The control room

The control room is where a sprawling industrial process becomes numbers, alarms and decisions. Quiet work there can determine what happens across an entire unit.

Somewhere in every plant in town is a windowless room where four or five people, give or take by unit, sit in front of a curved wall of screens and keep a machine the size of a neighborhood inside its lines. Most of Baytown will never see it. Here is what happens there, and why it's the quietest important room in the county.

The board and the field

A running unit has two kinds of operator. The board operator sits at the console and sees the whole unit as numbers and drawings: every temperature, every pressure, every level in every drum, every valve's position, updating every second. The field operator is outside in boots, walking the unit, reading gauges by eye, feeling a pump bearing for heat, opening the valves that aren't automated, and reporting back on the radio. Neither can do the job without the other. The board sees everything and touches nothing; the field touches everything and sees only what's in front of it. OSHA's manual doesn't use those two titles — the industry does — but its process descriptions say what the pair is for: keeping temperature, pressure, reflux and level within their limits, with automatic controls to prevent an excursion and regular sampling to prove the process is doing what the screen says.

What the screen is

The wall of screens is the face of a distributed control system: hundreds of small computers, each in charge of a piece of the plant, wired to thousands of sensors and to the motors on the valves, all reporting to the console. It's distributed on purpose — no single computer runs the plant, so no single failure should be able to stop it. The board operator doesn't drive the unit valve by valve; she sets targets, and the controllers hold them, and her job is to notice when the holding stops working. An alarm is the system's way of saying I can't hold this anymore; you decide.

The turnover

The most important ten minutes of the day happen at a whiteboard. The outgoing shift tells the incoming shift what the unit did, what it's doing, and what it's about to do — the pump that's running rough, the sample that came back high, the permit open on the north side. Then the new shift signs in and the old one goes home. The turnover exists because a plant has no memory of its own; the memory is in the logbook and the people. When something goes badly wrong in this industry, the investigators go to the turnover notes early. The Chemical Safety Board's report on Texas City in 2005 found a start-up begun by one shift and continued by another that didn't know how full a tower was. The tower overflowed. Fifteen people died. The Chemical Safety Board's report is the reason turnovers are written down, read aloud and signed.

The alarm

On a quiet night the screen is mostly white and green. When something drifts, a banner turns amber, and the operator has to decide, usually in under a minute, whether it's a bad sensor, a slow drift she can bring back with a setpoint, or the beginning of something. Most alarms are nothing. The whole craft is in knowing which ones aren't. There's an industry standard for exactly this — ISA-18.2, on managing alarms — because a screen that shouts all the time teaches people to stop listening; a good console is quieter than a bad one, not louder.

The board sees everything and touches nothing; the field touches everything and sees only what's in front of it.

The night

Twelve hours, on most plant rotations here. The plant doesn't care that it's three in the morning, and the body does. The control room is lit low, the coffee is bad, the radio is the only voice for an hour at a stretch, and the job is to be as sharp at hour eleven as hour one. The National Institute for Occupational Safety and Health says being awake seventeen hours impairs a person about the way a legal-limit drink does, and that night workers are twice as likely as day workers to report too little sleep. That's why the days off come in blocks, why the industry now writes limits on consecutive shifts, and why the page on the twelve-hour shift is not a complaint but a manual.

The start-up

The most careful week of the cycle isn't the emergency; it's the morning after a turnaround, when a cold, open, inspected unit has to be closed, purged, pressured and brought to temperature one step at a time. Start-ups and shutdowns are when a plant is least like its normal self, and the industry's incident history is crowded with them. In the control room a start-up is a procedure read line by line, with more hands on than a normal night — extra eyes at the screen, extra boots in the field, and a supervisor who has done it before. It is the closest a refinery gets to a surgeon's checklist.

Who sits there

Many came through Lee College's process-technology program; others came up through the field or over from another plant, and earned the chair. Some grew up in Baytown with a parent who sat in the same kind of room. The chair is one of the steadiest seats in town: the plant runs whether or not there's a turnaround, the shift is fixed, the benefits are real, and the work is exactly as hard as staying awake and honest for twelve hours with a machine that never lies and never sleeps. The operator's day is that shift in order.

The unwritten rules of the room

None of these are in a standard, and no two rooms keep them exactly alike, but they're the kind of rules a good room keeps anyway. The board operator's chair is hers; nobody else sits in it, even on break. The phone stays face-down or in the locker; the screen is the only thing that gets looked at. Nobody raises a voice — an emergency is run at conversational volume, because the person who shouts is the person nobody can understand on the radio. The coffee is communal and, by long tradition, not very good. The logbook is written in full sentences, in ink, because someone may read it in a hearing room someday, and every operator knows it. And when something looks strange, the oldest hand on the shift gets asked, not told — not because of rank, but because the unit may have done this before, and so has he.

What the radio says

The unit's second language is the radio, and it has a grammar. Names first, then the message, then "copy" back. Numbers said twice. "Stand by" means the board is thinking; "go ahead" means the board is listening. The exact discipline varies from site to site; the habit underneath it doesn't — clear words, said twice, because in the moment that matters the radio may be the only channel there is. Twenty minutes of silence on the radio is a good night. The grammar comes home, too: a plant kid who says "copy" at the dinner table may not be joking.

The room and the town

When a plant event has sent this town indoors, the story very often started in a room like this one, with an operator watching a number climb and deciding, in a minute, to trip the unit. The flare that followed was that decision, made visible. Not every flare is that — some are a routine start-up or shutdown, and the flame alone can't tell a neighbor which; who watches the plant shows how to find out. But the neighbor who saw the flare and got angry may well have been watching the safety system work without knowing it. That gap — between what the room knows and what the town sees — is the one this whole section is trying to close, and the control room is the best place to start, because it is where a town of eighty thousand is, without thinking about it, in somebody's hands for twelve hours at a time.

Why it matters that you know

Because the flare you see from the bridge is, as often as not, a decision somebody made in this room, in seconds. Because the plant you drive past is not on autopilot — it's on a person. And because that person is, often enough, someone you went to high school with.

Read it plainly

• The screen is a model.
• The field is physical reality.
• Good operators compare both.
• Trends matter before alarms.
• Alarms need priorities.
• Too many alarms create noise.
• A handover transfers responsibility.
• Small changes deserve explanation.
• Radio language should stay plain.
• Startup changes the room's tempo.
• Night work changes attention.
• Procedure protects memory.
• Experience protects context.
• Neither replaces the other.
• Calm is an operating skill.

Sources

OSHA Technical Manual, Section IV, Chapter 2 (control requirements, automatic controls, sampling). General references on distributed control systems. ANSI/ISA-18.2, Management of Alarm Systems for the Process Industries. U.S. Chemical Safety and Hazard Investigation Board, BP Texas City investigation digest (tower overfill, shift handover, fatigue findings). NIOSH, "Work-Related Fatigue Reaches Beyond the Workplace" (impairment and night-shift sleep figures). Lee College, Process Technology program.

A number on that board can be wrong in a way that looks exactly like right. The instrument that lies slowly is about the gap between the two.

En español

La sala de control: en cada planta del pueblo hay un cuarto sin ventanas donde cuatro o cinco personas mantienen una máquina del tamaño de un barrio dentro de sus líneas. Dos clases de operador: el de tablero, que ve toda la unidad como números y dibujos — cada temperatura, presión, nivel, cada válvula, actualizados cada segundo — y el de campo, que camina la unidad con botas, lee medidores, toca una bomba para sentir el calor y abre las válvulas que no son automáticas. Ninguno trabaja sin el otro. La pantalla es la cara de un sistema de control distribuido: cientos de computadoras pequeñas, cada una a cargo de una parte, sin que ninguna sola dirija la planta. Una alarma es el sistema diciendo: ya no puedo sostener esto, decida usted. El relevo — los diez minutos más importantes del día — se escribe, se lee en voz alta y se firma, porque la planta no tiene memoria propia; la investigación de Texas City en 2005 encontró un arranque empezado por un turno y continuado por otro que no sabía qué tan llena estaba la torre. La noche: doce horas; NIOSH dice que diecisiete horas despierto afectan como una copa al límite legal, y que los trabajadores nocturnos reportan el doble de falta de sueño. El arranque después de un turnaround es la semana más cuidadosa del ciclo: un procedimiento leído línea por línea, lo más parecido a la lista de un cirujano. Quién se sienta ahí: operadores del programa de Tecnología de Procesos de Lee College, que subieron desde el campo. La antorcha que se ve desde el puente suele ser la mitad visible de una decisión que alguien tomó en este cuarto — aunque una antorcha también puede ser un arranque, un paro o una liberación programada, y por sí sola no dice cuál fue.

Las reglas no escritas del cuarto. Ninguna está en una norma y no hay dos cuartos iguales, pero son las reglas que un buen cuarto guarda de todos modos: nadie más se sienta en la silla del operador de tablero, ni en el descanso; el teléfono boca abajo o en el casillero; nadie alza la voz — una emergencia se corre en volumen de conversación porque al que grita nadie lo entiende en el radio; el café es comunal y, por tradición, no muy bueno; la bitácora se escribe en oraciones completas, con tinta, porque alguien podría leerla en una audiencia algún día; y cuando algo se ve raro, al más viejo del turno se le pregunta, no se le ordena. Lo que dice el radio. Nombres primero, luego el mensaje, luego "copiado"; los números dos veces; "stand by" es que el tablero está pensando; la disciplina exacta varía por sitio, el hábito no; veinte minutos de silencio son una buena noche; el niño de planta que dice "copiado" en la mesa quizá no está bromeando. El cuarto y el pueblo. Cuando un evento de planta ha mandado al pueblo adentro, la historia muchas veces empezó en un cuarto así, con un operador viendo subir un número y decidiendo, en un minuto, disparar la unidad; la antorcha que siguió fue esa decisión hecha visible — aunque no toda antorcha es eso: puede ser un arranque o un paro rutinario, y la llama sola no dice cuál; el vecino que se enojó quizá vio el sistema de seguridad funcionar sin saberlo.