
• Formalised routines for measuring performance of HMI conditions in relation to Marathon’s management system had not been established.
• The establishment of a strategy and guidelines for the use of large screens to present important information in the control room remains outstanding.
• A suitable alarm analysis tool to identify any weaknesses in the alarm system and to verify the alarm system in relation to specified performance requirements is lacking.
• It follows from Petrolink’s “Dynamic Alarm Review no. 2” and the interviews that the current alarm system does not meet the regulations’ expected level of alarm system performance.
• It is unclear whether the safety assessment of the current alarm load has been formally reviewed and presented to relevant decision-makers.
• We have been informed that a proposal is pending which relates to the establishment of routines for monitoring alarm performance and the procurement of an alarm analysis tool; cf. “Technical Modification Request (TMR) ALV/PRJ/047”. The goal is to obtain a more effective analysis tool which would make it possible to identify any weaknesses in the alarm system and help ensure the system meets the established performance goals. The modification proposal has not yet been addressed by Marathon.

Improvement items

Planning and management of employee participation in the project: Deficient planning and management of employee participation in the improvement project.

Basis:

• There has been active involvement on the part of control room personnel in the project to ensure that the solutions are adapted to the operator’s needs in different operations situations, but it was noted during the audit that employee participation in the project could have been planned and managed in better way. In particular, there was a call for clearer resource clarifications in connection with time spent on the project and a more clear delineation between project work and regular tasks as the Alvheim FPSO operations operator during the project period.
• The control room operators could not always follow the original plans for participation in project work due to covering for other operators on Alvheim FPSO in cases of sickness/absence. This may have contributed to delaying progress on the project.
• There does not seem to be an established written mandate for the task of designated employee representative in the project or a plan for employee participation.

Other comments
Marathon has, in cooperation with the involved players, conducted extensive improvement work in connection with HMI, alarm and information presentation in the operator stations in the control room on Alvheim FPSO. As the project moved forward, the work turned out to be much more extensive than previously anticipated. This has caused the project to draw out and involve much more personnel resources than originally planned. Work is still outstanding for correcting the non-conformity.

The development of an alarm philosophy document and a document describing overall principles and guidelines relating to developing HMI conditions in operator stations in the control room have been key parts of the project execution. These two documents have contributed to securing a uniform HMI and screen image design across the different systems in the control room. The documents will be important for continuing the same HMI principles in the further life of the facility.