hmi and industrial computers - controlglobal.com · 2019. 5. 10. · ansi/isa-101.01 discusses...
TRANSCRIPT
eHANDBOOK
HMI and Industrial Computers
TABLE OF CONTENTSDefine and refine HMI requirements 4
How to question users, organize tasks, think clearly, and design effective human-machine
interfaces.
The brittle panel 15
What’s it worth to be able to touch old wiring without inadvertently causing an incident?
Device protection 18
It’s easy to make small and costly mistakes when specifying and applying enclosures.
What’s holding back mobile HMI 20
Progress in industrial deployments is slow for good reasons.
Safety for screens 22
As they multiply on tablet PCs and smart phones and show up in hazardous
settings, HMIs and their controls need intrinsic safety (IS) and other protections.
AD INDEXAcromag • acromag.com 17
Proface • www.profaceamerica.com 8, 13
Red Lion • www.redlion.net 14
Rittal • rittal.us 3
www.controlglobal.com
eHANDBOOK: HMI and Industrial Computers 2
RITTAL SHIPS QUICK!Made in the USA
www.Rittal.us (800) 477-4000
Built Tough.How tough is the TS 8 Modular Enclosure from Rittal?Tough enough to support 1500 pounds—about the weight of a young Sumatran rhinoceros.
Tough is…n a carbon steel base and zinc-plated carbon steel mounting paneln a 16x steel folded framen a durable, rugged corrosion-resistant finishfromour3-stepcoatingprocessn a unique frame structure that delivers 15% more mounting surface
12 million customers in 12 years can’t be wrong—they’ve made TS 8 the No. 1 industrial enclosure, worldwide!
www.controlglobal.com
eHANDBOOK: HMI and Industrial Computers 4
Industrial human machine interface (HMI)
has been a lively topic of discussion and
development for decades. The Abnormal
Situation Management (ASM) style started in
the 1990s with the ASM Consortium (www.
asmconsortium.net). ASM style evolved, and
the best-practice HMI gained a series of names,
including different spellings of “high“ perfor-
mance, etc. Many names were trademarked by
different parties, including ASM style.
The ANSI/ISA-101.01, Human Machine Interfac-
es for Process Automation Systems standard
was published in 2015. Its most significant con-
tributions were the introduction of a lifecycle
to manage the entire HMI, and a common set
of terms and definitions for HMI components.
As standards and guidelines developed, tech-
nology evolved and open systems platforms
matured, enabling HMI capabilities to become
quite advanced. Research into presenta-
tion formats, color selection and interaction
methods led to a common set of concepts for
best-practice HMI presentation, performance
and interaction. However, methods to de-
termine the content of an entire HMI or even
one screen are not as defined in industrial
settings. In my experience, some of the best
methods to define and refine requirements
for HMIs include using questionnaires and
interviews, Level 1 and 2 workshops, story-
boarding and more advanced methods.
FOUR HMI LEVELS ANSI/ISA-101.01 discusses different naviga-
tion methods and display styles. For the
examples below, it’s assumed a hierarchi-
cal navigation design will be used. and that
most displays will be Level 1, 2, 3 or 4. For
Define and refine HMI requirementsHow to question users, organize tasks, think clearly, and design effective human-machine interfaces.
by Bridget Fitzpatrick
www.controlglobal.com
eHANDBOOK: HMI and Industrial Computers 5
this discussion, the following general defini-
tions of levels apply:
• Level 1 displays are overviews for monitor-
ing span of control;
• Level 2 displays are operating displays for
major areas of the span of control;
• Level 3 displays are detailed displays used
for general troubleshooting; and
• Level 4 displays are auxiliary displays used
for focused troubleshooting or intermit-
tent task support.
WHAT ARE HMI REQUIREMENTS?Defining an HMI’s requirements may seem
straightforward. A well-designed HMI phi-
losophy and style guide will set the pre-
sentation formats and interaction meth-
ods. However, how the objects on the
screen behave is only the first step in an
effective HMI. Other key concepts include:
scope of each display; navigation hierar-
chy and methods; support for all modes
of operation; online or offline help; links to
procedures; and requirements related to
user roles and account privileges.
Consider a simple demineralized (demin)
water tank with a set of three pumps, au-
to-started on pressure control, with a re-
cycle loop (Figure 1). Its HMI needs seem
likely to be rudimentary—it’s just a water
Demin water storage
DeminI102
P-77672 gpm
TK102
P-7675.2%
99.2 °F
7.1 pH
Highrecycle
87.3 A87.2
27%
P-102A
P-102B
P-102C
Standby
Users
DeminI102
672 gpm
TK102
75.2%
99.2 °F
7.1 pH
87.3 A87.2
2%
P-102A
P-102B
P-102C
Standby
0.3 μS/cm
Pharma
Users
123
CertifiedIn: 673 gpmOut: 443 gpmHrs to fill: 21
TANK AND PUMP DETAILSFigure 1: A simple demineralization water tank with three pumps, auto-started on pressure control with a recycle loop, might seem to only need a simple HMI displaying its instruments and controls. However, questionnaires and operator interviews may show that pump auto-starts push operating costs over budget, requiring the HMI designer to add an alert, alarm or "high recycle" advice. Obser-vation may also show tank level having an interlock to an incoming block valve, so that detail may be added to the display. Source: Wood plc
www.controlglobal.com
eHANDBOOK: HMI and Industrial Computers 6
tank. The tank instruments and regulatory
controls need to be displayed. The device
controls for the pumps must be available.
What else could there be?
USING QUESTIONNAIRES AND INTERVIEWSUsing questionnaires to get the opera-
tions team thinking about the HMI can be
a useful first step, though generally it’s
not the only interaction required to define
requirements. The most effective use of
the questionnaire is in combination with
face-to-face interviews or workshops with
a representative set of users. The pre-work
related to the questionnaire will help guide
the discussion or workshop.
The same process can be used to derive
requirements for existing or new process
operations. For existing displays, the ques-
tionnaire can target displays in use. For a
new process, past experience with similar
processes, process and instrumentation
drawings (P&ID) and process flow diagrams
(PFD) can be used as source documents.
Some of the questionnaire will be focused
on the overall process and the entire HMI,
while other sections will focus on key oper-
ating displays and key performance indica-
tors (KPIs) for the process. Key topics for
questionnaires include:
• What parts of the process are operated
together, and when are multiple displays
used together (and result in constantly
swapping back and forth between dis-
plays)?
• Are there different modes of operation that
require different monitoring and controls?
• Are there special HMI needs related to loss
of utilities, such as instrument air, power,
steam, etc.?
• Could additional pieces of information be
shown?
• Would on-demand access to additional
information speed operations team re-
sponse?
• For existing facilities, what’s the worst day
related to the proposed display?
• For new facilities, what’s the most severe
process risk related to the proposed dis-
play scope?
Key results from the questionnaire pro-
cess include setting the scope of the
displays and identifying additional content
for the displays. Major modes of operation
and significant areas of impact related to
loss of utilities may also be identified.
Display scope: Displays often roughly match
the boundaries of existing P&ID drawings,
but P&IDs weren’t drawn with operability or
safety in mind, so they’re unlikely to have
the correct scope. Over time, other salient
information was likely added, though often
not in the best location or context. Defining
the best scope of a display is critical man-
aging the underlying process. The interview
focuses on how the process is operated.
www.controlglobal.com
eHANDBOOK: HMI and Industrial Computers 7
The first observation may be that the simple
water tank by itself is not a good scope for
a major operating display. In this scenario,
the tank is part of an integrated demin
water system. It’s the main storage for the
demin water and supplies the rest of the
facility. If the tank level and the distribution
pressure are not in alarm, the operations
team isn’t terribly interested in the tank by
itself. As such, key information from the
tank must be shown on related displays that
are monitored continuously. This identi-
fies that the example display may exist as a
Level 3 detail display, or that it needs to be
combined with other portions of the pro-
cess into a Level 2 display.
Display content: Discussion of prior upsets
may indicate that operations of the three
common pumps isn’t clear. Depending
on user demand, only one or two of the
pumps remain in operation.
Further discussion may indicate that cost
of operation often exceeds budget, com-
monly when a pump auto-starts and then
stays online when not needed. Adding an
alert and/or advice on the display when
this condition is detected will help the op-
erations team manage the budget. If the
cost concern is significant, an alarm may
be configured; in Figure 1, a “high recycle”
advice is shown. This could alternately
be sent to an operator alert or message
system.
Observation also noted that tank level has
an interlock to an incoming block valve, so
that detail is also added to the display. It’s
also likely that the tank would be blanketed
with nitrogen and vented on high pressure.
This blanketing may or may not be instru-
mented, depending on design.
STORYBOARDING WORKSHOPA storyboard is a graphic organizer that
uses either labels or images arranged in
sequence for the purpose of pre-visualiz-
ing an overall system. The storyboarding
process was developed at Walt Disney
Productions during the early 1930s.
The storyboarding workshop applies this
general Disney concept by organizing
graphics into a visual structure using ex-
isting display images, new P&IDs or PFDs,
a whiteboard, or a wall with Post-it notes.
The operations team reviews the scope of
each existing display and/or identifies the
scope of new displays on new engineering
drawings.
As the storyboarding team reviews the
structure, focused questions are used to
prompt storytelling (another reason to
call it storyboarding). For example, how
the process is run, what past upsets have
been (or what the biggest risks are for
new processes), what the interactions are
between parts of the process, or what the
impact of utilities loss is expected to be.
www.controlglobal.com
eHANDBOOK: HMI and Industrial Computers 8
Display scope: As the displays get orga-
nized, they’re divided into main operating
areas (Level 2) and details in that area (Lev-
el 3 and 4). The focus of storyboarding isn’t
detailed content, but rather main groupings
for Level 2, main types of Level 3 and 4, and
interactions.
Navigation hierarchy: During general dis-
cussions on operations, details will emerge
from past experience and/or from safety
studies. After storyboarding, a navigation
hierarchy will be developed.
Display content: Discussion of upsets
may highlight analyzers and lab values
required to certify quality of the water. In
more regulated systems, ongoing certifi-
cation of quality may be critical to down-
stream demin water users. Online analyz-
ers are likely to be shown, but adding lab
values from a local unit lab and/or the
official central lab certification point may
not have been considered. This identifies
new content for the Level 3 display and
items to be considered for Level 2.
Multiple Display + Box CombinationsSP-5000 Enhanced HMI
HMI ReliabilityCommunicate real-time with a range of control devices, and
collect data at high speed
IPC VersitalityUtilize Windows applications
tto deal with alarms or maintenance
ExtensiveConnectivity
Ethernet, Serial, SD, USB (Type A)USB (mini-B), Aux
RRemote Monitoring
profaceamerica.com800-289-9266
www.controlglobal.com
eHANDBOOK: HMI and Industrial Computers 9
Further discussion may identify users that
must be isolated from the system when
online analyzer or lab certification fails.
This may result in adding more data to the
displays, and perhaps identify the need for
links to emergency operations procedures.
If this isolation isn’t an automated shut-
down, display changes may be pivotal in
avoiding losses related to contamination
of users.
Figure 2 adds the isolation valve and
interlock on conductivity for pharmaceuti-
cal users. The online analyzer isn’t local to
the tank, so it wasn’t originally shown. The
isolation valve is managed by the pharma
unit, but is shown on the display for refer-
ence in the demin area.
Demin tank unit and main lab readings
are also added to the display. The overall
tank status, noted here as “certified,” is
also shown. This information may be made
available only on demand if there are no
routine contamination issues.
LEVEL 1 AND 2 WORKSHOPFor existing systems, an HMI improvement
project may only add new Level 1 and Level
2 displays as a first phase. Some of this
workshop content is similar to the story-
boarding workshop, which both focus on
setting the scope for each Level 2 displays.
During a Level 1 and Level 2 workshop,
a review of three to six months of alarm
and event data for an existing process will
uncover areas of focus for the Level 1 and
Demin water storage
DeminI102
P-77672 gpm
TK102
P-7675.2%
99.2 °F
7.1 pH
Highrecycle
87.3 A87.2
27%
P-102A
P-102B
P-102C
Standby
Users
DeminI102
672 gpm
TK102
75.2%
99.2 °F
7.1 pH
87.3 A87.2
2%
P-102A
P-102B
P-102C
Standby
0.3 μS/cm
Pharma
Users
123
CertifiedIn: 673 gpmOut: 443 gpmHrs to fill: 21
NEW DEVICES ADD TO HMIFigure 2: When the demineralization water storage application adds the isolation valve and interlock on conductivity typically used in pharmaceutical applications, its HMI adds tank unit and main lab readings, while overall tank status may be displayed as "certified." In addition, a blue arrow graphic can show direction of level change, while a mass balance shape can show input changes, and a yel-low tooltip box can detail supply/demand and hours to tank capacity. Also, lab data can be hidden, but available via a popup icon. Source: Wood plc
www.controlglobal.com
eHANDBOOK: HMI and Industrial Computers 10
Level 2 displays. This effort may also un-
cover process or control design deficien-
cies that require an unexpected and often
overlooked level of interaction. Review of
output and setpoint changes will identify
key controls for inclusion at Level 2.
Operating modes: It’s critical to under-
stand that, even in a continuous process,
there are different modes of operation
when support for maintenance, upset and
shutdown conditions are included. For
batch and discrete operations, modes of
“normal” operation are routinely changed.
Every HMI system should support the
operations team during all normal and
abnormal operating conditions. Abnormal
considerations include critical utilities im-
pacts, upstream and downstream effects,
maintenance and shutdown/start-up
impacts. Any of these may impact display
scope.
For demin production, there are modes of
operation impacting the tank and its sta-
tus. Demin water processes generally have
anion and cation resin beds and degasifi-
cation steps that produce purified water.
The resin beds periodically go through a
regeneration step (often once or more per
day). While in regeneration, the product
tank level will drop, and regain level once
water production resumes. The tank level
is important during regeneration to ensure
continuity of water supply.
When in regeneration, however, the ac-
tual display for the demin area may not be
focused on the storage tank and may need
additional details on the regeneration. As
such, it may be more effective to put the
general information from the demin system
on an overview, and customize the operat-
ing displays to the mode of operation in
the demin area. During normal online op-
eration, a steady drop of tank level is cause
for concern and should be supported by
highlighting the direction and pace of the
change. However, highlighting this during
regeneration or offline operation may not
It's critical to understand that, even in a continuous
process, there are different modes of operation
when support for maintenance, upset and
shutdown conditions are included.
www.controlglobal.com
eHANDBOOK: HMI and Industrial Computers 11
be important unless the level is forecasted
to drop below acceptable levels.
The routine variability in the level makes
selecting a single “normal” value impos-
sible. However, assisting the operations
team across all modes of operation is
warranted. Developing different “normal”
operating limits is justified only when the
possible consequences are large and nui-
sance alerts are likely.
Figure 2 also shows the direction of level
change (blue arrow), a simple mass bal-
ance shape by the tank level (small balance
showing higher input). The second im-
age shows the mass balance with a yellow
tooltip detailing supply and demand and
hours to tank reaching capacity. The lab
information can also be hidden and avail-
able as a popup from the info area near the
“certified” status on the tank.
During Level 2 discussions, mode-based
displays may be recommended to focus at-
tention on normal and regeneration modes
of operation. Combining key elements from
multiple Level 3 displays can create a very
effective Level 2. Adjusting displays to re-
flect different modes of operation must be
executed carefully to ensure the operations
team maintains situational awareness of any
developing issues on inactive process areas.
For sequential operation areas, awareness
of program status can be important. During
regeneration, the current phase and step of
the program, the status of any holds, and
forecasted time to completion is important
to the operations team.
Display scope: Depending on the span
of control, it’s recommended that Level 1
include all indicators with Priority 1 alarms
(highest alarm priority), and Level 2 in-
clude tags with Priority 1 or 2 alarms (two
highest alarm priorities). This may not be
feasible. At minimum, alarm groups or
other aggregation methods should provide
situational awareness and navigation links
to Level 3 displays with developing or es-
calating alarms.
Adjusting displays to reflect different
modes of operation must be executed carefully
to ensure the operations team maintains
situational awareness of any developing
issues on inactive process areas.
www.controlglobal.com
eHANDBOOK: HMI and Industrial Computers 12
Display content: Perhaps the hardest part of
developing best-in-class Level 1 displays is
to identify KPIs and calculations that reflect
overall area performance. When the opera-
tions team is responsible for budget perfor-
mance, it can be very effective to “dollarize”
these KPIs and compare them to budget
expectations. This enables real-time cost
control. Obviously, safety is the most critical
aspect of operations, so these KPIs musn’t
clutter or obscure more important informa-
tion. It can be effective to mask this type of
information if the area’s unacknowledged
alarm count is high.
Discussion of KPI performance may show
cost of operation exceeds budget. There-
fore, dollarizing the cost of operation and
adding alarms, alerts or messages to signifi-
cant deviations may be worth considering
for the Level 1 display.
ADVANCED METHODSWhen researching methods for require-
ments definition, more advanced methods
are commonly referenced. It’s important
to understand these methods are likely
warranted for use with complex tasks,
infrequent tasks, or complex controls and
applications. Commonly cited methods
include:
• Hierarchical task analysis (HTA) is one of
the most routinely referenced techniques.
In simple terms, an overall task is decom-
posed into steps. A cursory step is further
refined only when a potential benefit is
seen. The downside is many tasks don’t
require special HMI support. In many ways,
discussing modes of operation and review
of alarms and events can also identify ar-
eas of focus and need for HMI support.
• Review of existing emergency operating
procedures may highlight added, useful
information for a display. Loss of demin
tank level procedures may include a shed-
ding plan where some users could be
supplied with lower-quality water. Provid-
ing online forecasting tools to show the
effect of shedding may be an effective
support tool. The decision to provide this
may depend on frequency of expected
use. Location of the tool could be on the
operating displays or on the business LAN
using historian data.
• Timeline analysis (TA) arranges steps on
a timeline. This can be effective for time-
sensitive tasks or those with complex
interactions. This analysis can identify
areas where multiple displays are re-
quired. If the task is complex or done
infrequently, this analysis can be effec-
tive in the design process. If the task’s
duration is important, this analysis may
indicate the need to alert operations to
deviations.
• Link analysis (LA) demonstrates the fre-
quency of linkage between tasks. It’s use-
ful for streamlining tasks and identifying
how often a user has to navigate from one
www.controlglobal.com
eHANDBOOK: HMI and Industrial Computers 13
display to another. Perhaps the most ef-
fective use of this analysis in HMI design is
for existing displays where the navigation
is recorded and unknown interdependen-
cies are revealed.
• Other more advanced techniques to con-
sider include cognitive work analysis and
ecological analysis.
ASK THE RIGHT QUESTIONSUltimately, designing the best HMI re-
quires designers to find the correct knowl-
edge base to use. For existing processes,
this is the operations team (including
support personnel). For new processes,
this is the design team (including opera-
tions and maintenance). Once the correct
knowledge base is identified, the right
questions must be asked to define and
refine requirements. This may require
multiple methods. The effort and level of
detail should be driven by overall risk and
benefit potential.
Bridget Fitzpatrick is process automation authority at
Wood plc (www.woodplc.com), a system integrator
and supplier in Houston. She can be reached at bridget.
Combine an enahcned SP5000 HMI with Pro-face Connect, our ready-to-use embedded HMI cloud solution that allows you to securely access machines remotely from anywhere at anytime, and your assets are covered.
800-289-9266 | PROFACE AMERICA.COM
HMI PANELSBUILT FOR VERSATILITYConnect more devices with plug-in modules and support for 300+ protocols
WWW.REDLION.NET+1 (717) 767-6511 | [email protected]
From factories to extreme remote locations, our HMIs enable customers worldwide to connect, monitor and control processes across a broad range of industries.
Our indoor CR1000 and CR3000 HMIs are perfect for the factory floor, while our rugged Graphite® HMIs withstand extreme outdoor environments.
www.controlglobal.com
eHANDBOOK: HMI and Industrial Computers 15
Jake and his assistant were search-
ing. The outbuilding had some ambi-
ent monitors for oxygen and carbon
monoxide (CO), since it housed the continu-
ous emission monitoring system (CEMS) for
the nearby boiler. The stack sample being
analyzed was potentially suffocating or oth-
erwise lethal, so sirens would sound locally
and beacons would flash, alerting any occu-
pants that they should leave and seek fresh
air immediately. Jake calibrated the monitors
every quarter, but a recent corporate audit
recommended that this was insufficient if the
alarm did not also show in the control house—
a continuously attended location. Soon, the
operations manager entered a work order to
bring this alarm into the house.
If your facility has been around for more
than a couple of decades, it’s not uncom-
mon that the 20% spares left in local panels
by the original builders have long ago been
consumed. Projects come through, pro-
cess specialists come up with other points
to monitor, and before long, local junction
boxes have every spare pair occupied. In
Jake’s case, the next nearest place with a
spare for a new alarm was in the panel for
the crude furnace preheater. This panel ac-
companied the addition of the air preheater
decades ago, which was itself installed many
years after the original furnace was con-
structed. Inside, it was still full of relays wired
for burner management and the orderly
startup of the preheater. When Jake opened
the panel, it was like a journey back in time.
A routine task got interesting when he tried
to move some wires to check if they were
spares; a boring day became exciting when
the furnace unexpectedly shut down.
The brittle panelWhat’s it worth to be able to touch old wiring without inadvertently causing an incident?
by John Rezabek
www.controlglobal.com
eHANDBOOK: HMI and Industrial Computers 16
No instrument specialist or operator wants
an exciting day. And so, it’s become common
that no one is eager to poke at anything for
fear that some unforeseen interconnection
will cause a process upset or shutdown. Over
years of operation, contacts corrode, vibra-
tion loosens once-tight terminations, and
heat, cold, humidity and time take their toll
on every sensor and logic solver. What had
been shiny, tight and certifiable decades ago
is now a liability—it’s “brittle.”
How do we deal with brittle? Should we do
nothing until months or years in the future
when the process is offline? What if a vital
measurement or interlock means we must
open and work in such scarily fragile enclo-
sures while the process is running profitably?
Although we have cultures where instrument
and electrical—I&E—is considered infrastruc-
ture (a perspective I would argue is less than
optimal), it remains that the consequences of
brittle or shabby delivery of measurements
and interlocks have grave consequences for
productivity—not to mention other priorities
such as safety and the environment.
If Jake had foreseen the impact of his actions
before opening the preheater panel, what
might he have done differently? 20/20 hind-
sight says, why wasn’t someone doing a tug-
test and retorqueing of all the terminals in the
panel during the last process outage? Often
the issue is, people you’d entrust with such
tasks are consumed with putting out fires—
attending to the hot issues of recent memory.
When production is profitable, the business
has little patience for downtime, so “nice to
do” preventive care is usually postponed.
Let’s try imagining what robustness—the
opposite of brittle—would be like. Robust-
ness would mean even when we inadver-
tently trigger some otherwise spurious
(false) signal, the control system/logic solver
doesn’t invoke a trip. But old relay logic and
skid-mounted PLCs don’t normally attempt
to use even simple voting to invoke a trip—
mechanical equipment suppliers and consul-
tants would sooner protect their liability than
employ any cleverness (or expense) to avoid
a spurious trip, unless specifically directed by
the client.
Do your specifications address terminal
blocks? Some of us experience pushback from
electrical contractors when we suggest spring-
clamp terminals, but perhaps this can be
overcome with a little investment in tools and
training. If our projects endure for decades,
this relatively mundane choice of terminal
blocks might be a simple and effective bul-
wark against future brittleness.
A routine task got interesting when he tried to move some wires to check if they were
spares; a boring day became exciting when the furnace unexpectedly shut down.
Visit www.Acromag.com/SCTO LEARN MORE
You can depend on Acromag for all
your monitoring and control solutions.
New Dual-Channel ProgrammableTransmitters & Signal Splitters
■ Dual channel saves you money
■ Front facing terminal blocks saves you time
■ High performance increases accuracy
Acromag.com
877-295-7057
Linkedin.com/company/acromag
MADE IN USA
ISO9001AS9100
IECEx
www.controlglobal.com
eHANDBOOK: HMI and Industrial Computers 18
Device protectionIt’s easy to make small and costly mistakes when specifying and applying enclosures.
by Ian Verhappen
Every component of a control sys-
tem, from sensors to cables to con-
trollers, needs to be protected from
its environment. The most common way of
providing this protection is by placing the
equipment in some form of enclosure.
Sensors and associated electronics are
typically packaged in a metal transmitter
housing. Cables have insulation, of course,
and in many cases, the additional protection
of conduit or a cable tray. Controllers and
other larger electronics or combinations of
equipment are normally mounted in some
form of cabinet.
The most common form of enclosure is
metal, typically painted steel with stainless
steel closing mechanisms and a suitable
gasket or sealing assembly to provide the
necessary level of protection from ambi-
ent elements, and the associated required
NEMA or IP rating.
However, once we make an enclosure mois-
ture-resistant, that means we’re not only
keeping the moisture out, but also keeping
moisture in. There’s always going to be mois-
ture inside the enclosure because it contains
air, and when the temperature drops this can
lead to condensation. Water and electricity
do not mix well, and water also contributes to
accelerated corrosion. It’s therefore always a
good idea to include a breather/drain as part
of the enclosure design, especially for explo-
sion-proof enclosures placed outside.
Breather/drains allow the enclosure to equili-
brate with ambient conditions, and as a re-
sult, prevent condensation when installations
www.controlglobal.com
eHANDBOOK: HMI and Industrial Computers 19
are subjected to fluctuations in temperature,
while also effectively draining any water in
the enclosure. Because water collects in low
spots, these units should be placed at the
lowest point of an enclosure. Once installed,
the breather/drains should be maintained
because, if spiders decide to spin a web or
nest in this nice cozy location, the unit will
become plugged and cease to work.
Put unions between the enclosure and cable
seals, so if it’s necessary to remove the
cable from the enclosure (perhaps because
you forgot the breather drain and the enclo-
sure corroded), you won’t have to replace
the entire cable. If there’s no union, it will be
necessary to break the seal, thus damaging
the integrity of the cable.
Also, remember that real people have to work
in these enclosures, often wearing gloves,
which in addition to making their fingers
“bigger” also results in some loss of dexter-
ity. Therefore, don’t forget to leave sufficient
working room around the installed equip-
ment, not just for the workers but for such
things as bend radius of cables, cable tags,
etc. I’ve often seen a nice, small, 6 x 6-in.
enclosure that looks beautiful on paper get
tossed by the field crew because they simply
couldn’t terminate to what was inside it.
For the price of a slightly larger enclosure,
the amount of time saved in the field will
more than pay for the incremental cost of
the box. My personal rule of thumb is a min-
imum of 2 in. on either side of any equip-
ment (terminal strip and cable management
duct are two pieces of equipment), which
means 4 in. and preferably 6 in. between
two terminal strips without ducts.
If you’re planning to mount an access point
or other wireless device inside a metal
enclosure, remember that a Faraday cage
is made of metal, so your signal attenua-
tion will be atrocious. Consider using one
of the many fiberglass or polycarbonate
enclosures on the market instead. These
also have the option of insulated walls if
required.
Should you need to use a metal enclosure
for your wireless device, it will likely be
necessary to place the antenna outside. An
external antenna normally means a num-
ber of connections to transition across the
enclosure boundary, so consider the signal
attenuation across each connection as part
of your design.
Though many practitioners think “it’s only
an enclosure,” it’s critical that it be done
right because your work will be in use for
a long time. A field junction box might be
protecting something as simple as terminal
strips or an access point, but the infrastruc-
ture equipment inside is expected to last life
of plant, and is very difficult as well costly
to replace.
www.controlglobal.com
eHANDBOOK: HMI and Industrial Computers 20
What’s holding back mobile HMIProgress in industrial deployments is slow for good reasons.
by Ian Verhappen
Mobile HMIs have been discussed
everywhere for many years now,
including hard hat-mounted pro-
prietary systems more than a decade ago.
However, despite all the marketing about
HMI “anywhere, anytime,” we still don’t
seem to have much penetration beyond the
more traditional wired panel. The incongru-
ency is that most of us have a smart phone,
and use it all the time for much more than
simply a phone or camera—my wife certain-
ly reminds me that I spend too much time
looking at that thing.
Other than our industry’s traditional reluc-
tance to adopt new technologies, what are
some of the reasons and challenges faced
by the mobile HMI? In no particular order,
the following quickly come to mind: cyber-
security, integration, intrinsic safety, cov-
erage and risk management. Let’s look at
each of these a bit further.
Cybersecurity is certainly a consideration
for any connected device, and especially for
one connected to a control system, since
many mobile devices such as tablets and
phones don’t have the same level of hard-
ware and software protection as a dedicat-
ed, hardwired system. Wireless cybersecu-
rity is improving by leaps and bounds with
access points, white and black lists, etc., but
unless mobile device use is restricted (i.e.,
control system only), it will likely be used to
access secure and unsecure information on
the same hardware, increasing the possibil-
ity of being compromised.
Integration is necessary on multiple lev-
els. If the intent is to allow use of “any”
www.controlglobal.com
eHANDBOOK: HMI and Industrial Computers 21
device, system administrators could need
to support, for example, Android, Linux
and Windows systems on equipment from
Apple, Google, Samsung, Nokia, Huawei,
etc., as well as industrial devices designed
for the plant environment (dust, moisture,
etc.). There are ruggedized computers,
tablets, and phones on the market today,
including intrinsically safe units, suitable
for use anywhere, so the plant environ-
ment issue can be addressed for a cost,
and with devices not likely to be available
in the normal consumer marketplace.
Another integration challenge is the in-
terface itself. Fortunately, the majority of
HMI products are moving to a web-based
presentation, and international standards
support consistency across almost any
platform from a multi-panel wall screen to
smart phone. This challenge appears to be
well in hand.
I’ve mentioned the coverage issue many
times in the past—the need to put in infra-
structure can limit introduction of wireless
devices. A corollary challenge, once the
license-free infrastructure is in place, is that
almost all of it relies on using the 2.4 GHz
spectrum, so now you also need a plan to
manage available channels to ensure your
priority messages get through before other
traffic. For example, HMI update, WSN
signal, maintenance vibration measure-
ment, and accessing maintenance manuals,
walkdown checklists, etc., are all use cases
for the roaming HMI and wireless infrastruc-
ture. I believe that in the next five years,
this will become less of an issue as different
5G networks, enhanced mobile broadband
(eMBB), massive machine-type communica-
tion (mMTC), and ultra-reliable, low-latency
communications (URLLC) implementations
become available.
This leaves the largest challenge—risk
management. Most facilities will want to
be sure that the system has incorporated
enough safeguards to allow unattended
remote operation. SCADA systems are
a good example of this, with occupancy
detection plus cameras to ensure that if
someone is present, communications are
in place to prevent injury from remote
operation of equipment, or that the per-
son making the change is close enough
to the process to be aware of local haz-
ards. Use profiles will become increasingly
important, and may incorporate location
awareness as part of that profile to pre-
vent someone from accidentally operating
a plant from home on their mobile device.
For these reasons, mobile HMI is another
of the automation sector’s examples of
marketing vs. implementation. Even so,
I’m confident the use of mobile HMIs will
continue to grow, though the rate of that
growth is likely less than market studies
might suggest.
www.controlglobal.com
eHANDBOOK: HMI and Industrial Computers 22
Safety for screensAs they multiply on tablet PCs and smart phones and show up in hazardous settings, HMIs and their controls need intrinsic safety (IS) and other protections.
by Jim Montague
Going out in bad weather? You
may need a sweater or coat.
Working in a harsh or hazard-
ous environment? You and your cowork-
ers will need the right protective and
safety gear.
The same goes for tools and accessories,
especially all the human-machine interfac-
es (HMI) on tablet PCs and smart phones
that are flooding onto plant floors and
field applications—sometimes authorized,
but often unauthorized due to their sheer
prevalence on the consumer side. Despite
their numbers, they must also comply with
the same intrinsic safety (IS) and other
standards as earlier electronic handheld
devices by limiting operating voltages,
and getting sheathed in just as much rub-
ber and plastic.
Of course, today’s increasingly chip-
based, Ethernet-aided and wireless sys-
tems mean users don’t need to go into
hazardous areas as often as in the past,
and can monitor and manage applications
from safer distances. However, there are
still many times when technicians and
operators must routinely journey out to
pipelines and tanks, up to columns, or out
in the field to other equipment—even if
they can interact with many process appli-
cations and equipment via a tablet PC and
wireless link when they get there.
“It depends on each facility’s policies and
the specific level of the hazardous area
whether tablet PCs, smart phones and
other devices can be brought in “ says
Jeff Morton, sales manager at Cross Co.’s
Process Control Integration Group (www.
www.controlglobal.com
eHANDBOOK: HMI and Industrial Computers 23
crossco.com/process-controls) in Knox-
ville, Tenn. The group is a certified member
of the Control System Integrators Associa-
tion (CSIA, www.controlsys.org). “We see
a lot of interest in remote, wireless opera-
tor panels implemented as thin clients or
virtual clients in food and beverage and
chemical applications, as we don’t work in
oil and gas. Usually, iPads are employed
in non-hazardous areas, but we did have
one client that needed a tablet PC in a
Class I, Div. 2, non-explosive area, so its
operators could walk in and start a pump
for its chemical extrusion process. This is
a volatile environment and the user previ-
ously had a pushbutton in an appropriate
panel. Instead of yelling back and forth, we
brought in an industrially hardened tablet
PC with Class I, Div 2 certification.”
ARMOR UP INTERFACES Because the most obvious way to protect
interfaces that must go into hazardous ar-
eas is shielding them, many suppliers have
been putting them in purpose-built cases or
manufacturing them with built-in protections
that comply with IS and other standrds.
For instance, RAG Deutsche Steinkohle AG
(www.rag.de) in Herne, Germany, operates six
anthracite coal mines, and recently replaced
its hardwired, non-portable voice, data and
video communications with a wireless, com-
puter-based system that includes Bluetooth
headsets, wireless LAN access points (AP)
and cameras, and i.roc Ci70-Ex handheld PCs
with barcode modules from ecom instru-
ments GmbH (www.ecom-ex.com), a divi-
sion of Pepperl+Fuchs. The i.rocs run RAG’s
UNDERGROUND PC COMMUNICATIONSFigure 1: For data, voice and video communications, Germany-based coal mine operator RAG ad-opted a wireless, computer-based system with Bluetooth headsets, wireless LAN access points (AP) and cameras, and i.roc Ci70-Ex handheld PCs, which are IP65 rated and certified for use in potentially explosive mining environments. Source: RAG and ecom
www.controlglobal.com
eHANDBOOK: HMI and Industrial Computers 24
proprietary software, so the mines’ above-
ground staff can send requested data such
as technical documents to below-ground APs
that relay them to the IP65-rated handhelds,
which are certified for use in potentially ex-
plosive mining environments (Figure 1).
RAG reports that immediately available
data and advice via the i-rocs and its
computer-based communications greatly
enhance mine operations and maintenance,
which make its products more competitive
internationally. Also, the company is saving
on downtime and damage because its engi-
neering experts no longer need to be onsite
to instruct miners, but can instead save time
by guiding them through inspection and
repair tasks remotely from above ground.
“Handhelds have been used in IS areas for a
long time, but now they’re making a logical
progression into more hazardous settings,
and developers like Imtech are embedding
Android apps in them, while suppliers like
Pepperl+Fuchs’ ecom are adding location-
aware capabilities and Bluetooth,” says Grant
LeSueur, senior director for control and safety
software at Schneider Electric (www.schnei-
der-electric.us). “These GPS-based technolo-
gies can also help with cybersecurity because
they can be set to only allow data access with
a location-based prerequisite.”
DEVICE-LEVEL AND I/O SHIELDINGBeyond armoring interfaces brought into IS
and hazardous areas, several end users and
system integrators are taking a closer look at
better protecting I/O and device-level com-
ponents in IS and hazardous areas, especially
as they gain new networking connections.
For example, to maximize capacity at its
3-million-cubic-meter Kalmaz underground
natural gas storage facility in Hajigabul,
the State Oil Co. of the Azerbaijan Repub-
lic (www.SOCAR.az) recently updated the
core instrumentation and controls of its
surface applications with help from Inkoel
(www.inkoel.az), an automation engineer-
ing contractor in Baku, Azerbaijan. These
above-ground processes include two-stage
separation of solids and condensate; gas
flow measurement at wells; gas compres-
sion, preheating and pressure control; and
drying and treatment (Figure 2).
I/O SAFE IN THE FIELD Figure 2: State Oil Company of the Azerbaijan Republic's 3-billion-cubic meter Kalmaz under-ground natural gas storage facility uses Ex Inter-face relay modules to establish intrinsically safe signal circuits for 1,000 I/O points that handle its above-ground processing applications, which are controlled by Rockwell Automation's Plant-PAx PAS and Prosoft Technology's MVI56-AFC gas and liquid flow computer. Source: SOCAR and Rockwell Automation
www.controlglobal.com
eHANDBOOK: HMI and Industrial Computers 25
SOCAR and Inkoel implemented a PlantPAx
process automation system (PAS) from
Rockwell Automation (www.rockwellau-
tomation.com) for about 1,000 I/O points
handling monitoring, control and gas-flow
calculations. This client-server architecture
includes Operator Work System (OWS);
Process Automation Supervisory Server
(PASS); EtherNet/IP networking; Prosoft
Technology’s in-rack MVI56-AFC gas and
liquid flow computer for running dedicated
gas flow and calculation algorithms follow-
ing ISO-5167 measurement standards; and
522 Endress+Hauser overload-resistant
pressure and differential pressure/tempera-
ture smart transmitters.
MVI56-AFC calculates flow rates, accu-
mulated volumes, accumulated mass and
accumulated energy for up to 16 meter runs,
provides data directly to PlantPAx, and
transfers results back to processor memory
for control, or sends them to servers or the
OWS supervisory layer. To make the gas
storage application’s I/O consistent and
intrinsically safe, SOCAR and Inkoel imple-
mented Ex Interface relay modules, en-
abling IS signal circuits that are electrically
isolated from the overall system, while its
process values are accurately transmitted
to the process control system.
Likewise, Manoel Feliciano da Silva, techni-
cal advisor at Petrobras (www.petrobras.
com.br/en), reports it’s developed a mud-
gas separator for its under-balanced drilling
(UBD) method, which uses hydrodynamic
pressure of the drilling mud and fluids in the
well bore that’s lower than the well forma-
tion. Because surface pressure is lower than
well pressure, UBD applications can bring
hydrocarbons to the surface at controlled
rates, and eliminate or reduce the need for
fracturing after a well is completed, which
allows it to reach full production sooner.
However, UBD requires specialized surface
equipment for continuous separation of the
mud and hydrocarbons, so Petrobras also
developed its Aleph HMI/SCADA application
based on LabVIEW software from National
Instruments (www.ni.com). “A microcom-
puter runs the LabVIEW application, drivers
for integration with other PLCs, and screens
for operator control of the UBD operation,”
explains da Silva. “Aleph and LabVIEW pro-
vide process diagram visualization, separator
measurements, and real-time control loops
for the continuous separation. The data ac-
quisition system measures: drill bit position
through an electromagnetic measurement
while drilling (EM MWD) function; gas and
liquid flow rates; liquid height and pressure in
the separator; downhole pressure measure-
ments; and control valve positions through IS
sensors and 4-20 mA transmitters.”
LabVIEW also provides connectivity to
the drilling control PLC through an RS-232
serial drive and connectivity to a remote
system through a DataSocket server. This
system meets all design requirements in-
www.controlglobal.com
eHANDBOOK: HMI and Industrial Computers 26
cluding: safety with IS sensors and a sepa-
rate UBD control PLC; flexible software and
modular hardware for additional I/O; inte-
gration via open protocols and LabVIEW
software with a range of connectivity; and
ease-of-use with LabVIEW graphical devel-
opment environment.
“By deploying UBD technology based on
NI LabVIEW, we save between $500,000
Protected interfaces
There's a dizzying array of suppliers offering
tablet PCs, smart phones, handheld comput-
ing devices or cases that are reported to be
intrinsically safe (IS) or at least offer a range of
protections for use in hazardous environments.
Here are some of the main players:
• Aegex Technologies (http://aegex.com) pro-
vides IS Industrial Internet of Things (IIoT) and
mobile solutions for hazardous applications,
such as Windows 10 tablets, sensors and part-
ner monitoring systems, which are tested in its
AegexLabs R&D facility.
• Azonix Corp. (www.azonix.com) is a member of
MTL Instruments Group, which is part of Eaton's
Crouse-Hinds division. It designs and manufac-
tures intrinsically safe communication and data
acquisition products for hazardous-classified
Zone 1 (Class I, Div. 2) and Zone 2 areas.
• Bartec Enterprise Mobility (https://bartec-
mobility.com) brings more than 40 years of
explosion protection experience to its cameras,
tablet PCs, smart phones and other devices.
• Beijing Dorland System Control Technology Co.
(www.dorland-tech.com) makes phones, smart
phones, PDAs, RFID and barcode devices, lap-
tops, tablet PCs and digital cameras, which it
reports are all intrinsically safe.
• ecom (www.ecom-ex.com) is a Pepperl+Fuchs
brand that concentrates on mobile computing,
communications, measuring and calibration,
and handlamps.
• Exloc Instruments (www.exloc.com) supplies
IS tablet PCs, as well as industrial commu-
nications, notification products, process
instrumentation, indicators and displays, plant
maintenance and tracking solutions, engineered
solutions and enclosures, and cooling and pres-
surization devices.
• Getac (http://us.getac.com) provides rugged
notebook PCs, tablets, handhelds and video
equipment.
• Handheld Group (www.handheldgroup.com)
manufactures rugged mobile computers, PDAs
and tablets, and recently launched its first
rugged IS computer.
• Panasonic (https://na.panasonic.com)
makes a variety of industrially hardened
labtops, notebook and tablet PCs, and
other handhelds.
• Xciel Inc. (www.xciel.com) builds IS por-
table devices like smartphones and
tablet PCs, ruggedizes and certifies
commercial-grade products, and certifies
industrial-grade products.
www.controlglobal.com
eHANDBOOK: HMI and Industrial Computers 27
and $2 million, depending on the size of
the well and the cost of a fracturing job,”
adds da Silva.
HAZARDS SHIFT; SO DOES SAFETYJust as advancing technologies and capa-
bilities are pushing HMIs into more chal-
lenging settings, similar forces are altering
many hazardous environments, and impact-
ing choices about the right safety levels for
solutions that should be deployed in them.
“Many manufacturers support bring-your-
own-device (BYOD) for maintenance and
other tasks, and some hazardous areas could
support BYOD. However, we’re not seeing it
because our customers’ approach is to limit
access to hazardous areas altogether. Re-
cently, they’re limiting access even further
by leveraging technology to access hazard-
ous areas remotely from safe areas,” says
John Tertin, sales and marketing director
at ESE Inc. (https://eseautomation.com), a
CISA-certified system integrator in Marsh-
field, Wis. “We deploy rugged HMIs, but not
usually due to class requirements.”
Nonetheless, Tertin reports there’s more at-
tention to overall process safety in the past
two years, and ESE’s approach and avail-
able technical responses have shifted, too.
“Previously, we’d use several safety monitor-
ing relays going back to a central controller,
but as more attention was given to process
safety and both the number and complexity
of safety circuits has grown, we’ve transi-
tioned to safety PLCs and distributed safety
I/O, such as Rockwell Automation’s Point
Guard I/O, which let the safety circuits sig-
nal via Ethernet and allow visibility down
to individual points. Even in complex safety
circuits, engineers can determine the exact
device that caused a safety trip and where it’s
located. Safety I/O is also very economical
and cost-effective to design and implement
compared to the complexity of using safety
control relays for larger systems.”
Tertin adds that users want visibility into
their processes, but they also want to see
into them without having to go into haz-
ardous areas. “We’re not trying to replace
clipboard with iPads. We’re trying to skip
that step entirely, and not go into hazardous
locations and stand in front of equipment
unless we have to,” he explains. “Not only do
our customers want to limit people in class/
div areas, but they also want to limit the
components in them, too. While we do use IS
power supplies, I/O and field devices, we still
prefer to install them outside of rated areas,
and wire them in via sealed conduits.
“Field components must be in hazardous
areas, but using sealed rigid conduit and ter-
minating them in a safe area lets us add an-
other layer of safety and security by keeping
controls and support devices outside of the
rated area. For example, a flowmeter in a haz-
ardous setting needs to be IS, but the IS I/O
and power supply that it’s terminated to can
be outside and removed from a hazardous
www.controlglobal.com
eHANDBOOK: HMI and Industrial Computers 28
setting. The devices are then wired through
sealed conduit, further limiting exposure.”
PROTECTION WITH VIRTUALIZATIONOnce the prejudice that only hardware can
offer protection begins to dissipate, de-
velopers and users report that software,
servers, networks and other forms of digita-
lization and virtualization can also improve
safety—though their simpler, combined
solutions are often in a box as well.
“We see plenty of manufacturers making
thin clients that are hazardous-rated, mini-
PCs with Ethernet, power, screens and key-
boards. However, virtual components make
IS panels even easier to design and build,”
says Will Aja, customer operations VP at
Panacea Technologies Inc. (www.panaceat-
ech.com), a CSIA-member system integrator
in Montgomeryville, Pa. “We recently did a
pharma industry project for a chemical sys-
tem with panels in a hazardous area, which
needed to modernize its HMIs from physi-
cal touchscreens to panels with hazardous-
rated touchscreens on the front. So, we went
virtual with ACP Thin Manager (https://thin-
manager.com) software on a couple of Class
I, Div. 2 screens in the hazardous area.”
Aja explains that protection in a situation like
this traditionally requires costly IS barriers
or nitrogen purging/ventilation. However,
“virtualizing” is far less expensive because
it distributes some formerly non-distributed
HMI components, and uses standard display
libraries and a common server architecture to
serve screens to thin clients.
“With virtualization, we can pull out every-
thing that was causing problems—in this case,
terminal blocks, controls and a nitrogen purge
panel—so all that’s left in the hazardous area
is a Class I. Div. 2 box housing the HMI, touch-
screen and thin client, running software such
as Rockwell Automation’s FactoryTalk (FT)
View SE,” explains Aja. “Also, instead of deal-
ing with HMIs that are islands and patchworks
of visualization with all kinds of different pro-
gramming, we’re taking anywhere from 11 to
50 separate screens, finding commonalities,
and pushing them into one project with a uni-
form HMI library. This can mean huge gains as
a result of stocking fewer displays; eliminat-
ing parts by using one type of thin client and
touchscreen; and decoupling the hardware
and software layers.
“As a result, instead of being stuck in the
usual two- and three-year obsolescence
cycles for hardware and traditional software,
we just replace the commodity tablet PCs,
smart phones or other interfaces serving our
screens as needed. These devices can be
intrinsically safe if required, but future plants
aren’t going to have as many HMIs in the field.
Instead, they’ll have engineering stations that
will interact with IS tablets, and use geo-
fencing that will only allow users to securely
control the boiler or other equipment when
they’re close to it.”