All at Sea: An Ergonomic Analysis of Oil Production Platform Control Rooms.

Dr Guy H. Walker, Steve Waterfield MSc & Dr Pauline Thompson

Institute for Infrastructure and the Environment (IIE),

School of the Built Environment, Heriot-Watt University, Edinburgh, EH14 4AS

ABSTRACT

Control rooms on offshore production platforms are the focal point for their safe and efficient

operation. Following the Piper Alpha disaster in 1988 a sizeable body of safety literature was

generated covering the ergonomic issues then in play. More than twenty years have passed since

that time and significant changes have occurred to how control rooms are manned and the

technology now in use. As the North Sea oil industry in the UK enters a new phase in its life cycle,

and becomes subject to unprecedented production and cost pressures, it is time to revisit these

issues. This paper reports on an ergonomic survey covering approximately a third of all North Sea

control rooms. The focus is on the adaptive capacity of the highly experienced control room

operators and the current challenges to that capacity. Areas of concern include the support

provided for dealing with non-routine events, the persistent issue of ‘alarm overload’, the flexibility

and control of current SCADA systems, the use of control rooms for non-related tasks and personnel,

and the possible role of non-technical skills training.

Keywords: Control room design, surveys, systems ergonomics

INTRODUCTION

Background and Context

UK oil production is centred in the North Sea. It encompasses a region to the North East of the

Shetland Islands, the East Shetland Basin, then South to an area off the coast of Norfolk with an

Eastern boundary abutting the UK Continental Shelf. Offshore oil installations in this area are

remote (up to 180 miles offshore) with high hazard potential. High pressure flammable and volatile

materials are present and many hazardous operations, such as drilling, need to be carried out in a

limited space. Many installations have a large number of people living in close proximity to these

hazards and staff normally fly in and out by helicopter. As such, there are major potential hazards to

both life and the environment and clear safety issues. Indeed, if these installations were onshore

they would be designated as top tier COMAH (Control of Major Accident Hazards) sites.

In broad terms nearly all of the off shore installations have common facilities of relatively simple

engineering design. Most production platforms incorporate systems and infrastructure for oil, gas

and water separation, gas dew point conditioning, gas compression and export, crude oil export and

produced water disposal. The focal point for the monitoring and control of these processes, and the

accompanying safety systems, is the control room. This is one of the key interfaces at which humans

in these systems are able to intervene in the large scale mechanical and technical processes, an

interface whose importance has been highlighted by notable accidents such as Piper Alpha, Texas

City and Three Mile Island. Clearly, ergonomics issues are important in getting this interface right,

but ergonomics issues are modified by a number of features unique to the users of the control room

and to the context they find themselves in.

The first is that oil has been extracted from the North Sea in bulk since only the mid-1970s and from

the outset it was without precedent in the UK. As a result, many of the founding principles emerged

as a series of ‘bolt-ons’ from other sectors. For example, the installations were at sea so there was a

prominent marine aspect. The installations were also challenging to construct, so there was a

prominent civil engineering aspect. The installations were also heavily focussed around well and

drilling technology, so this too dominated. Put simply, the main technical challenge was on getting

the facilities in place and in production, and expertise from these and similar backgrounds

dominated in the design process.

The second issue is the disconnect between the on and off-shore context. Effectively the situation is

one of a large number of people living in close proximity to a hydrocarbon drilling and processing

operation with no easy means of escape should an emergency occur. It is extremely unlikely that

onshore planning regulations would allow population centres to be as close to such plants as is

effectively the case offshore, and COMAH regulations do not apply. Likewise, the UK Health and

Safety Executive (HSE) had no direct jurisdiction until the late 1980’s (after the Piper Alpha disaster;

Cullen, 1990), the industry being managed previously by shipping and maritime agencies.

The third issue is lifecycle. Many valuable works on the ergonomics of offshore control rooms were

published in the aftermath of Piper Alpha (e.g. Rundmo 1992a, b, 1993, 1996; Rundmo & Hestad &

Ulleberg, 1998; Flin et al., 1996 etc.) when the industry was approximately fifteen to twenty years

old. At the time of writing the industry is approximately forty years old and several significant

developments in control room design have emerged since then, including greater degrees of

automation and more advanced Supervisory Control and Data Acquisition (SCADA) systems.

In summary, the offshore industry is characterised by a very distinct design legacy, an unusually high

hazard context, a different set of standards compared to on-shore installations, and has been subject

to developments in control room design that have not been significantly revisited from an

ergonomics point of view since the flurry of published work post-Piper Alpha. This paper aims to

explore these issues by providing an up to date survey of control room ergonomics, comparing on

and off-shore locations and leveraging the new ergonomics knowledge that has also emerged in the

previous twenty years.

Evolution of the Control Room

Off shore control rooms describe a ‘classic’ trajectory from local automatic control to Supervisory

Control and Data Acquisition (Kragt, 1992). In the early period of the off-shore oil industry, control

rooms were usually basic monitoring stations with instruments only giving indications of measured

values in the field. First generation control rooms slowly evolved into having pneumatic or electro-

pneumatic instrumentation that allowed local automatic control of the more critical parts of the

processes, usually supported by large annunciator panels. In this case each instrument needed a

discreet set of components and wiring to convey the information to and from the control point to

the end element, which meant that each control loop was a single entity and could only carry out its

specific ‘hardwired’ function. Despite the inevitable crudities and inefficiencies of hard wired

controls and annunciator panels they did embody some (usually inadvertent) ergonomic advantages.

For example, operators could get a very quick appreciation of the state of the plant simply by the

amount of light being given off by the panel. The relative lack of automation required the operators

to continuously engage with the control systems, thereby helping them to track the dynamics of

evolving situations (Kaber & Endsley, 2004; Moray, 2004; Stanton, Chambers & Piggot, 2001;

Norman, 1990) which, in turn, was facilitated by ‘hard-wired’ controls that provided a relatively

simple and direct action-feedback loop (e.g. Norman, 1990; Zubof, 1988; Stanton & Marsden, 1996).

The disadvantage, of course, was the reliance placed on operator vigilance, the implications of high

workload, the need to maximise process efficiency and the relatively small scale of operations that

one (or a few) operators could manage at any one time (Kragt, 1992). As such, during this period

basic overview SCADA (Supervisory Control and Data Acquisition) systems began to appear. These

took in data from a wider range of systems and sensors and allowed trends of certain parameters to

be followed more closely. These systems were not capable of full remote control and this situation

remained until the late 1980s. As a ‘proof of concept’ and a demonstration of technological

capability, however, these early SCADA systems were successful and ultimately led to second and

third generation control rooms.

Second and third generation control rooms made use of the widespread availability of

microcomputers and distributed control systems (DCSs) and began to emerge in off-shore locations

from the late 1980’s onwards. The human interaction with these systems shifted from annunciator

panels and hard-wired controls to computer screens and keyboards, creating new ergonomic

possibilities but removing others. The wider range of activities these systems now interfaced with

also required greater degrees of team working, again, creating new opportunities for coordination

and cooperation but requiring this of personnel traditionally used to lone-working. In other safety

critical industries, such as aviation, this issue has been recognised and initiatives such as Crew

Resource Management (CRM) and training in ‘non-technical skills’ have been in existence for some

time (e.g. Cooper, White & Lauber, 1980).

On the one hand, second and third generation systems represented a ‘step change’, but on the other

hand they were a ‘bolt on’: they did not completely replace elements from the annunciator panels or

all hard-wired controls, thus in many cases the control room that emerged was a hybrid of new and

legacy equipment. Operators, due in large part to their domain experience, were required and

seemingly able to adapt to this new situation. In third generation systems even greater

centralisation is possible. The situation today is that control of an offshore plant can be assumed

from an on-shore location meaning that unmanned, remotely operated installations are now

common.

The modern production platform control room is now, in theory, a high tech SCADA centre with

efficient and capable computer systems and a wealth of information available to the control room

operator, as shown in Figure 1. The SCADA system can keep track of individual control circuits,

alerting the operator to failure of components long before they cause further problems. The

primary task of the system is to continuously control the production process, which it can do for

extended periods of time without any human input. These technological changes have inevitably

changed the role of the control room operator, altering their workload, their perception of system

states and requiring them to work as part of a larger distributed team. It has also changed the role

of the local control room. It is still in place in offshore locations, still important for plant safety,

equipped with a mixture of legacy and new equipment, and because of increased automation is

increasingly used for additional purposes.

Figure 1 – Typical offshore control room

Ergonomic Issues

The trajectory traced by first, second and third generation offshore control rooms is a familiar one.

Hollnagel and Woods (2005) describe it as a self-reinforcing complexity cycle. The cycle begins with

new technology creating a perceived deficiency in an existing system. SCADA, for example, ‘affords’

new functionality like remote control, greater efficiency and reduced costs compared to hardwired

controls and annunciator panels. This apparent lack of capability is answered by expanding the

systems’ functionality by ‘bolting on’ the extra capability. This, in turn, creates a new and more

complex system that has been pushed “back to the edge of the performance envelope” (Woods &

Cook, 2002, p.141). A characteristic of this self-reinforcing cycle is that the user is often left “with an

arbitrary collection of tasks and little thought may have been given to providing support for them”

(Bainbridge, 1982, p. 151). As a result, human adaptability is required in order for these systems to

work as intended which, in turn, creates new ‘opportunities for malfunction’. Hollnagel and Woods

clarify this point: “by this we do not mean just more opportunities for humans to make mistakes but

rather more cases where actions have unexpected and adverse consequences” (2005, p. 5). The

response to situations such as these is to change the functionality of the system again, from second

to third generation control rooms for example, thus completing the self-reinforcing cycle shown in

Figure 2.

Figure 2 – Hollnagel and Woods (2005) self-reinforcing complexity cycle

The implied task for the human operators is to track the dynamics of this evolving context. This

situation is again a familiar one. A well-worn maxim in Ergonomics is that ‘it is easier to twist metal

than it is to twist arms’ (e.g. Sanders & McCormick, 1992), in other words, it is easier to adapt a

system to its user than to insist on adapting users to a system. At one level this represents the

definition of Ergonomics itself, i.e. ‘matching products, systems, artefacts, infrastructures and

environments to the capabilities and limitations of humans’. When interpreted literally, however, it

tends to presuppose that users do not change and that the system (and user) can be seen in

isolation from their environment. An alternative way of viewing the ‘twisting metal versus arms’

dialectic is to see it as an almost necessarily antagonistic process, such that there is “reciprocal

evolutionary change” (Kelly, 1994, p. 74), or a little of both metal and arm twisting. Users have their

‘arms twisted’ by having to adapt to a new system, in turn, the system has a little more of its ‘metal

bent’ to suit new needs that arise from this adaptation, which creates more new needs, more arm

twisting and more metal bending, projecting forward in a co-evolutionary spiral until the original

system becomes very different from its original form. Indeed, when surveying the evolutionary

timeline of off-shore control rooms it is clear that it says as much about what the control room has

done to users as the users have done to the control room. Both have become locked into a single

system, “Each step of co-evolutionary advance winds the two antagonists more inseparably, until

each other is wholly dependent on the other’s antagonism. The two become one” (Kelly, 1994, p.

74; Licklider, 1960). Because of this there is a great danger of ‘ergonomic-naivety’: it becomes very

easy to identify ergonomic shortcomings when compared to various ‘normative’ standards, but that

is to miss entirely the contextual features of the system and the expertise of the users, both of which

are vital to effective and sensible ergonomic interventions.

Figure 3 – Technology creates new capabilities for control room technology. Operators adapt to these capabilities, creating new needs and aspirations which, in turn, manifest themselves as new deficiencies in the system which go on to

prompt more new technology, more complex systems and new opportunities for problems to arise.

Exploratory Hypothesis

There are two approaches that can be taken towards an ergonomic analysis of offshore control

rooms. The first is to embark on a ‘normative’ analysis, simply comparing the current state of affairs

against established best-practice and legislation. The second is to acknowledge the uniqueness of

the situation, the evolved nature of the technology and the expertise of the persons at work in this

setting. As such the question is more subtle. It is about the extent of adaptation, the ability of

control room operators to track the co-evolving dynamic of technology and their use of it, and

furthermore, to consider the exact nature of that adaptability and its limits. The broad hypothesis

put forward in this article is novel: if the humans in this situation are tracking the dynamics of this

co-evolving situation then, despite appearances to the contrary, off-shore control rooms should

emerge as ergonomically comparable to a brand new, on-shore, state of the art control room

designed against modern ergonomic guidelines. Any shortcomings revealed by the normative

analysis will help to provide insights into the limits of this adaptation and help designers to ensure

that users are being supported in a way that is not ‘ergonomically naïve’ but sensitive to their

context and to the expertise control room operators bring to the situation.

METHOD

Design

Experienced members of control room staff aboard North Sea production facilities completed a

control room survey based on existing measures and techniques. Their responses were anchored to

a control condition comprised of the same assessments performed on a land-based SCADA control

room. The questionnaire was compiled, adjusted to the domain in question, piloted, administered

and interpreted by a control room operator with 30 years of industry experience. This ensured high

levels of access to front-line personnel who completed the survey within the actual working

environment. The survey included guidance notes and a pre-briefing, and was designed and

administered according to established ethical guidelines.

Participants

Twenty eight control room operators took part in the survey. They were spread across 25 different

installations, covering a broad range of North Sea locations, operating companies and facilities. The

participants were approximately 60th percentile males (mean height = 180 cm, SD = 6 cm) with a

mean age of 39 years (SD = 8.63 years). A very high level of industry experience was in evidence,

with a mean of 18 years (SD = 9.96 years) working in the industry, and a mean of 8.5 years (SD = 7.2

years) working in control room environments specifically. The majority of participants had a

background in either production and operations (43%) or else instruments (36%). A much smaller

percentage derived from electrical or mechanical trades (8%). 54% occupied permanent control

room positions whilst 39% reported that they occupied rotational positions.

Methodology

The questionnaire method combined the construct validity of existing techniques with the ecological

validity of in-depth domain experience. The assessment instrument that arose from this process is

as follows:

Section 1: People

This section contained demographic information including age, experience, height, technical and

educational background.

Section 2: Environment

This section extracted data on subjective impressions of thermal comfort using the Predicted Mean

Vote (PMV) scale (Toftum, 2005). Information on the clothing normally worn in the control room

environment was also gathered which, in turn, permitted the Predicted Percentage Dissatisfied

(PPD) to be calculated (e.g. BS ISO 11064-6:2005). Subjective ratings of sound level (and their

primary source) were gathered via a checklist using examples from Stanton et al. (2010). An

assessment of air quality relied upon the Cornell Office Environment Survey (Hedge, 2005), whilst an

assessment of lighting proceeded on the basis of Boyce’s (2005) Discomfort Glare Flowchart.

Section 3: Control Room Context

This section was based on industry experience and a pilot study. It enabled participants to rate the

presence or absence of discrete control room features such as whether it was regarded as a safety

critical area, whether it was clean or dirty and the number of operators normally present. Other

multiple choice questions probed activities that operators were responsible for, the nature and type

of control panels and the types of communications systems installed (and used).

Section 4: System Usability

This section was based upon Ravden and Johnson’s HCI Checklist (1989) and the NASA Task Load

Index (TLX; Hart & Staveland, 1986). Ravden & Johnson’s (1989) HCI checklist comprises ten sections

of questions designed to assess the overall usability of a computer based system. The ten sections

refer to visual clarity, consistency, compatibility, feedback, explicitness, functionality, flexibility, error

prevention, user support and usability. The NASA Task Load Index (NASA TLX; Hart and Staveland,

1986) was used to measure participant MWL during task performance. The NASA TLX is a multi-

dimensional rating tool that is used to derive an overall workload rating based upon a weighted

average of six workload sub-scale ratings.

Section 5: Overrides, Procedures and Alarms

This section was based on a mixture of industry experience and question items from EEMUA 191

(2007). EMMUA (the Engineering Equipment and Material Users’ Association) is an industrial

association of leading national and multinational organisations in the petroleum, oil, gas, chemical

and energy industries. The EEMUA shares resources and expertise with the aims of improving

effectiveness and efficiency in their respective organisations. The EEMUA guides (of which EEMUA

191 is an example) encapsulate best industrial practice and are therefore an excellent basis for a

review of existing systems or a basis for design of new systems.

Procedure

The opportunities to conduct the form of control room survey that would be appropriate in on-shore

situations are severely limited in off-shore situations. Physical access to geographically disperse off-

shore sites is via helicopter or boat, and thus difficult and costly. The high hazard nature of the

industry also does not permit easy access to non-industry (human factors) specialists, neither is the

workplace amenable to the type of physical measurements and analyses normally performed (the

control rooms are often in use 24 hours a day and far from spacious). The strategy employed in this

study to grant access to this domain was to design a survey instrument that remained theoretically

valid, yet could be easily completed by front-line operators in their place of work. This strategy was

enacted as follows:

A methods review identified a selection of existing ergonomic instruments which met the following

criteria:

Ease of use

Little or no subsidiary equipment required

Construct validity (applicability to domain in question).

The selected measures were then compiled into one survey instrument. In order to check that these

compiled standard instruments were compatible with how personnel in this context understood

them, and to identify areas that required more domain specific questions, a pilot study was

performed in one off-shore location, and enhancements identified.

Revisions to the questionnaire were performed (including re-ordering of sections, additional

questions, further clarification etc.) using a team comprised of human factors specialists and a

control room operator of 30 years’ experience. Solutions were developed that ensured compatibility

with the domain in question whilst retaining construct validity. Fifty of the final questionnaires were

sent to the desired locations/personnel, and 28 questionnaires were returned, a response rate of

56%. There are in the region of 90 fixed installations in the North Sea, thus the responses capture

approximately 33% of all North Sea control rooms.

The use of standard ergonomic instruments grants an opportunity to compare the results with an

on-shore SCADA control room. This analysis was performed in the pre-commissioning stages of a

new facility, and was carried out by HF specialists prior to the off-shore work.

RESULTS AND DISCUSSION

The Control Room Environment

The off-shore control rooms contain a number of common features. All are equipped with fixed

desks, 75% of which are either above (25%) or below (60%) the 705 to 735mm height specified by

BS5940-1 (1999). This represents a particular concern in that the participants were approximately

60th percentile males (mean height = 180 cm, SD = 6 cm). 52% of the control rooms surveyed were

designated as ‘dirty areas’ which means that personnel are permitted to enter from the plant

without cleaning, changing or removing work clothes. In 44% of cases the control room also serves

as a supervisor’s office, and as a place where permits to work are administered (56%). Whilst in the

majority of cases (68% dayshift, 72% nightshift) the control room is manned by one control room

operator, 76% of respondents indicated that other people are in the control room ‘frequently’. 80%

of these people (from the operators point of view) are ‘just passing through’, 72% of ‘other people’

are at work on other work stations. The number of additional personnel and activities now

performed in the control room was consistently highlighted as an area for concern, especially given

that 72% of the control rooms surveyed were designated as safety areas.

The results of the control room environment measures are summarised in Table 1. Despite first

impressions to the contrary the off-shore control room environment is felt to be relatively benign in

terms of thermal characteristics but potential issues with noise, air quality and lighting were

detected. It is important to note, however, that when asked the relatively unambiguous question

“do you consider the work area to be comfortable?” 77% of respondents answered ‘yes’.

Thermal Environment

Twenty five of the twenty eight participants self-rated themselves against the seven-point Predicted

Mean Vote (PMV) scale, ranging from -3 (too cold) to +3 (too hot). The goal is to achieve a thermally

neutral situation (a rating of 0) whereby the heat generated by activity and metabolism (as affected

by clothing insulation) is in balance with the heat loss due to the temperature differential of the

room. In this environment control room operators undertake sedentary or light work (a metabolic

rate of approximately 70 – 90W/m2) with 96% reporting that they wear light or indoor clothing. The

Percentage Persons Dissatisfied (PPD) technique provides a method for coupling these PMV ratings

to population-level Percentage Persons Dissatisfied (PPD) estimates (BS ISO 7730, 1995). The mean

PMV = 0.29 which equates to 8% PPD. The comparable results for the on-shore SCADA control room

were PMV = 0.82 which equates to 12% PPD. In both cases, the mean PMV is biased by a small

amount towards warmer thermal sensation, despite light clothing being worn. Based on this

analysis it is safe to conclude that significant problems with the thermal environment in both

locations were not detected. The only exception to this was the 36% of respondents who indicated

that, contrary to BS11064:6 (1995), they did not have control over the ambient temperature.

Noise

Due to the restrictions in terms of access and lack of specialist equipment, assessment of noise in

the off shore control rooms proceeded on the basis of a self-rating technique. Control room

operators rated the ambient noise against a five point scale ranging from 40dB (the example given

being a ‘quiet office’) up to 80dB (the example given being a ‘power drill’). BS EN ISO 11064-6 (2005)

stipulates that ambient noise in control room environments should not exceed 45 dB LAeq,y, thus self-

ratings above scale point 3 (50db normal office) are taken to be indicative of noise related

shortcomings. According to this crude measure, 52% of the control rooms appear outside of

recommended ambient noise levels. 56% of respondents cited the primary cause of ambient noise

as ventilation equipment, followed by 40% citing the control room equipment itself. Interestingly,

only 12% cited external noise sources.

Air Quality

Elements from Hedge’s (2005) office environment survey were incorporated into the off-shore

survey instrument. Two five point subjective rating scales were provided. The first enabled direct

ratings of air quality properties (such as dryness, dustiness etc.), the second used air quality

‘symptoms’ (such as sore throat, fatigue etc.) from the office environment survey. Whilst 28% of

respondents rated air quality as ‘fine’, 44% indicated that the air was ‘too dry’, 24% noted ‘low flow’

and 12% noted ‘dusty’. The physical symptoms experienced by control room operators were all

approximately equally rated. Thus between 48 and 60% had experienced sore eyes and throats,

runny noses, fatigue and headache in the past 4 weeks. Whilst these health effects may not be

directly caused by the control room, they are present within it and provide clues for design

interventions that could ameliorate them.

Lighting

The discomfort glare procedure (Boyce, 2005) was employed as a quick and effective way of

assessing the suitability of lighting in the control room environment. The results indicate that in

nearly half of the control rooms (48%) discomfort glare is likely, based on an office lighting survey

completed by operators, an assessment of reflections and lighting sources. 36% of respondents also

indicate that VDU light reflection is an issue, whilst 12% indicated strip light flicker. The majority of

display types (80%) are LCD.

Table 1– Summary of control room environment measures (shaded cells indicate evidence of lack of compliance with HF best practice)

Description of Measure HF Best Practice Off Shore Control Rooms On Shore Control RoomThermal Environment Predicted Mean Vote (PMV) is a

subjective measure of thermal comfort ranging from -3 (cold) to +3 (hot).

PMV = 0 (thermally neutral) 0.29 0.82

Percentage Persons Dissatisfied (PPD) enables PMV values to be mapped onto population-level ratings of thermal comfort.

PPD < 10 % 8% 12%

Control room operators should be able to control the temperature in the control room.

Temperature control(s) installed

36% of control rooms not equipped

Yes

Noise Self-rating of noise sources according to criteria contained in BS7445-1 (1991) and Stanton et al (2010).

Maximum ambient noise 45 dB LAeq,y

Approx. 52% respondents exposed to higher levels

49.7 dB(A)

Air Quality Office environment survey (Hedge, 2005).

Fewer than 30% of respondents cite specific air quality issues and symptoms

6/9 issues identified (67%). 12/14 issues identified (86%)

Lighting Discomfort glare flowchart (Boyce, 2005).

Rating of ‘discomfort glare unlikely’

12/25 (48%) rated discomfort glare as likely

discomfort glare unlikely’

Visual Clarity

Consistency

Compatibility

Informative Feedback

ExplicitnessAppropriate Functionality

Flexibility and Control

Error Prevention and Correction

User Guide and Support

12345

Off ShoreOn ShoreNeutral

Figure 4– Results of Ravden and Johnson (1989) Human Computer Interaction (HCI) checklist for off-shore control rooms (dotted line) and on-shore comparison (solid line).

System Usability

The surveyed control room operators perform a number of duties in their workplace. All

respondents were in charge of the fire and gas displays, 88% were in charge of Emergency Shut

Down (ESD) and 56% in charge of equipment monitoring (e.g. pumps and compressors). Just under

half of respondents (48%) were in charge of CCTV, and 40% in charge of sand monitoring. All of

these functions/duties rely on a SCADA system and concomitant control room displays and

interfaces. The Ravden and Johnson (1989) Human Computer Interaction (HCI) checklist was applied

to these systems to provide an assessment of their overall usability. Figure 4 presents the results of

this analysis for both off and on-shore control room domains.

Again, despite very marked differences in the on and off-shore situation, the users in each context

rated each system very similarly. All usability scales achieved neutral ratings or greater, revealing no

subjectively felt ‘serious’ system deficiencies. Two differences did emerge, however, between the

on and off-shore control rooms. The former case scored more highly in terms of flexibility and

control, and on error prevention. Further insight into these differences was derived from the survey.

A common problem concerned the availability, recency and relevance of hard copy manuals. Whilst

the automation is now capable of running many of the routine operations the ‘classic’ irony is that

the human operator is increasingly relied upon to diagnose and remedy non-routine conditions. As

such, problem-solving resources such as manuals and help menus assume a higher importance than

might at first be assumed by the designers of specific software applications. For example, help

menus were cited as providing generic system instructions rather than detailed guidance specific to

a particular installation.

Another common criticism was the lack of adequate system memory to store a large number of

trends. Trends are another important tool in non-routine operations of the sort that now fall to

control room operators. Additional memory adds more cost to the system and it was pointed out

that the designers at the project phase decided how much was enough, which manifested itself as

the minimum. This severely hampered historical storage of trends, meaning that a useful trend that

had been set up and could be used quickly and easily again in the future had to be erased if another

was required. Lack of memory also limited the amount of system history, resulting in parameters

the project designers decided were low priority only being viewable in “real time” only. This lack of

history can add workload to the operator when trying to determine the cause of an upset or

incident.

Alarms were another area of concern identified by the HCI checklist. Alarms, in combination with

trend information and help resources, are another critical aspect of the ability for humans to

interface with non-routine conditions via the control room systems. Free text entries provided by

survey respondents reveal the extent of the issue:

“The alarm system is currently under revision to cut down on the number and frequency of the

alarms generated. Just about any fault condition is alarmed on the panel (including things like

ventilation alarms when someone fails to use the airlocks correctly).”

“Unfortunately when in a 'process trip' condition the sheer amount of alarms coming through the system makes conversation almost impossible for the first few minutes, this being the time when you would most like to communicate with each other [or]outside ops.”

“600 -700 standing alarms at any one time. The configuration is also poor, equipment offline is

constantly in alarm. System scan speed is also very slow so there are no first-up alarms to indicate

the cause of a shut down.”

“Level alarms are another source of 'nuisance' alarms, a level bouncing around its alarm point when

accepted will clear, then come into alarm again seconds later, there is no facility to hold an alarm in

a 'silenced but not accepted' state, so silencing these alarms becomes a regular and tedious process.”

These issues were well represented overall in the results of the survey, as shown in Table 2. More

than 70% of the ratings given to the following statements were negative:

Table 2 – More than 70% of the ratings received from the sample (n=25) were negative in respect to the following specific items

Survey Item Response (n = 25)

“Alarm numbers can frequently add to stress levels” 80% agreed

“We work to EEMUA guidelines for numbers of alarms” 75% disagreed

“A high proportion of alarms are regarded as nuisance alarms” 75% agreed

“A high proportion of alarms are regarded as low priority alarms” 88% agreed

“Multiple alarms can cause confusion and have been missed” 83% agreed

The evidence from the survey is that control room operators are ‘working around’ this issue. Its

continued presence, however, represents an area of concern given the safety legacy of Piper Alpha

which specifically raised the issue of alarms (e.g. Cullen, 1990).

CONCLUSION

The challenges inherent in performing any form of ergonomic analysis in off-shore situations are

great. This paper has described the activities performed in order to provide just such an analysis

over a large proportion of control rooms functioning on North Sea facilities at the present time. The

situation is, in many ways, unique. That being said, some of the fundamental ergonomic issues are

very familiar. In particular, the ‘co-evolved’ nature of the control room and its users is a particularly

marked feature of the present analysis and one which greatly influences the interpretation of the

results. The results show that despite very obvious differences between on and off-shore control

room environments the ratings for environmental ergonomics and overall system usability were

striking more for their similarities than their differences. A trap that many ergonomic analyses fall

into is to focus on the latter rather than former.

The reason many Ergonomic analyses can lack credibility is because of legacy, expertise and the fact

that “people using the [system] interpret it, amend it, massage it and make such adjustments as they

see fit and/or are able to undertake” (Clegg, 2000, p. 467). The collection of working practices,

accumulated experience, norms and behaviours that result from this can inadvertently be done

away with through an overly simplistic ergonomics analyses in much the same way that they can be

swept aside by step changes in technology. This is why current thinking in the field, as exemplified

by BS/EN/ISO13407:1999, strongly advocates a ‘systems approach’. A systems approach to

ergonomic interventions would view the off-shore control room as something which has evolved to

its present state and would require careful evolution to a desired future state, building on the

accumulated experience, norms, behaviours etc. and involving users in a process of iterative design.

Whilst on the one hand the inherent ‘adaptive capability’ of humans in control room settings yields a

set of generally positive results, on the other hand there are several findings which suggest areas

where that ‘adaptive capacity’ is being tested, and which should form the focus of future work.

The first area concerns the changing nature of the control room task. With greater degrees of

automation the role of the human operator is increasingly oriented around dealing with non-routine

situations. The results of the survey suggest that greater support could be provided to help

operators perform this function. This includes specific and up to date guidance material,

comprehensive system ‘help menus’, an improved alarm philosophy and possibly consideration of

‘non-technical skills’ and how best to train them.

The second area also arises from the changing nature of the control room task and greater levels of

automation. The off-shore control centre seems to have evolved into a central place for all activities.

It is often the only location manned 24 hours a day and so is the ‘obvious’ focal point for activities.

Routine automatic operation lends itself to this situation; the management of abnormal situations

does not.

In these critical areas it would appear that the ability of human operators to adapt to their new role

and situation is potentially reaching its limits and requires further investigation in order to derive

contextually sensitive, and therefore effective, ergonomic interventions.

ACKNOWLEDGEMENTS

Shell U.K. Oil Ltd. for sponsoring the original independent research. Representatives from Shell UK

Oil, Bluewater, Maersk, BG Group, Nexen, Talisman, Energy and TAQA. The Step Change in Safety

Organisation who circulated the questionnaire.

REFERENCES

Bainbridge, L. (1982). Ironies of automation. In J. Rasmussen, K. Duncan, & J. Neplat (Eds.), New Technology and Human Error. New York: Wiley.

Boyce, P.R (2005) Evaluating office lighting. In N.A. Stanton, A. Hedge, K. Brookhuis, E. Salas, and H. Hendrick (Eds.), Handbook of Human Factors and Ergonomics Methods. Boca Raton, FL: CRC Press.

British Standards Institute BS 5940-1: 1999. Office furniture - Part 1: Specification for design and dimensions of office workstations, desks, tables and chairs. London: BSi

BS EN ISO 7730:1995. Moderate thermal environments – Determination of the PMV and PPD indices and specification of the conditions for thermal comfort. London: BSi

BS EN ISO 13407: 1999. Human-centred design processes for interactive systems. London: BSi

British Standards Institute BS 7445-1:1991 ISO 1996-1:1982. Description and Measurement of Environmental Noise — Part 1: Guide to quantities and procedures. London: BSi

British Standards Institute BS EN ISO11064-Parts 1-7 1991-1995. Ergonomic Design of Control Centres. London: BSi

Cooper, G.E., White, M.D., & Lauber, J.K. (1980). Resource management on the flightdeck. Proceedings of a NASA/Industry Workshop (NASA CP-2120).

Cullen, Lord (1990) The Public Enquiry into the Piper Alpha Disaster. London: HMSO

Clegg, C. W. (2000). Sociotechnical principles for system design. Applied Ergonomics, 31, 463-477.

EEMUA 191 (2007) Alarm Systems. A Guide to Design Management & Procurement. Publication No.191 Edi 2. Eastbourne: CPI Anthony Rowe.

Flin, R., Mearns, K., O’Connor, P. & Bryden, R. (1996). Measuring safety climate: identifying the common features. Safety Science, 34, 177-192.

Hart, S.G., & Staveland, L.E., (1988). Development of a multi-dimensional workload rating scale: Results of empirical and theoretical research. In P. A. Hancock & N. Meshkati (Eds.), Human Mental Workload. Amsterdam. The Netherlands. Elsevier.

Hedge, A (2005) In Handbook of Human Factors and Ergonomics Methods, Stanton, N.A. et al., Eds., CRC Press, Boca Raton, FL, pp. 604–617.

Hollnagel, E. & Woods, D. D. (2005). Joint cognitive systems: Foundations of cognitive systems engineering. London: Taylor & Francis.

Kelly, K. (1994). Out of control: The new biology of machines, social systems, and the economic world. New York: Purseus.

Kragt, H. (1992). Introduction to enhancing industrial performance. In Kragt, H. (Ed). Enhancing industrial performance. London: Taylor & Francis.

Kaber, D. B. & Endsley, M. R. (2004). The effects of level of automation and adaptive automation on human performance, situation awareness and workload in a dynamic control task. Theoretical Issues in Ergonomics Science, 5(2), 113 – 153.

Licklider, J. C. R (1960). Man-computer symbiosis. IRE Transactions on Human Factors in Electronics, HFE-1, 4-11.

Moray, N. 2004. Ou’ sont les neiges d’antan?. In D. A. Vincenzi, M. Mouloua, & P. A. Hancock (Eds.), Human Performance, Situation Awareness and Automation; Current Research and Trends. (Mahwah, NJ: LEA).

Norman, D. A. (1990). The ‘problem’ with automation: inappropriate feedback and interaction, not ‘over-automation’. Philosophical Transactions of the Royal Society of London, B 327, 585-593.

Noyes, J and Bransby, M (2001) People in Control. Human factors in control room design. London : The Institute of Electrical Engineers.

Ravden, S and Johnson, G (1989) Evaluating usability of human-computer interfaces: a practical method. New York: Halsted Press

Rundmo, T. (1992a) Risk perception and safety on offshore petroleum platforms - Par II: Perceived risk, job stress and accidents. Safety Science 15, 53 - 68.

Rundmo, T. (1992b) Risk perception and safety on offshore petroleum platforms - Part I: Perception of risk. Safety Science, 15, 39 - 52.

Rundmo, T. (1993) Occupational accidents and objective risk on North Sea offshore installations Safety Science, 17, 103 - 116.

Rundmo, T. (1996) Associations Between risk perception and safety. Safety Science 24, 107 - 209.

Rundmo, T., Hestad, H. & Ulleberg, P. (1998) Organizational factors, safety attitudes and workload among offshore oil personnel. Safety Science, 29, 75 - 87.

Sanders, M. S. & McCormick, E. J. (1992). Human factors in engineering and design. Maidenhead, UK: McGraw-Hill.

Stanton, N. A.; Chambers, P. R. G. & Piggott, J. (2001) Situational awareness and safety. Safety Science 39 189-204.

Stanton, N. A. & Marsden, P. (1996). From fly-by-wire to drive-by-wire: Safety implications of automation in vehicles. Safety Science, 24, (1), 35-49.

Stanton, N. A., Salmon, P., Jenkins, D. & Walker, G. (2010). Human factors in the design and evaluation of central control room operations. Boca Raton, FL: CRC.

Toftum, J. (2005). Thermal comfort indices. In N. A. Stanton, A. Hedge, K. Brookhuis, E. Salas, & H. Hendrick. (Eds.), Handbook of human factors and ergonomics methods. Boca Raton, FL:CRC Press.

Woods, D. D. & Cook, R. I. (2002). Nine steps to move forward from error. Cognition Technology and Work, 4(2), 137-144.

Zuboff, S. (1988). In the age of the smart machine: the future of work and power. London: Heinemann.