hmi and industrial computers - controlglobal.com · 2019. 5. 10. · ansi/isa-101.01 discusses...

eHANDBOOK

HMI and Industrial Computers

TABLE OF CONTENTSDefine and refine HMI requirements 4

How to question users, organize tasks, think clearly, and design effective human-machine

interfaces.

The brittle panel 15

What’s it worth to be able to touch old wiring without inadvertently causing an incident?

Device protection 18

It’s easy to make small and costly mistakes when specifying and applying enclosures.

What’s holding back mobile HMI 20

Progress in industrial deployments is slow for good reasons.

Safety for screens 22

As they multiply on tablet PCs and smart phones and show up in hazardous

settings, HMIs and their controls need intrinsic safety (IS) and other protections.

AD INDEXAcromag • acromag.com 17

Proface • www.profaceamerica.com 8, 13

Red Lion • www.redlion.net 14

Rittal • rittal.us 3

www.controlglobal.com

eHANDBOOK: HMI and Industrial Computers 2

https://www.acromag.com/SC?utm_source=Control&utm_medium=CatalogMagazine&utm_campaign=State-of-Technology&utm_content=DT-SP

http://www.redlion.net

https://www.rittal.us/

RITTAL SHIPS QUICK!Made in the USA

www.Rittal.us (800) 477-4000

Built Tough.How tough is the TS 8 Modular Enclosure from Rittal?Tough enough to support 1500 pounds—about the weight of a young Sumatran rhinoceros.

Tough is…n a carbon steel base and zinc-plated carbon steel mounting paneln a 16x steel folded framen a durable, rugged corrosion-resistant finishfromour3-stepcoatingprocessn a unique frame structure that delivers 15% more mounting surface

12 million customers in 12 years can’t be wrong—they’ve made TS 8 the No. 1 industrial enclosure, worldwide!

https://www.rittal.us/



Industrial human machine interface (HMI)

has been a lively topic of discussion and

development for decades. The Abnormal

Situation Management (ASM) style started in

the 1990s with the ASM Consortium (www.

asmconsortium.net). ASM style evolved, and

the best-practice HMI gained a series of names,

including different spellings of “high“ perfor-

mance, etc. Many names were trademarked by

different parties, including ASM style.

The ANSI/ISA-101.01, Human Machine Interfac-

es for Process Automation Systems standard

was published in 2015. Its most significant con-

tributions were the introduction of a lifecycle

to manage the entire HMI, and a common set

of terms and definitions for HMI components.

As standards and guidelines developed, tech-

nology evolved and open systems platforms

matured, enabling HMI capabilities to become

quite advanced. Research into presenta-

tion formats, color selection and interaction

methods led to a common set of concepts for

best-practice HMI presentation, performance

and interaction. However, methods to de-

termine the content of an entire HMI or even

one screen are not as defined in industrial

settings. In my experience, some of the best

methods to define and refine requirements

for HMIs include using questionnaires and

interviews, Level 1 and 2 workshops, story-

boarding and more advanced methods.

FOUR HMI LEVELS ANSI/ISA-101.01 discusses different naviga-

tion methods and display styles. For the

examples below, it’s assumed a hierarchi-

cal navigation design will be used. and that

most displays will be Level 1, 2, 3 or 4. For

Define and refine HMI requirementsHow to question users, organize tasks, think clearly, and design effective human-machine interfaces.

by Bridget Fitzpatrick



this discussion, the following general defini-

tions of levels apply:

• Level 1 displays are overviews for monitor-

ing span of control;

• Level 2 displays are operating displays for

major areas of the span of control;

• Level 3 displays are detailed displays used

for general troubleshooting; and

• Level 4 displays are auxiliary displays used

for focused troubleshooting or intermit-

tent task support.

WHAT ARE HMI REQUIREMENTS?Defining an HMI’s requirements may seem

straightforward. A well-designed HMI phi-

losophy and style guide will set the pre-

sentation formats and interaction meth-

ods. However, how the objects on the

screen behave is only the first step in an

effective HMI. Other key concepts include:

scope of each display; navigation hierar-

chy and methods; support for all modes

of operation; online or offline help; links to

procedures; and requirements related to

user roles and account privileges.

Consider a simple demineralized (demin)

water tank with a set of three pumps, au-

to-started on pressure control, with a re-

cycle loop (Figure 1). Its HMI needs seem

likely to be rudimentary—it’s just a water

Demin water storage

DeminI102

P-77672 gpm

TK102

P-7675.2%

99.2 °F

7.1 pH

Highrecycle

87.3 A87.2

27%

P-102A

P-102B

P-102C

Standby

Users

DeminI102

672 gpm

TK102

75.2%

99.2 °F

7.1 pH

87.3 A87.2

2%

P-102A

P-102B

P-102C

Standby

0.3 μS/cm

Pharma

Users

123

CertifiedIn: 673 gpmOut: 443 gpmHrs to fill: 21

TANK AND PUMP DETAILSFigure 1: A simple demineralization water tank with three pumps, auto-started on pressure control with a recycle loop, might seem to only need a simple HMI displaying its instruments and controls. However, questionnaires and operator interviews may show that pump auto-starts push operating costs over budget, requiring the HMI designer to add an alert, alarm or "high recycle" advice. Obser-vation may also show tank level having an interlock to an incoming block valve, so that detail may be added to the display. Source: Wood plc



tank. The tank instruments and regulatory

controls need to be displayed. The device

controls for the pumps must be available.

What else could there be?

USING QUESTIONNAIRES AND INTERVIEWSUsing questionnaires to get the opera-

tions team thinking about the HMI can be

a useful first step, though generally it’s

not the only interaction required to define

requirements. The most effective use of

the questionnaire is in combination with

face-to-face interviews or workshops with

a representative set of users. The pre-work

related to the questionnaire will help guide

the discussion or workshop.

The same process can be used to derive

requirements for existing or new process

operations. For existing displays, the ques-

tionnaire can target displays in use. For a

new process, past experience with similar

processes, process and instrumentation

drawings (P&ID) and process flow diagrams

(PFD) can be used as source documents.

Some of the questionnaire will be focused

on the overall process and the entire HMI,

while other sections will focus on key oper-

ating displays and key performance indica-

tors (KPIs) for the process. Key topics for

questionnaires include:

• What parts of the process are operated

together, and when are multiple displays

used together (and result in constantly

swapping back and forth between dis-

plays)?

• Are there different modes of operation that

require different monitoring and controls?

• Are there special HMI needs related to loss

of utilities, such as instrument air, power,

steam, etc.?

• Could additional pieces of information be

shown?

• Would on-demand access to additional

information speed operations team re-

sponse?

• For existing facilities, what’s the worst day

related to the proposed display?

• For new facilities, what’s the most severe

process risk related to the proposed dis-

play scope?

Key results from the questionnaire pro-

cess include setting the scope of the

displays and identifying additional content

for the displays. Major modes of operation

and significant areas of impact related to

loss of utilities may also be identified.

Display scope: Displays often roughly match

the boundaries of existing P&ID drawings,

but P&IDs weren’t drawn with operability or

safety in mind, so they’re unlikely to have

the correct scope. Over time, other salient

information was likely added, though often

not in the best location or context. Defining

the best scope of a display is critical man-

aging the underlying process. The interview

focuses on how the process is operated.



The first observation may be that the simple

water tank by itself is not a good scope for

a major operating display. In this scenario,

the tank is part of an integrated demin

water system. It’s the main storage for the

demin water and supplies the rest of the

facility. If the tank level and the distribution

pressure are not in alarm, the operations

team isn’t terribly interested in the tank by

itself. As such, key information from the

tank must be shown on related displays that

are monitored continuously. This identi-

fies that the example display may exist as a

Level 3 detail display, or that it needs to be

combined with other portions of the pro-

cess into a Level 2 display.

Display content: Discussion of prior upsets

may indicate that operations of the three

common pumps isn’t clear. Depending

on user demand, only one or two of the

pumps remain in operation.

Further discussion may indicate that cost

of operation often exceeds budget, com-

monly when a pump auto-starts and then

stays online when not needed. Adding an

alert and/or advice on the display when

this condition is detected will help the op-

erations team manage the budget. If the

cost concern is significant, an alarm may

be configured; in Figure 1, a “high recycle”

advice is shown. This could alternately

be sent to an operator alert or message

system.

Observation also noted that tank level has

an interlock to an incoming block valve, so

that detail is also added to the display. It’s

also likely that the tank would be blanketed

with nitrogen and vented on high pressure.

This blanketing may or may not be instru-

mented, depending on design.

STORYBOARDING WORKSHOPA storyboard is a graphic organizer that

uses either labels or images arranged in

sequence for the purpose of pre-visualiz-

ing an overall system. The storyboarding

process was developed at Walt Disney

Productions during the early 1930s.

The storyboarding workshop applies this

general Disney concept by organizing

graphics into a visual structure using ex-

isting display images, new P&IDs or PFDs,

a whiteboard, or a wall with Post-it notes.

The operations team reviews the scope of

each existing display and/or identifies the

scope of new displays on new engineering

drawings.

As the storyboarding team reviews the

structure, focused questions are used to

prompt storytelling (another reason to

call it storyboarding). For example, how

the process is run, what past upsets have

been (or what the biggest risks are for

new processes), what the interactions are

between parts of the process, or what the

impact of utilities loss is expected to be.



Display scope: As the displays get orga-

nized, they’re divided into main operating

areas (Level 2) and details in that area (Lev-

el 3 and 4). The focus of storyboarding isn’t

detailed content, but rather main groupings

for Level 2, main types of Level 3 and 4, and

interactions.

Navigation hierarchy: During general dis-

cussions on operations, details will emerge

from past experience and/or from safety

studies. After storyboarding, a navigation

hierarchy will be developed.

Display content: Discussion of upsets

may highlight analyzers and lab values

required to certify quality of the water. In

more regulated systems, ongoing certifi-

cation of quality may be critical to down-

stream demin water users. Online analyz-

ers are likely to be shown, but adding lab

values from a local unit lab and/or the

official central lab certification point may

not have been considered. This identifies

new content for the Level 3 display and

items to be considered for Level 2.

Multiple Display + Box CombinationsSP-5000 Enhanced HMI

HMI ReliabilityCommunicate real-time with a range of control devices, and

collect data at high speed

IPC VersitalityUtilize Windows applications

tto deal with alarms or maintenance

ExtensiveConnectivity

Ethernet, Serial, SD, USB (Type A)USB (mini-B), Aux

RRemote Monitoring

profaceamerica.com800-289-9266

http://profaceamerica.com



Further discussion may identify users that

must be isolated from the system when

online analyzer or lab certification fails.

This may result in adding more data to the

displays, and perhaps identify the need for

links to emergency operations procedures.

If this isolation isn’t an automated shut-

down, display changes may be pivotal in

avoiding losses related to contamination

of users.

Figure 2 adds the isolation valve and

interlock on conductivity for pharmaceuti-

cal users. The online analyzer isn’t local to

the tank, so it wasn’t originally shown. The

isolation valve is managed by the pharma

unit, but is shown on the display for refer-

ence in the demin area.

Demin tank unit and main lab readings

are also added to the display. The overall

tank status, noted here as “certified,” is

also shown. This information may be made

available only on demand if there are no

routine contamination issues.

LEVEL 1 AND 2 WORKSHOPFor existing systems, an HMI improvement

project may only add new Level 1 and Level

2 displays as a first phase. Some of this

workshop content is similar to the story-

boarding workshop, which both focus on

setting the scope for each Level 2 displays.

During a Level 1 and Level 2 workshop,

a review of three to six months of alarm

and event data for an existing process will

uncover areas of focus for the Level 1 and

Demin water storage

DeminI102

P-77672 gpm

TK102

P-7675.2%

99.2 °F

7.1 pH

Highrecycle

87.3 A87.2

27%

P-102A

P-102B

P-102C

Standby

Users

DeminI102

672 gpm

TK102

75.2%

99.2 °F

7.1 pH

87.3 A87.2

2%

P-102A

P-102B

P-102C

Standby

0.3 μS/cm

Pharma

Users

123

CertifiedIn: 673 gpmOut: 443 gpmHrs to fill: 21

NEW DEVICES ADD TO HMIFigure 2: When the demineralization water storage application adds the isolation valve and interlock on conductivity typically used in pharmaceutical applications, its HMI adds tank unit and main lab readings, while overall tank status may be displayed as "certified." In addition, a blue arrow graphic can show direction of level change, while a mass balance shape can show input changes, and a yel-low tooltip box can detail supply/demand and hours to tank capacity. Also, lab data can be hidden, but available via a popup icon. Source: Wood plc



Level 2 displays. This effort may also un-

cover process or control design deficien-

cies that require an unexpected and often

overlooked level of interaction. Review of

output and setpoint changes will identify

key controls for inclusion at Level 2.

Operating modes: It’s critical to under-

stand that, even in a continuous process,

there are different modes of operation

when support for maintenance, upset and

shutdown conditions are included. For

batch and discrete operations, modes of

“normal” operation are routinely changed.

Every HMI system should support the

operations team during all normal and

abnormal operating conditions. Abnormal

considerations include critical utilities im-

pacts, upstream and downstream effects,

maintenance and shutdown/start-up

impacts. Any of these may impact display

scope.

For demin production, there are modes of

operation impacting the tank and its sta-

tus. Demin water processes generally have

anion and cation resin beds and degasifi-

cation steps that produce purified water.

The resin beds periodically go through a

regeneration step (often once or more per

day). While in regeneration, the product

tank level will drop, and regain level once

water production resumes. The tank level

is important during regeneration to ensure

continuity of water supply.

When in regeneration, however, the ac-

tual display for the demin area may not be

focused on the storage tank and may need

additional details on the regeneration. As

such, it may be more effective to put the

general information from the demin system

on an overview, and customize the operat-

ing displays to the mode of operation in

the demin area. During normal online op-

eration, a steady drop of tank level is cause

for concern and should be supported by

highlighting the direction and pace of the

change. However, highlighting this during

regeneration or offline operation may not

It's critical to understand that, even in a continuous

process, there are different modes of operation

when support for maintenance, upset and

shutdown conditions are included.



be important unless the level is forecasted

to drop below acceptable levels.

The routine variability in the level makes

selecting a single “normal” value impos-

sible. However, assisting the operations

team across all modes of operation is

warranted. Developing different “normal”

operating limits is justified only when the

possible consequences are large and nui-

sance alerts are likely.

Figure 2 also shows the direction of level

change (blue arrow), a simple mass bal-

ance shape by the tank level (small balance

showing higher input). The second im-

age shows the mass balance with a yellow

tooltip detailing supply and demand and

hours to tank reaching capacity. The lab

information can also be hidden and avail-

able as a popup from the info area near the

“certified” status on the tank.

During Level 2 discussions, mode-based

displays may be recommended to focus at-

tention on normal and regeneration modes

of operation. Combining key elements from

multiple Level 3 displays can create a very

effective Level 2. Adjusting displays to re-

flect different modes of operation must be

executed carefully to ensure the operations

team maintains situational awareness of any

developing issues on inactive process areas.

For sequential operation areas, awareness

of program status can be important. During

regeneration, the current phase and step of

the program, the status of any holds, and

forecasted time to completion is important

to the operations team.

Display scope: Depending on the span

of control, it’s recommended that Level 1

include all indicators with Priority 1 alarms

(highest alarm priority), and Level 2 in-

clude tags with Priority 1 or 2 alarms (two

highest alarm priorities). This may not be

feasible. At minimum, alarm groups or

other aggregation methods should provide

situational awareness and navigation links

to Level 3 displays with developing or es-

calating alarms.

Adjusting displays to reflect different

modes of operation must be executed carefully

to ensure the operations team maintains

situational awareness of any developing

issues on inactive process areas.



Display content: Perhaps the hardest part of

developing best-in-class Level 1 displays is

to identify KPIs and calculations that reflect

overall area performance. When the opera-

tions team is responsible for budget perfor-

mance, it can be very effective to “dollarize”

these KPIs and compare them to budget

expectations. This enables real-time cost

control. Obviously, safety is the most critical

aspect of operations, so these KPIs musn’t

clutter or obscure more important informa-

tion. It can be effective to mask this type of

information if the area’s unacknowledged

alarm count is high.

Discussion of KPI performance may show

cost of operation exceeds budget. There-

fore, dollarizing the cost of operation and

adding alarms, alerts or messages to signifi-

cant deviations may be worth considering

for the Level 1 display.

ADVANCED METHODSWhen researching methods for require-

ments definition, more advanced methods

are commonly referenced. It’s important

to understand these methods are likely

warranted for use with complex tasks,

infrequent tasks, or complex controls and

applications. Commonly cited methods

include:

• Hierarchical task analysis (HTA) is one of

the most routinely referenced techniques.

In simple terms, an overall task is decom-

posed into steps. A cursory step is further

refined only when a potential benefit is

seen. The downside is many tasks don’t

require special HMI support. In many ways,

discussing modes of operation and review

of alarms and events can also identify ar-

eas of focus and need for HMI support.

• Review of existing emergency operating

procedures may highlight added, useful

information for a display. Loss of demin

tank level procedures may include a shed-

ding plan where some users could be

supplied with lower-quality water. Provid-

ing online forecasting tools to show the

effect of shedding may be an effective

support tool. The decision to provide this

may depend on frequency of expected

use. Location of the tool could be on the

operating displays or on the business LAN

using historian data.

• Timeline analysis (TA) arranges steps on

a timeline. This can be effective for time-

sensitive tasks or those with complex

interactions. This analysis can identify

areas where multiple displays are re-

quired. If the task is complex or done

infrequently, this analysis can be effec-

tive in the design process. If the task’s

duration is important, this analysis may

indicate the need to alert operations to

deviations.

• Link analysis (LA) demonstrates the fre-

quency of linkage between tasks. It’s use-

ful for streamlining tasks and identifying

how often a user has to navigate from one



display to another. Perhaps the most ef-

fective use of this analysis in HMI design is

for existing displays where the navigation

is recorded and unknown interdependen-

cies are revealed.

• Other more advanced techniques to con-

sider include cognitive work analysis and

ecological analysis.

ASK THE RIGHT QUESTIONSUltimately, designing the best HMI re-

quires designers to find the correct knowl-

edge base to use. For existing processes,

this is the operations team (including

support personnel). For new processes,

this is the design team (including opera-

tions and maintenance). Once the correct

knowledge base is identified, the right

questions must be asked to define and

refine requirements. This may require

multiple methods. The effort and level of

detail should be driven by overall risk and

benefit potential.

Bridget Fitzpatrick is process automation authority at

Wood plc (www.woodplc.com), a system integrator

and supplier in Houston. She can be reached at bridget.

[email protected].

Combine an enahcned SP5000 HMI with Pro-face Connect, our ready-to-use embedded HMI cloud solution that allows you to securely access machines remotely from anywhere at anytime, and your assets are covered.

800-289-9266 | PROFACE AMERICA.COM

http://profaceamerica.com

HMI PANELSBUILT FOR VERSATILITYConnect more devices with plug-in modules and support for 300+ protocols

WWW.REDLION.NET+1 (717) 767-6511 | [email protected]

From factories to extreme remote locations, our HMIs enable customers worldwide to connect, monitor and control processes across a broad range of industries.

Our indoor CR1000 and CR3000 HMIs are perfect for the factory floor, while our rugged Graphite® HMIs withstand extreme outdoor environments.

http://www.redlion.net



Jake and his assistant were search-

ing. The outbuilding had some ambi-

ent monitors for oxygen and carbon

monoxide (CO), since it housed the continu-

ous emission monitoring system (CEMS) for

the nearby boiler. The stack sample being

analyzed was potentially suffocating or oth-

erwise lethal, so sirens would sound locally

and beacons would flash, alerting any occu-

pants that they should leave and seek fresh

air immediately. Jake calibrated the monitors

every quarter, but a recent corporate audit

recommended that this was insufficient if the

alarm did not also show in the control house—

a continuously attended location. Soon, the

operations manager entered a work order to

bring this alarm into the house.

If your facility has been around for more

than a couple of decades, it’s not uncom-

mon that the 20% spares left in local panels

by the original builders have long ago been

consumed. Projects come through, pro-

cess specialists come up with other points

to monitor, and before long, local junction

boxes have every spare pair occupied. In

Jake’s case, the next nearest place with a

spare for a new alarm was in the panel for

the crude furnace preheater. This panel ac-

companied the addition of the air preheater

decades ago, which was itself installed many

years after the original furnace was con-

structed. Inside, it was still full of relays wired

for burner management and the orderly

startup of the preheater. When Jake opened

the panel, it was like a journey back in time.

A routine task got interesting when he tried

to move some wires to check if they were

spares; a boring day became exciting when

the furnace unexpectedly shut down.

The brittle panelWhat’s it worth to be able to touch old wiring without inadvertently causing an incident?

by John Rezabek



No instrument specialist or operator wants

an exciting day. And so, it’s become common

that no one is eager to poke at anything for

fear that some unforeseen interconnection

will cause a process upset or shutdown. Over

years of operation, contacts corrode, vibra-

tion loosens once-tight terminations, and

heat, cold, humidity and time take their toll

on every sensor and logic solver. What had

been shiny, tight and certifiable decades ago

is now a liability—it’s “brittle.”

How do we deal with brittle? Should we do

nothing until months or years in the future

when the process is offline? What if a vital

measurement or interlock means we must

open and work in such scarily fragile enclo-

sures while the process is running profitably?

Although we have cultures where instrument

and electrical—I&E—is considered infrastruc-

ture (a perspective I would argue is less than

optimal), it remains that the consequences of

brittle or shabby delivery of measurements

and interlocks have grave consequences for

productivity—not to mention other priorities

such as safety and the environment.

If Jake had foreseen the impact of his actions

before opening the preheater panel, what

might he have done differently? 20/20 hind-

sight says, why wasn’t someone doing a tug-

test and retorqueing of all the terminals in the

panel during the last process outage? Often

the issue is, people you’d entrust with such

tasks are consumed with putting out fires—

attending to the hot issues of recent memory.

When production is profitable, the business

has little patience for downtime, so “nice to

do” preventive care is usually postponed.

Let’s try imagining what robustness—the

opposite of brittle—would be like. Robust-

ness would mean even when we inadver-

tently trigger some otherwise spurious

(false) signal, the control system/logic solver

doesn’t invoke a trip. But old relay logic and

skid-mounted PLCs don’t normally attempt

to use even simple voting to invoke a trip—

mechanical equipment suppliers and consul-

tants would sooner protect their liability than

employ any cleverness (or expense) to avoid

a spurious trip, unless specifically directed by

the client.

Do your specifications address terminal

blocks? Some of us experience pushback from

electrical contractors when we suggest spring-

clamp terminals, but perhaps this can be

overcome with a little investment in tools and

training. If our projects endure for decades,

this relatively mundane choice of terminal

blocks might be a simple and effective bul-

wark against future brittleness.

A routine task got interesting when he tried to move some wires to check if they were

spares; a boring day became exciting when the furnace unexpectedly shut down.

Visit www.Acromag.com/SCTO LEARN MORE

You can depend on Acromag for all

your monitoring and control solutions.

New Dual-Channel ProgrammableTransmitters & Signal Splitters

■ Dual channel saves you money

■ Front facing terminal blocks saves you time

■ High performance increases accuracy

Acromag.com

877-295-7057

Linkedin.com/company/acromag

MADE IN USA

ISO9001AS9100

IECEx

https://www.acromag.com/SC?utm_source=Control&utm_medium=CatalogMagazine&utm_campaign=State-of-Technology&utm_content=DT-SP



Device protectionIt’s easy to make small and costly mistakes when specifying and applying enclosures.

by Ian Verhappen

Every component of a control sys-

tem, from sensors to cables to con-

trollers, needs to be protected from

its environment. The most common way of

providing this protection is by placing the

equipment in some form of enclosure.

Sensors and associated electronics are

typically packaged in a metal transmitter

housing. Cables have insulation, of course,

and in many cases, the additional protection

of conduit or a cable tray. Controllers and

other larger electronics or combinations of

equipment are normally mounted in some

form of cabinet.

The most common form of enclosure is

metal, typically painted steel with stainless

steel closing mechanisms and a suitable

gasket or sealing assembly to provide the

necessary level of protection from ambi-

ent elements, and the associated required

NEMA or IP rating.

However, once we make an enclosure mois-

ture-resistant, that means we’re not only

keeping the moisture out, but also keeping

moisture in. There’s always going to be mois-

ture inside the enclosure because it contains

air, and when the temperature drops this can

lead to condensation. Water and electricity

do not mix well, and water also contributes to

accelerated corrosion. It’s therefore always a

good idea to include a breather/drain as part

of the enclosure design, especially for explo-

sion-proof enclosures placed outside.

Breather/drains allow the enclosure to equili-

brate with ambient conditions, and as a re-

sult, prevent condensation when installations



are subjected to fluctuations in temperature,

while also effectively draining any water in

the enclosure. Because water collects in low

spots, these units should be placed at the

lowest point of an enclosure. Once installed,

the breather/drains should be maintained

because, if spiders decide to spin a web or

nest in this nice cozy location, the unit will

become plugged and cease to work.

Put unions between the enclosure and cable

seals, so if it’s necessary to remove the

cable from the enclosure (perhaps because

you forgot the breather drain and the enclo-

sure corroded), you won’t have to replace

the entire cable. If there’s no union, it will be

necessary to break the seal, thus damaging

the integrity of the cable.

Also, remember that real people have to work

in these enclosures, often wearing gloves,

which in addition to making their fingers

“bigger” also results in some loss of dexter-

ity. Therefore, don’t forget to leave sufficient

working room around the installed equip-

ment, not just for the workers but for such

things as bend radius of cables, cable tags,

etc. I’ve often seen a nice, small, 6 x 6-in.

enclosure that looks beautiful on paper get

tossed by the field crew because they simply

couldn’t terminate to what was inside it.

For the price of a slightly larger enclosure,

the amount of time saved in the field will

more than pay for the incremental cost of

the box. My personal rule of thumb is a min-

imum of 2 in. on either side of any equip-

ment (terminal strip and cable management

duct are two pieces of equipment), which

means 4 in. and preferably 6 in. between

two terminal strips without ducts.

If you’re planning to mount an access point

or other wireless device inside a metal

enclosure, remember that a Faraday cage

is made of metal, so your signal attenua-

tion will be atrocious. Consider using one

of the many fiberglass or polycarbonate

enclosures on the market instead. These

also have the option of insulated walls if

required.

Should you need to use a metal enclosure

for your wireless device, it will likely be

necessary to place the antenna outside. An

external antenna normally means a num-

ber of connections to transition across the

enclosure boundary, so consider the signal

attenuation across each connection as part

of your design.

Though many practitioners think “it’s only

an enclosure,” it’s critical that it be done

right because your work will be in use for

a long time. A field junction box might be

protecting something as simple as terminal

strips or an access point, but the infrastruc-

ture equipment inside is expected to last life

of plant, and is very difficult as well costly

to replace.



What’s holding back mobile HMIProgress in industrial deployments is slow for good reasons.

by Ian Verhappen

Mobile HMIs have been discussed

everywhere for many years now,

including hard hat-mounted pro-

prietary systems more than a decade ago.

However, despite all the marketing about

HMI “anywhere, anytime,” we still don’t

seem to have much penetration beyond the

more traditional wired panel. The incongru-

ency is that most of us have a smart phone,

and use it all the time for much more than

simply a phone or camera—my wife certain-

ly reminds me that I spend too much time

looking at that thing.

Other than our industry’s traditional reluc-

tance to adopt new technologies, what are

some of the reasons and challenges faced

by the mobile HMI? In no particular order,

the following quickly come to mind: cyber-

security, integration, intrinsic safety, cov-

erage and risk management. Let’s look at

each of these a bit further.

Cybersecurity is certainly a consideration

for any connected device, and especially for

one connected to a control system, since

many mobile devices such as tablets and

phones don’t have the same level of hard-

ware and software protection as a dedicat-

ed, hardwired system. Wireless cybersecu-

rity is improving by leaps and bounds with

access points, white and black lists, etc., but

unless mobile device use is restricted (i.e.,

control system only), it will likely be used to

access secure and unsecure information on

the same hardware, increasing the possibil-

ity of being compromised.

Integration is necessary on multiple lev-

els. If the intent is to allow use of “any”



device, system administrators could need

to support, for example, Android, Linux

and Windows systems on equipment from

Apple, Google, Samsung, Nokia, Huawei,

etc., as well as industrial devices designed

for the plant environment (dust, moisture,

etc.). There are ruggedized computers,

tablets, and phones on the market today,

including intrinsically safe units, suitable

for use anywhere, so the plant environ-

ment issue can be addressed for a cost,

and with devices not likely to be available

in the normal consumer marketplace.

Another integration challenge is the in-

terface itself. Fortunately, the majority of

HMI products are moving to a web-based

presentation, and international standards

support consistency across almost any

platform from a multi-panel wall screen to

smart phone. This challenge appears to be

well in hand.

I’ve mentioned the coverage issue many

times in the past—the need to put in infra-

structure can limit introduction of wireless

devices. A corollary challenge, once the

license-free infrastructure is in place, is that

almost all of it relies on using the 2.4 GHz

spectrum, so now you also need a plan to

manage available channels to ensure your

priority messages get through before other

traffic. For example, HMI update, WSN

signal, maintenance vibration measure-

ment, and accessing maintenance manuals,

walkdown checklists, etc., are all use cases

for the roaming HMI and wireless infrastruc-

ture. I believe that in the next five years,

this will become less of an issue as different

5G networks, enhanced mobile broadband

(eMBB), massive machine-type communica-

tion (mMTC), and ultra-reliable, low-latency

communications (URLLC) implementations

become available.

This leaves the largest challenge—risk

management. Most facilities will want to

be sure that the system has incorporated

enough safeguards to allow unattended

remote operation. SCADA systems are

a good example of this, with occupancy

detection plus cameras to ensure that if

someone is present, communications are

in place to prevent injury from remote

operation of equipment, or that the per-

son making the change is close enough

to the process to be aware of local haz-

ards. Use profiles will become increasingly

important, and may incorporate location

awareness as part of that profile to pre-

vent someone from accidentally operating

a plant from home on their mobile device.

For these reasons, mobile HMI is another

of the automation sector’s examples of

marketing vs. implementation. Even so,

I’m confident the use of mobile HMIs will

continue to grow, though the rate of that

growth is likely less than market studies

might suggest.



Safety for screensAs they multiply on tablet PCs and smart phones and show up in hazardous settings, HMIs and their controls need intrinsic safety (IS) and other protections.

by Jim Montague

Going out in bad weather? You

may need a sweater or coat.

Working in a harsh or hazard-

ous environment? You and your cowork-

ers will need the right protective and

safety gear.

The same goes for tools and accessories,

especially all the human-machine interfac-

es (HMI) on tablet PCs and smart phones

that are flooding onto plant floors and

field applications—sometimes authorized,

but often unauthorized due to their sheer

prevalence on the consumer side. Despite

their numbers, they must also comply with

the same intrinsic safety (IS) and other

standards as earlier electronic handheld

devices by limiting operating voltages,

and getting sheathed in just as much rub-

ber and plastic.

Of course, today’s increasingly chip-

based, Ethernet-aided and wireless sys-

tems mean users don’t need to go into

hazardous areas as often as in the past,

and can monitor and manage applications

from safer distances. However, there are

still many times when technicians and

operators must routinely journey out to

pipelines and tanks, up to columns, or out

in the field to other equipment—even if

they can interact with many process appli-

cations and equipment via a tablet PC and

wireless link when they get there.

“It depends on each facility’s policies and

the specific level of the hazardous area

whether tablet PCs, smart phones and

other devices can be brought in “ says

Jeff Morton, sales manager at Cross Co.’s

Process Control Integration Group (www.



crossco.com/process-controls) in Knox-

ville, Tenn. The group is a certified member

of the Control System Integrators Associa-

tion (CSIA, www.controlsys.org). “We see

a lot of interest in remote, wireless opera-

tor panels implemented as thin clients or

virtual clients in food and beverage and

chemical applications, as we don’t work in

oil and gas. Usually, iPads are employed

in non-hazardous areas, but we did have

one client that needed a tablet PC in a

Class I, Div. 2, non-explosive area, so its

operators could walk in and start a pump

for its chemical extrusion process. This is

a volatile environment and the user previ-

ously had a pushbutton in an appropriate

panel. Instead of yelling back and forth, we

brought in an industrially hardened tablet

PC with Class I, Div 2 certification.”

ARMOR UP INTERFACES Because the most obvious way to protect

interfaces that must go into hazardous ar-

eas is shielding them, many suppliers have

been putting them in purpose-built cases or

manufacturing them with built-in protections

that comply with IS and other standrds.

For instance, RAG Deutsche Steinkohle AG

(www.rag.de) in Herne, Germany, operates six

anthracite coal mines, and recently replaced

its hardwired, non-portable voice, data and

video communications with a wireless, com-

puter-based system that includes Bluetooth

headsets, wireless LAN access points (AP)

and cameras, and i.roc Ci70-Ex handheld PCs

with barcode modules from ecom instru-

ments GmbH (www.ecom-ex.com), a divi-

sion of Pepperl+Fuchs. The i.rocs run RAG’s

UNDERGROUND PC COMMUNICATIONSFigure 1: For data, voice and video communications, Germany-based coal mine operator RAG ad-opted a wireless, computer-based system with Bluetooth headsets, wireless LAN access points (AP) and cameras, and i.roc Ci70-Ex handheld PCs, which are IP65 rated and certified for use in potentially explosive mining environments. Source: RAG and ecom



proprietary software, so the mines’ above-

ground staff can send requested data such

as technical documents to below-ground APs

that relay them to the IP65-rated handhelds,

which are certified for use in potentially ex-

plosive mining environments (Figure 1).

RAG reports that immediately available

data and advice via the i-rocs and its

computer-based communications greatly

enhance mine operations and maintenance,

which make its products more competitive

internationally. Also, the company is saving

on downtime and damage because its engi-

neering experts no longer need to be onsite

to instruct miners, but can instead save time

by guiding them through inspection and

repair tasks remotely from above ground.

“Handhelds have been used in IS areas for a

long time, but now they’re making a logical

progression into more hazardous settings,

and developers like Imtech are embedding

Android apps in them, while suppliers like

Pepperl+Fuchs’ ecom are adding location-

aware capabilities and Bluetooth,” says Grant

LeSueur, senior director for control and safety

software at Schneider Electric (www.schnei-

der-electric.us). “These GPS-based technolo-

gies can also help with cybersecurity because

they can be set to only allow data access with

a location-based prerequisite.”

DEVICE-LEVEL AND I/O SHIELDINGBeyond armoring interfaces brought into IS

and hazardous areas, several end users and

system integrators are taking a closer look at

better protecting I/O and device-level com-

ponents in IS and hazardous areas, especially

as they gain new networking connections.

For example, to maximize capacity at its

3-million-cubic-meter Kalmaz underground

natural gas storage facility in Hajigabul,

the State Oil Co. of the Azerbaijan Repub-

lic (www.SOCAR.az) recently updated the

core instrumentation and controls of its

surface applications with help from Inkoel

(www.inkoel.az), an automation engineer-

ing contractor in Baku, Azerbaijan. These

above-ground processes include two-stage

separation of solids and condensate; gas

flow measurement at wells; gas compres-

sion, preheating and pressure control; and

drying and treatment (Figure 2).

I/O SAFE IN THE FIELD Figure 2: State Oil Company of the Azerbaijan Republic's 3-billion-cubic meter Kalmaz under-ground natural gas storage facility uses Ex Inter-face relay modules to establish intrinsically safe signal circuits for 1,000 I/O points that handle its above-ground processing applications, which are controlled by Rockwell Automation's Plant-PAx PAS and Prosoft Technology's MVI56-AFC gas and liquid flow computer. Source: SOCAR and Rockwell Automation



SOCAR and Inkoel implemented a PlantPAx

process automation system (PAS) from

Rockwell Automation (www.rockwellau-

tomation.com) for about 1,000 I/O points

handling monitoring, control and gas-flow

calculations. This client-server architecture

includes Operator Work System (OWS);

Process Automation Supervisory Server

(PASS); EtherNet/IP networking; Prosoft

Technology’s in-rack MVI56-AFC gas and

liquid flow computer for running dedicated

gas flow and calculation algorithms follow-

ing ISO-5167 measurement standards; and

522 Endress+Hauser overload-resistant

pressure and differential pressure/tempera-

ture smart transmitters.

MVI56-AFC calculates flow rates, accu-

mulated volumes, accumulated mass and

accumulated energy for up to 16 meter runs,

provides data directly to PlantPAx, and

transfers results back to processor memory

for control, or sends them to servers or the

OWS supervisory layer. To make the gas

storage application’s I/O consistent and

intrinsically safe, SOCAR and Inkoel imple-

mented Ex Interface relay modules, en-

abling IS signal circuits that are electrically

isolated from the overall system, while its

process values are accurately transmitted

to the process control system.

Likewise, Manoel Feliciano da Silva, techni-

cal advisor at Petrobras (www.petrobras.

com.br/en), reports it’s developed a mud-

gas separator for its under-balanced drilling

(UBD) method, which uses hydrodynamic

pressure of the drilling mud and fluids in the

well bore that’s lower than the well forma-

tion. Because surface pressure is lower than

well pressure, UBD applications can bring

hydrocarbons to the surface at controlled

rates, and eliminate or reduce the need for

fracturing after a well is completed, which

allows it to reach full production sooner.

However, UBD requires specialized surface

equipment for continuous separation of the

mud and hydrocarbons, so Petrobras also

developed its Aleph HMI/SCADA application

based on LabVIEW software from National

Instruments (www.ni.com). “A microcom-

puter runs the LabVIEW application, drivers

for integration with other PLCs, and screens

for operator control of the UBD operation,”

explains da Silva. “Aleph and LabVIEW pro-

vide process diagram visualization, separator

measurements, and real-time control loops

for the continuous separation. The data ac-

quisition system measures: drill bit position

through an electromagnetic measurement

while drilling (EM MWD) function; gas and

liquid flow rates; liquid height and pressure in

the separator; downhole pressure measure-

ments; and control valve positions through IS

sensors and 4-20 mA transmitters.”

LabVIEW also provides connectivity to

the drilling control PLC through an RS-232

serial drive and connectivity to a remote

system through a DataSocket server. This

system meets all design requirements in-



cluding: safety with IS sensors and a sepa-

rate UBD control PLC; flexible software and

modular hardware for additional I/O; inte-

gration via open protocols and LabVIEW

software with a range of connectivity; and

ease-of-use with LabVIEW graphical devel-

opment environment.

“By deploying UBD technology based on

NI LabVIEW, we save between $500,000

Protected interfaces

There's a dizzying array of suppliers offering

tablet PCs, smart phones, handheld comput-

ing devices or cases that are reported to be

intrinsically safe (IS) or at least offer a range of

protections for use in hazardous environments.

Here are some of the main players:

• Aegex Technologies (http://aegex.com) pro-

vides IS Industrial Internet of Things (IIoT) and

mobile solutions for hazardous applications,

such as Windows 10 tablets, sensors and part-

ner monitoring systems, which are tested in its

AegexLabs R&D facility.

• Azonix Corp. (www.azonix.com) is a member of

MTL Instruments Group, which is part of Eaton's

Crouse-Hinds division. It designs and manufac-

tures intrinsically safe communication and data

acquisition products for hazardous-classified

Zone 1 (Class I, Div. 2) and Zone 2 areas.

• Bartec Enterprise Mobility (https://bartec-

mobility.com) brings more than 40 years of

explosion protection experience to its cameras,

tablet PCs, smart phones and other devices.

• Beijing Dorland System Control Technology Co.

(www.dorland-tech.com) makes phones, smart

phones, PDAs, RFID and barcode devices, lap-

tops, tablet PCs and digital cameras, which it

reports are all intrinsically safe.

• ecom (www.ecom-ex.com) is a Pepperl+Fuchs

brand that concentrates on mobile computing,

communications, measuring and calibration,

and handlamps.

• Exloc Instruments (www.exloc.com) supplies

IS tablet PCs, as well as industrial commu-

nications, notification products, process

instrumentation, indicators and displays, plant

maintenance and tracking solutions, engineered

solutions and enclosures, and cooling and pres-

surization devices.

• Getac (http://us.getac.com) provides rugged

notebook PCs, tablets, handhelds and video

equipment.

• Handheld Group (www.handheldgroup.com)

manufactures rugged mobile computers, PDAs

and tablets, and recently launched its first

rugged IS computer.

• Panasonic (https://na.panasonic.com)

makes a variety of industrially hardened

labtops, notebook and tablet PCs, and

other handhelds.

• Xciel Inc. (www.xciel.com) builds IS por-

table devices like smartphones and

tablet PCs, ruggedizes and certifies

commercial-grade products, and certifies

industrial-grade products.



and $2 million, depending on the size of

the well and the cost of a fracturing job,”

adds da Silva.

HAZARDS SHIFT; SO DOES SAFETYJust as advancing technologies and capa-

bilities are pushing HMIs into more chal-

lenging settings, similar forces are altering

many hazardous environments, and impact-

ing choices about the right safety levels for

solutions that should be deployed in them.

“Many manufacturers support bring-your-

own-device (BYOD) for maintenance and

other tasks, and some hazardous areas could

support BYOD. However, we’re not seeing it

because our customers’ approach is to limit

access to hazardous areas altogether. Re-

cently, they’re limiting access even further

by leveraging technology to access hazard-

ous areas remotely from safe areas,” says

John Tertin, sales and marketing director

at ESE Inc. (https://eseautomation.com), a

CISA-certified system integrator in Marsh-

field, Wis. “We deploy rugged HMIs, but not

usually due to class requirements.”

Nonetheless, Tertin reports there’s more at-

tention to overall process safety in the past

two years, and ESE’s approach and avail-

able technical responses have shifted, too.

“Previously, we’d use several safety monitor-

ing relays going back to a central controller,

but as more attention was given to process

safety and both the number and complexity

of safety circuits has grown, we’ve transi-

tioned to safety PLCs and distributed safety

I/O, such as Rockwell Automation’s Point

Guard I/O, which let the safety circuits sig-

nal via Ethernet and allow visibility down

to individual points. Even in complex safety

circuits, engineers can determine the exact

device that caused a safety trip and where it’s

located. Safety I/O is also very economical

and cost-effective to design and implement

compared to the complexity of using safety

control relays for larger systems.”

Tertin adds that users want visibility into

their processes, but they also want to see

into them without having to go into haz-

ardous areas. “We’re not trying to replace

clipboard with iPads. We’re trying to skip

that step entirely, and not go into hazardous

locations and stand in front of equipment

unless we have to,” he explains. “Not only do

our customers want to limit people in class/

div areas, but they also want to limit the

components in them, too. While we do use IS

power supplies, I/O and field devices, we still

prefer to install them outside of rated areas,

and wire them in via sealed conduits.

“Field components must be in hazardous

areas, but using sealed rigid conduit and ter-

minating them in a safe area lets us add an-

other layer of safety and security by keeping

controls and support devices outside of the

rated area. For example, a flowmeter in a haz-

ardous setting needs to be IS, but the IS I/O

and power supply that it’s terminated to can

be outside and removed from a hazardous



setting. The devices are then wired through

sealed conduit, further limiting exposure.”

PROTECTION WITH VIRTUALIZATIONOnce the prejudice that only hardware can

offer protection begins to dissipate, de-

velopers and users report that software,

servers, networks and other forms of digita-

lization and virtualization can also improve

safety—though their simpler, combined

solutions are often in a box as well.

“We see plenty of manufacturers making

thin clients that are hazardous-rated, mini-

PCs with Ethernet, power, screens and key-

boards. However, virtual components make

IS panels even easier to design and build,”

says Will Aja, customer operations VP at

Panacea Technologies Inc. (www.panaceat-

ech.com), a CSIA-member system integrator

in Montgomeryville, Pa. “We recently did a

pharma industry project for a chemical sys-

tem with panels in a hazardous area, which

needed to modernize its HMIs from physi-

cal touchscreens to panels with hazardous-

rated touchscreens on the front. So, we went

virtual with ACP Thin Manager (https://thin-

manager.com) software on a couple of Class

I, Div. 2 screens in the hazardous area.”

Aja explains that protection in a situation like

this traditionally requires costly IS barriers

or nitrogen purging/ventilation. However,

“virtualizing” is far less expensive because

it distributes some formerly non-distributed

HMI components, and uses standard display

libraries and a common server architecture to

serve screens to thin clients.

“With virtualization, we can pull out every-

thing that was causing problems—in this case,

terminal blocks, controls and a nitrogen purge

panel—so all that’s left in the hazardous area

is a Class I. Div. 2 box housing the HMI, touch-

screen and thin client, running software such

as Rockwell Automation’s FactoryTalk (FT)

View SE,” explains Aja. “Also, instead of deal-

ing with HMIs that are islands and patchworks

of visualization with all kinds of different pro-

gramming, we’re taking anywhere from 11 to

50 separate screens, finding commonalities,

and pushing them into one project with a uni-

form HMI library. This can mean huge gains as

a result of stocking fewer displays; eliminat-

ing parts by using one type of thin client and

touchscreen; and decoupling the hardware

and software layers.

“As a result, instead of being stuck in the

usual two- and three-year obsolescence

cycles for hardware and traditional software,

we just replace the commodity tablet PCs,

smart phones or other interfaces serving our

screens as needed. These devices can be

intrinsically safe if required, but future plants

aren’t going to have as many HMIs in the field.

Instead, they’ll have engineering stations that

will interact with IS tablets, and use geo-

fencing that will only allow users to securely

control the boiler or other equipment when

they’re close to it.”

hmi and industrial computers - controlglobal.com · 2019. 5. 10. · ansi/isa-101.01 discusses...

Documents