All at Sea: An Ergonomic Analysis of Oil Production Platform Control Rooms.

Dr Guy H. Walker, Steve Waterfield MSc & Dr Pauline Thompson

Institute for Infrastructure and the Environment (IIE),

School of the Built Environment, Heriot-Watt University, Edinburgh, EH14 4AS

ABSTRACT

Control rooms on offshore production platforms are the focal point for their safe and efficient
operation. Following the Piper Alpha disaster in 1988 a sizeable body of safety literature was
generated covering the ergonomic issues then in play. More than twenty years have passed since
that time and significant changes have occurred to how control rooms are manned and the
technology now in use. As the North Sea oil industry in the UK enters a new phase in its life cycle,
and becomes subject to unprecedented production and cost pressures, it is time to revisit these
issues. This paper reports on an ergonomic survey covering approximately a third of all North Sea
control rooms. The focus is on the adaptive capacity of the highly experienced control room
operators and the current challenges to that capacity. Areas of concern include the support
provided for dealing with non-routine events, the persistent issue of ‘alarm overload’, the flexibility
and control of current SCADA systems, the use of control rooms for non-related tasks and personnel,
and the possible role of non-technical skills training.

Keywords: Control room design, surveys, systems ergonomics

 INTRODUCTION

Background and Context

UK oil production is centred in the North Sea. It encompasses a region to the North East of the
Shetland Islands, the East Shetland Basin, then South to an area off the coast of Norfolk with an
Eastern boundary abutting the UK Continental Shelf. Offshore oil installations in this area are
remote (up to 180 miles offshore) with high hazard potential. High pressure flammable and volatile
materials are present and many hazardous operations, such as drilling, need to be carried out in a
limited space. Many installations have a large number of people living in close proximity to these
hazards and staff normally fly in and out by helicopter. As such, there are major potential hazards to
both life and the environment and clear safety issues. Indeed, if these installations were onshore
they would be designated as top tier COMAH (Control of Major Accident Hazards) sites.

In broad terms nearly all of the off shore installations have common facilities of relatively simple
engineering design. Most production platforms incorporate systems and infrastructure for oil, gas
and water separation, gas dew point conditioning, gas compression and export, crude oil export and
produced water disposal. The focal point for the monitoring and control of these processes, and the
accompanying safety systems, is the control room. This is one of the key interfaces at which humans
in these systems are able to intervene in the large scale mechanical and technical processes, an
interface whose importance has been highlighted by notable accidents such as Piper Alpha, Texas
City and Three Mile Island. Clearly, ergonomics issues are important in getting this interface right,
but ergonomics issues are modified by a number of features unique to the users of the control room
and to the context they find themselves in.

The first is that oil has been extracted from the North Sea in bulk since only the mid-1970s and from
the outset it was without precedent in the UK. As a result, many of the founding principles emerged
as a series of ‘bolt-ons’ from other sectors. For example, the installations were at sea so there was a
prominent marine aspect. The installations were also challenging to construct, so there was a
prominent civil engineering aspect. The installations were also heavily focussed around well and
drilling technology, so this too dominated. Put simply, the main technical challenge was on getting
the facilities in place and in production, and expertise from these and similar backgrounds
dominated in the design process.

The second issue is the disconnect between the on and off-shore context. Effectively the situation is
one of a large number of people living in close proximity to a hydrocarbon drilling and processing
operation with no easy means of escape should an emergency occur. It is extremely unlikely that
onshore planning regulations would allow population centres to be as close to such plants as is
effectively the case offshore, and COMAH regulations do not apply. Likewise, the UK Health and
Safety Executive (HSE) had no direct jurisdiction until the late 1980’s (after the Piper Alpha disaster;
Cullen, 1990), the industry being managed previously by shipping and maritime agencies.

The third issue is lifecycle. Many valuable works on the ergonomics of offshore control rooms were
published in the aftermath of Piper Alpha (e.g. Rundmo 1992a, b, 1993, 1996; Rundmo & Hestad &
Ulleberg, 1998; Flin et al., 1996 etc.) when the industry was approximately fifteen to twenty years
old. At the time of writing the industry is approximately forty years old and several significant
developments in control room design have emerged since then, including greater degrees of
automation and more advanced Supervisory Control and Data Acquisition (SCADA) systems.

In summary, the offshore industry is characterised by a very distinct design legacy, an unusually high
hazard context, a different set of standards compared to on-shore installations, and has been
subject to developments in control room design that have not been significantly revisited from an
ergonomics point of view since the flurry of published work post-Piper Alpha. This paper aims to
explore these issues by providing an up to date survey of control room ergonomics, comparing on
and off-shore locations and leveraging the new ergonomics knowledge that has also emerged in the
previous twenty years.

Evolution of the Control Room

Off shore control rooms describe a ‘classic’ trajectory from local automatic control to Supervisory
Control and Data Acquisition (Kragt, 1992). In the early period of the off-shore oil industry, control
rooms were usually basic monitoring stations with instruments only giving indications of measured
values in the field. First generation control rooms slowly evolved into having pneumatic or electro-
pneumatic instrumentation that allowed local automatic control of the more critical parts of the
processes, usually supported by large annunciator panels. In this case each instrument needed a
discreet set of components and wiring to convey the information to and from the control point to
the end element, which meant that each control loop was a single entity and could only carry out its
specific ‘hardwired’ function. Despite the inevitable crudities and inefficiencies of hard wired
controls and annunciator panels they did embody some (usually inadvertent) ergonomic advantages.
For example, operators could get a very quick appreciation of the state of the plant simply by the
amount of light being given off by the panel. The relative lack of automation required the operators
to continuously engage with the control systems, thereby helping them to track the dynamics of
evolving situations (Kaber & Endsley, 2004; Moray, 2004; Stanton, Chambers & Piggot, 2001;
Norman, 1990) which, in turn, was facilitated by ‘hard-wired’ controls that provided a relatively
simple and direct action-feedback loop (e.g. Norman, 1990; Zubof, 1988; Stanton & Marsden, 1996).
The disadvantage, of course, was the reliance placed on operator vigilance, the implications of high
workload, the need to maximise process efficiency and the relatively small scale of operations that
one (or a few) operators could manage at any one time (Kragt, 1992). As such, during this period
basic overview SCADA (Supervisory Control and Data Acquisition) systems began to appear. These
took in data from a wider range of systems and sensors and allowed trends of certain parameters to
be followed more closely. These systems were not capable of full remote control and this situation
remained until the late 1980s. As a ‘proof of concept’ and a demonstration of technological
capability, however, these early SCADA systems were successful and ultimately led to second and
third generation control rooms.

Second and third generation control rooms made use of the widespread availability of
microcomputers and distributed control systems (DCSs) and began to emerge in off-shore locations
from the late 1980’s onwards. The human interaction with these systems shifted from annunciator
panels and hard-wired controls to computer screens and keyboards, creating new ergonomic
possibilities but removing others. The wider range of activities these systems now interfaced with
also required greater degrees of team working, again, creating new opportunities for coordination
and cooperation but requiring this of personnel traditionally used to lone-working. In other safety
critical industries, such as aviation, this issue has been recognised and initiatives such as Crew
Resource Management (CRM) and training in ‘non-technical skills’ have been in existence for some
time (e.g. Cooper, White & Lauber, 1980).
On the one hand, second and third generation systems represented a ‘step change’, but on the other
hand they were a ‘bolt on’: they did not completely replace elements from the annunciator panels or
all hard-wired controls, thus in many cases the control room that emerged was a hybrid of new and
legacy equipment. Operators, due in large part to their domain experience, were required and
seemingly able to adapt to this new situation. In third generation systems even greater
centralisation is possible. The situation today is that control of an offshore plant can be assumed
from an on-shore location meaning that unmanned, remotely operated installations are now
common.

The modern production platform control room is now, in theory, a high tech SCADA centre with
efficient and capable computer systems and a wealth of information available to the control room
operator, as shown in Figure 1. The SCADA system can keep track of individual control circuits,
alerting the operator to failure of components long before they cause further problems. The
primary task of the system is to continuously control the production process, which it can do for
extended periods of time without any human input. These technological changes have inevitably
changed the role of the control room operator, altering their workload, their perception of system
states and requiring them to work as part of a larger distributed team. It has also changed the role
of the local control room. It is still in place in offshore locations, still important for plant safety,
equipped with a mixture of legacy and new equipment, and because of increased automation is
increasingly used for additional purposes.
 Figure 1 – Typical offshore control room

Ergonomic Issues

The trajectory traced by first, second and third generation offshore control rooms is a familiar one.
Hollnagel and Woods (2005) describe it as a self-reinforcing complexity cycle. The cycle begins with
new technology creating a perceived deficiency in an existing system. SCADA, for example, ‘affords’
new functionality like remote control, greater efficiency and reduced costs compared to hardwired
controls and annunciator panels. This apparent lack of capability is answered by expanding the
systems’ functionality by ‘bolting on’ the extra capability. This, in turn, creates a new and more
complex system that has been pushed “back to the edge of the performance envelope” (Woods &
Cook, 2002, p.141). A characteristic of this self-reinforcing cycle is that the user is often left “with an
arbitrary collection of tasks and little thought may have been given to providing support for them”
(Bainbridge, 1982, p. 151). As a result, human adaptability is required in order for these systems to
work as intended which, in turn, creates new ‘opportunities for malfunction’. Hollnagel and Woods
clarify this point: “by this we do not mean just more opportunities for humans to make mistakes but
rather more cases where actions have unexpected and adverse consequences” (2005, p. 5). The
response to situations such as these is to change the functionality of the system again, from second
to third generation control rooms for example, thus completing the self-reinforcing cycle shown in
Figure 2.
 Figure 2 – Hollnagel and Woods (2005) self-reinforcing complexity cycle

The implied task for the human operators is to track the dynamics of this evolving context. This
situation is again a familiar one. A well-worn maxim in Ergonomics is that ‘it is easier to twist metal
than it is to twist arms’ (e.g. Sanders & McCormick, 1992), in other words, it is easier to adapt a
system to its user than to insist on adapting users to a system. At one level this represents the
definition of Ergonomics itself, i.e. ‘matching products, systems, artefacts, infrastructures and
environments to the capabilities and limitations of humans’. When interpreted literally, however, it
tends to presuppose that users do not change and that the system (and user) can be seen in
isolation from their environment. An alternative way of viewing the ‘twisting metal versus arms’
dialectic is to see it as an almost necessarily antagonistic process, such that there is “reciprocal
evolutionary change” (Kelly, 1994, p. 74), or a little of both metal and arm twisting. Users have their
‘arms twisted’ by having to adapt to a new system, in turn, the system has a little more of its ‘metal
bent’ to suit new needs that arise from this adaptation, which creates more new needs, more arm
twisting and more metal bending, projecting forward in a co-evolutionary spiral until the original
system becomes very different from its original form. Indeed, when surveying the evolutionary
timeline of off-shore control rooms it is clear that it says as much about what the control room has
done to users as the users have done to the control room. Both have become locked into a single
system, “Each step of co-evolutionary advance winds the two antagonists more inseparably, until
each other is wholly dependent on the other’s antagonism. The two become one” (Kelly, 1994, p.
74; Licklider, 1960). Because of this there is a great danger of ‘ergonomic-naivety’: it becomes very
easy to identify ergonomic shortcomings when compared to various ‘normative’ standards, but that
is to miss entirely the contextual features of the system and the expertise of the users, both of which
are vital to effective and sensible ergonomic interventions.

Figure 3 – Technology creates new capabilities for control room technology. Operators adapt to these capabilities,
creating new needs and aspirations which, in turn, manifest themselves as new deficiencies in the system which go on to
prompt more new technology, more complex systems and new opportunities for problems to arise.

Exploratory Hypothesis

There are two approaches that can be taken towards an ergonomic analysis of offshore control
rooms. The first is to embark on a ‘normative’ analysis, simply comparing the current state of affairs
against established best-practice and legislation. The second is to acknowledge the uniqueness of
the situation, the evolved nature of the technology and the expertise of the persons at work in this
setting. As such the question is more subtle. It is about the extent of adaptation, the ability of
control room operators to track the co-evolving dynamic of technology and their use of it, and
furthermore, to consider the exact nature of that adaptability and its limits. The broad hypothesis
put forward in this article is novel: if the humans in this situation are tracking the dynamics of this
co-evolving situation then, despite appearances to the contrary, off-shore control rooms should
emerge as ergonomically comparable to a brand new, on-shore, state of the art control room
designed against modern ergonomic guidelines. Any shortcomings revealed by the normative
analysis will help to provide insights into the limits of this adaptation and help designers to ensure
that users are being supported in a way that is not ‘ergonomically naïve’ but sensitive to their
context and to the expertise control room operators bring to the situation.

METHOD

Design

Experienced members of control room staff aboard North Sea production facilities completed a
control room survey based on existing measures and techniques. Their responses were anchored to
a control condition comprised of the same assessments performed on a land-based SCADA control
room. The questionnaire was compiled, adjusted to the domain in question, piloted, administered
and interpreted by a control room operator with 30 years of industry experience. This ensured high
levels of access to front-line personnel who completed the survey within the actual working
environment. The survey included guidance notes and a pre-briefing, and was designed and
administered according to established ethical guidelines.

Participants

Twenty eight control room operators took part in the survey. They were spread across 25 different
installations, covering a broad range of North Sea locations, operating companies and facilities. The
participants were approximately 60th percentile males (mean height = 180 cm, SD = 6 cm) with a
mean age of 39 years (SD = 8.63 years). A very high level of industry experience was in evidence,
with a mean of 18 years (SD = 9.96 years) working in the industry, and a mean of 8.5 years (SD = 7.2
years) working in control room environments specifically. The majority of participants had a
background in either production and operations (43%) or else instruments (36%). A much smaller
percentage derived from electrical or mechanical trades (8%). 54% occupied permanent control
room positions whilst 39% reported that they occupied rotational positions.

Methodology
The questionnaire method combined the construct validity of existing techniques with the ecological
validity of in-depth domain experience. The assessment instrument that arose from this process is
as follows:

Section 1: People

This section contained demographic information including age, experience, height, technical and
educational background.

Section 2: Environment

This section extracted data on subjective impressions of thermal comfort using the Predicted Mean
Vote (PMV) scale (Toftum, 2005). Information on the clothing normally worn in the control room
environment was also gathered which, in turn, permitted the Predicted Percentage Dissatisfied
(PPD) to be calculated (e.g. BS ISO 11064-6:2005). Subjective ratings of sound level (and their
primary source) were gathered via a checklist using examples from Stanton et al. (2010). An
assessment of air quality relied upon the Cornell Office Environment Survey (Hedge, 2005), whilst an
assessment of lighting proceeded on the basis of Boyce’s (2005) Discomfort Glare Flowchart.

Section 3: Control Room Context

This section was based on industry experience and a pilot study. It enabled participants to rate the
presence or absence of discrete control room features such as whether it was regarded as a safety
critical area, whether it was clean or dirty and the number of operators normally present. Other
multiple choice questions probed activities that operators were responsible for, the nature and type
of control panels and the types of communications systems installed (and used).

Section 4: System Usability

This section was based upon Ravden and Johnson’s HCI Checklist (1989) and the NASA Task Load
Index (TLX; Hart & Staveland, 1986). Ravden & Johnson’s (1989) HCI checklist comprises ten sections
of questions designed to assess the overall usability of a computer based system. The ten sections
refer to visual clarity, consistency, compatibility, feedback, explicitness, functionality, flexibility, error
prevention, user support and usability. The NASA Task Load Index (NASA TLX; Hart and Staveland,
1986) was used to measure participant MWL during task performance. The NASA TLX is a multi-
dimensional rating tool that is used to derive an overall workload rating based upon a weighted
average of six workload sub-scale ratings.

Section 5: Overrides, Procedures and Alarms

This section was based on a mixture of industry experience and question items from EEMUA 191
(2007). EMMUA (the Engineering Equipment and Material Users’ Association) is an industrial
association of leading national and multinational organisations in the petroleum, oil, gas, chemical
and energy industries. The EEMUA shares resources and expertise with the aims of improving
effectiveness and efficiency in their respective organisations. The EEMUA guides (of which EEMUA
191 is an example) encapsulate best industrial practice and are therefore an excellent basis for a
review of existing systems or a basis for design of new systems.

Procedure

The opportunities to conduct the form of control room survey that would be appropriate in on-shore
situations are severely limited in off-shore situations. Physical access to geographically disperse off-
shore sites is via helicopter or boat, and thus difficult and costly. The high hazard nature of the
industry also does not permit easy access to non-industry (human factors) specialists, neither is the
workplace amenable to the type of physical measurements and analyses normally performed (the
control rooms are often in use 24 hours a day and far from spacious). The strategy employed in this
study to grant access to this domain was to design a survey instrument that remained theoretically
valid, yet could be easily completed by front-line operators in their place of work. This strategy was
enacted as follows:

A methods review identified a selection of existing ergonomic instruments which met the following
criteria:

 Ease of use
 Little or no subsidiary equipment required
  Construct validity (applicability to domain in question).

The selected measures were then compiled into one survey instrument. In order to check that these
compiled standard instruments were compatible with how personnel in this context understood
them, and to identify areas that required more domain specific questions, a pilot study was
performed in one off-shore location, and enhancements identified.

Revisions to the questionnaire were performed (including re-ordering of sections, additional

questions, further clarification etc.) using a team comprised of human factors specialists and a
control room operator of 30 years’ experience. Solutions were developed that ensured
compatibility with the domain in question whilst retaining construct validity. Fifty of the final
questionnaires were sent to the desired locations/personnel, and 28 questionnaires were returned,
a response rate of 56%. There are in the region of 90 fixed installations in the North Sea, thus the
responses capture approximately 33% of all North Sea control rooms.

The use of standard ergonomic instruments grants an opportunity to compare the results with an
on-shore SCADA control room. This analysis was performed in the pre-commissioning stages of a
new facility, and was carried out by HF specialists prior to the off-shore work.

RESULTS AND DISCUSSION

The Control Room Environment

The off-shore control rooms contain a number of common features. All are equipped with fixed
desks, 75% of which are either above (25%) or below (60%) the 705 to 735mm height specified by
BS5940-1 (1999). This represents a particular concern in that the participants were approximately
60th percentile males (mean height = 180 cm, SD = 6 cm). 52% of the control rooms surveyed were
designated as ‘dirty areas’ which means that personnel are permitted to enter from the plant
without cleaning, changing or removing work clothes. In 44% of cases the control room also serves
as a supervisor’s office, and as a place where permits to work are administered (56%). Whilst in the
majority of cases (68% dayshift, 72% nightshift) the control room is manned by one control room
operator, 76% of respondents indicated that other people are in the control room ‘frequently’. 80%
of these people (from the operators point of view) are ‘just passing through’, 72% of ‘other people’
are at work on other work stations. The number of additional personnel and activities now
performed in the control room was consistently highlighted as an area for concern, especially given
that 72% of the control rooms surveyed were designated as safety areas.

The results of the control room environment measures are summarised in Table 1. Despite first
impressions to the contrary the off-shore control room environment is felt to be relatively benign in
terms of thermal characteristics but potential issues with noise, air quality and lighting were
detected. It is important to note, however, that when asked the relatively unambiguous question
“do you consider the work area to be comfortable?” 77% of respondents answered ‘yes’.

Thermal Environment

Twenty five of the twenty eight participants self-rated themselves against the seven-point Predicted
Mean Vote (PMV) scale, ranging from -3 (too cold) to +3 (too hot). The goal is to achieve a thermally
neutral situation (a rating of 0) whereby the heat generated by activity and metabolism (as affected
by clothing insulation) is in balance with the heat loss due to the temperature differential of the
room. In this environment control room operators undertake sedentary or light work (a metabolic
rate of approximately 70 – 90W/m2) with 96% reporting that they wear light or indoor clothing. The
Percentage Persons Dissatisfied (PPD) technique provides a method for coupling these PMV ratings
to population-level Percentage Persons Dissatisfied (PPD) estimates (BS ISO 7730, 1995). The mean
PMV = 0.29 which equates to 8% PPD. The comparable results for the on-shore SCADA control room
were PMV = 0.82 which equates to 12% PPD. In both cases, the mean PMV is biased by a small
amount towards warmer thermal sensation, despite light clothing being worn. Based on this
analysis it is safe to conclude that significant problems with the thermal environment in both
locations were not detected. The only exception to this was the 36% of respondents who indicated
that, contrary to BS11064:6 (1995), they did not have control over the ambient temperature.
Noise

Due to the restrictions in terms of access and lack of specialist equipment, assessment of noise in
the off shore control rooms proceeded on the basis of a self-rating technique. Control room
operators rated the ambient noise against a five point scale ranging from 40dB (the example given
being a ‘quiet office’) up to 80dB (the example given being a ‘power drill’). BS EN ISO 11064-6 (2005)
stipulates that ambient noise in control room environments should not exceed 45 dB LAeq,y, thus self-
ratings above scale point 3 (50db normal office) are taken to be indicative of noise related
shortcomings. According to this crude measure, 52% of the control rooms appear outside of
recommended ambient noise levels. 56% of respondents cited the primary cause of ambient noise
as ventilation equipment, followed by 40% citing the control room equipment itself. Interestingly,
only 12% cited external noise sources.

Air Quality

Elements from Hedge’s (2005) office environment survey were incorporated into the off-shore
survey instrument. Two five point subjective rating scales were provided. The first enabled direct
ratings of air quality properties (such as dryness, dustiness etc.), the second used air quality
‘symptoms’ (such as sore throat, fatigue etc.) from the office environment survey. Whilst 28% of
respondents rated air quality as ‘fine’, 44% indicated that the air was ‘too dry’, 24% noted ‘low flow’
and 12% noted ‘dusty’. The physical symptoms experienced by control room operators were all
approximately equally rated. Thus between 48 and 60% had experienced sore eyes and throats,
runny noses, fatigue and headache in the past 4 weeks. Whilst these health effects may not be
directly caused by the control room, they are present within it and provide clues for design
interventions that could ameliorate them.

Lighting

The discomfort glare procedure (Boyce, 2005) was employed as a quick and effective way of
assessing the suitability of lighting in the control room environment. The results indicate that in
nearly half of the control rooms (48%) discomfort glare is likely, based on an office lighting survey
completed by operators, an assessment of reflections and lighting sources. 36% of respondents also
indicate that VDU light reflection is an issue, whilst 12% indicated strip light flicker. The majority of
display types (80%) are LCD.
Table 1– Summary of control room environment measures (shaded cells indicate evidence of lack of compliance with HF best practice)

Description of Measure HF Best Practice Off Shore Control Rooms On Shore Control Room
Thermal Environment Predicted Mean Vote (PMV) is a PMV = 0 (thermally neutral) 0.29 0.82
subjective measure of thermal
comfort ranging from -3 (cold) to +3
(hot).
Percentage Persons Dissatisfied PPD < 10 % 8% 12%
(PPD) enables PMV values to be
mapped onto population-level
ratings of thermal comfort.
Control room operators should be Temperature control(s) 36% of control rooms not Yes
able to control the temperature in installed equipped
the control room.
Noise Self-rating of noise sources according Maximum ambient noise 45 Approx. 52% respondents 49.7 dB(A)
to criteria contained in BS7445-1 dB LAeq,y exposed to higher levels
(1991) and Stanton et al (2010).
Air Quality Office environment survey (Hedge, Fewer than 30% of 6/9 issues identified (67%). 12/14 issues identified
2005). respondents cite specific air (86%)
quality issues and symptoms
Lighting Discomfort glare flowchart (Boyce, Rating of ‘discomfort glare 12/25 (48%) rated discomfort glare
2005). unlikely’ discomfort glare as likely unlikely’
 Visual Clarity
5
User Guide and
4 Consistency
Support

Error Prevention and 2 Off Shore

Compatibility
Correction
1 On Shore
Neutral

Flexibility and Control Informative Feedback

Appropriate
Explicitness
Functionality

Figure 4– Results of Ravden and Johnson (1989) Human Computer Interaction (HCI) checklist for off-shore control rooms (dotted line) and on-shore comparison (solid line).
System Usability

The surveyed control room operators perform a number of duties in their workplace. All
respondents were in charge of the fire and gas displays, 88% were in charge of Emergency Shut
Down (ESD) and 56% in charge of equipment monitoring (e.g. pumps and compressors). Just under
half of respondents (48%) were in charge of CCTV, and 40% in charge of sand monitoring. All of
these functions/duties rely on a SCADA system and concomitant control room displays and
interfaces. The Ravden and Johnson (1989) Human Computer Interaction (HCI) checklist was applied
to these systems to provide an assessment of their overall usability. Figure 4 presents the results of
this analysis for both off and on-shore control room domains.

Again, despite very marked differences in the on and off-shore situation, the users in each context
rated each system very similarly. All usability scales achieved neutral ratings or greater, revealing no
subjectively felt ‘serious’ system deficiencies. Two differences did emerge, however, between the
on and off-shore control rooms. The former case scored more highly in terms of flexibility and
control, and on error prevention. Further insight into these differences was derived from the survey.

A common problem concerned the availability, recency and relevance of hard copy manuals. Whilst
the automation is now capable of running many of the routine operations the ‘classic’ irony is that
the human operator is increasingly relied upon to diagnose and remedy non-routine conditions. As
such, problem-solving resources such as manuals and help menus assume a higher importance than
might at first be assumed by the designers of specific software applications. For example, help
menus were cited as providing generic system instructions rather than detailed guidance specific to
a particular installation.

Another common criticism was the lack of adequate system memory to store a large number of
trends. Trends are another important tool in non-routine operations of the sort that now fall to
control room operators. Additional memory adds more cost to the system and it was pointed out
that the designers at the project phase decided how much was enough, which manifested itself as
the minimum. This severely hampered historical storage of trends, meaning that a useful trend that
had been set up and could be used quickly and easily again in the future had to be erased if another
was required. Lack of memory also limited the amount of system history, resulting in parameters
the project designers decided were low priority only being viewable in “real time” only. This lack of
history can add workload to the operator when trying to determine the cause of an upset or
incident.

Alarms were another area of concern identified by the HCI checklist. Alarms, in combination with
trend information and help resources, are another critical aspect of the ability for humans to
interface with non-routine conditions via the control room systems. Free text entries provided by
survey respondents reveal the extent of the issue:

“The alarm system is currently under revision to cut down on the number and frequency of the
alarms generated. Just about any fault condition is alarmed on the panel (including things like
ventilation alarms when someone fails to use the airlocks correctly).”

“Unfortunately when in a 'process trip' condition the sheer amount of alarms coming through the
system makes conversation almost impossible for the first few minutes, this being the time when you
would most like to communicate with each other [or]outside ops.”

“600 -700 standing alarms at any one time. The configuration is also poor, equipment offline is
constantly in alarm. System scan speed is also very slow so there are no first-up alarms to indicate
the cause of a shut down.”

“Level alarms are another source of 'nuisance' alarms, a level bouncing around its alarm point when
accepted will clear, then come into alarm again seconds later, there is no facility to hold an alarm in
a 'silenced but not accepted' state, so silencing these alarms becomes a regular and tedious process.”

These issues were well represented overall in the results of the survey, as shown in Table 2. More
than 70% of the ratings given to the following statements were negative:
Table 2 – More than 70% of the ratings received from the sample (n=25) were negative in respect to the following
specific items

Survey Item Response (n = 25)

“Alarm numbers can frequently add to stress levels” 80% agreed

“We work to EEMUA guidelines for numbers of alarms” 75% disagreed

“A high proportion of alarms are regarded as nuisance alarms” 75% agreed

“A high proportion of alarms are regarded as low priority alarms” 88% agreed

“Multiple alarms can cause confusion and have been missed” 83% agreed

The evidence from the survey is that control room operators are ‘working around’ this issue. Its
continued presence, however, represents an area of concern given the safety legacy of Piper Alpha
which specifically raised the issue of alarms (e.g. Cullen, 1990).

CONCLUSION

The challenges inherent in performing any form of ergonomic analysis in off-shore situations are
great. This paper has described the activities performed in order to provide just such an analysis
over a large proportion of control rooms functioning on North Sea facilities at the present time. The
situation is, in many ways, unique. That being said, some of the fundamental ergonomic issues are
very familiar. In particular, the ‘co-evolved’ nature of the control room and its users is a particularly
marked feature of the present analysis and one which greatly influences the interpretation of the
results. The results show that despite very obvious differences between on and off-shore control
room environments the ratings for environmental ergonomics and overall system usability were
striking more for their similarities than their differences. A trap that many ergonomic analyses fall
into is to focus on the latter rather than former.

The reason many Ergonomic analyses can lack credibility is because of legacy, expertise and the fact
that “people using the [system] interpret it, amend it, massage it and make such adjustments as they
see fit and/or are able to undertake” (Clegg, 2000, p. 467). The collection of working practices,
accumulated experience, norms and behaviours that result from this can inadvertently be done
away with through an overly simplistic ergonomics analyses in much the same way that they can be
swept aside by step changes in technology. This is why current thinking in the field, as exemplified
by BS/EN/ISO13407:1999, strongly advocates a ‘systems approach’. A systems approach to
ergonomic interventions would view the off-shore control room as something which has evolved to
its present state and would require careful evolution to a desired future state, building on the
accumulated experience, norms, behaviours etc. and involving users in a process of iterative design.
Whilst on the one hand the inherent ‘adaptive capability’ of humans in control room settings yields a
set of generally positive results, on the other hand there are several findings which suggest areas
where that ‘adaptive capacity’ is being tested, and which should form the focus of future work.

The first area concerns the changing nature of the control room task. With greater degrees of
automation the role of the human operator is increasingly oriented around dealing with non-routine
situations. The results of the survey suggest that greater support could be provided to help
operators perform this function. This includes specific and up to date guidance material,
comprehensive system ‘help menus’, an improved alarm philosophy and possibly consideration of
‘non-technical skills’ and how best to train them.

The second area also arises from the changing nature of the control room task and greater levels of
automation. The off-shore control centre seems to have evolved into a central place for all
activities. It is often the only location manned 24 hours a day and so is the ‘obvious’ focal point for
activities. Routine automatic operation lends itself to this situation; the management of abnormal
situations does not.

In these critical areas it would appear that the ability of human operators to adapt to their new role
and situation is potentially reaching its limits and requires further investigation in order to derive
contextually sensitive, and therefore effective, ergonomic interventions.
 ACKNOWLEDGEMENTS

Shell U.K. Oil Ltd. for sponsoring the original independent research. Representatives from Shell UK
Oil, Bluewater, Maersk, BG Group, Nexen, Talisman, Energy and TAQA. The Step Change in Safety
Organisation who circulated the questionnaire.

REFERENCES

Bainbridge, L. (1982). Ironies of automation. In J. Rasmussen, K. Duncan, & J. Neplat (Eds.), New
Technology and Human Error. New York: Wiley.

Boyce, P.R (2005) Evaluating office lighting. In N.A. Stanton, A. Hedge, K. Brookhuis, E. Salas, and H.
Hendrick (Eds.), Handbook of Human Factors and Ergonomics Methods. Boca Raton, FL: CRC Press.

British Standards Institute BS 5940-1: 1999. Office furniture - Part 1: Specification for design and
dimensions of office workstations, desks, tables and chairs. London: BSi

BS EN ISO 7730:1995. Moderate thermal environments – Determination of the PMV and PPD indices
and specification of the conditions for thermal comfort. London: BSi

BS EN ISO 13407: 1999. Human-centred design processes for interactive systems. London: BSi

British Standards Institute BS 7445-1:1991 ISO 1996-1:1982. Description and Measurement of

Environmental Noise — Part 1: Guide to quantities and procedures. London: BSi

British Standards Institute BS EN ISO11064-Parts 1-7 1991-1995. Ergonomic Design of Control

Centres. London: BSi

Cooper, G.E., White, M.D., & Lauber, J.K. (1980). Resource management on the flightdeck.
Proceedings of a NASA/Industry Workshop (NASA CP-2120).

Cullen, Lord (1990) The Public Enquiry into the Piper Alpha Disaster. London: HMSO

Clegg, C. W. (2000). Sociotechnical principles for system design. Applied Ergonomics, 31, 463-477.

EEMUA 191 (2007) Alarm Systems. A Guide to Design Management & Procurement. Publication
No.191 Edi 2. Eastbourne: CPI Anthony Rowe.

Flin, R., Mearns, K., O’Connor, P. & Bryden, R. (1996). Measuring safety climate: identifying the
common features. Safety Science, 34, 177-192.

Hart, S.G., & Staveland, L.E., (1988). Development of a multi-dimensional workload rating scale:
Results of empirical and theoretical research. In P. A. Hancock & N. Meshkati (Eds.), Human Mental
Workload. Amsterdam. The Netherlands. Elsevier.

Hedge, A (2005) In Handbook of Human Factors and Ergonomics Methods, Stanton, N.A. et al., Eds.,
CRC Press, Boca Raton, FL, pp. 604–617.
Hollnagel, E. & Woods, D. D. (2005). Joint cognitive systems: Foundations of cognitive systems
engineering. London: Taylor & Francis.

Kelly, K. (1994). Out of control: The new biology of machines, social systems, and the economic
world. New York: Purseus.

Kragt, H. (1992). Introduction to enhancing industrial performance. In Kragt, H. (Ed). Enhancing

industrial performance. London: Taylor & Francis.

Kaber, D. B. & Endsley, M. R. (2004). The effects of level of automation and adaptive automation on
human performance, situation awareness and workload in a dynamic control task. Theoretical
Issues in Ergonomics Science, 5(2), 113 – 153.

Licklider, J. C. R (1960). Man-computer symbiosis. IRE Transactions on Human Factors in Electronics,

HFE-1, 4-11.

Moray, N. 2004. Ou’ sont les neiges d’antan?. In D. A. Vincenzi, M. Mouloua, & P. A. Hancock (Eds.),
Human Performance, Situation Awareness and Automation; Current Research and Trends.
(Mahwah, NJ: LEA).

Norman, D. A. (1990). The ‘problem’ with automation: inappropriate feedback and interaction, not
‘over-automation’. Philosophical Transactions of the Royal Society of London, B 327, 585-593.

Noyes, J and Bransby, M (2001) People in Control. Human factors in control room design. London :
The Institute of Electrical Engineers.

Ravden, S and Johnson, G (1989) Evaluating usability of human-computer interfaces: a practical

method. New York: Halsted Press

Rundmo, T. (1992a) Risk perception and safety on offshore petroleum platforms - Par II: Perceived
risk, job stress and accidents. Safety Science 15, 53 - 68.

Rundmo, T. (1992b) Risk perception and safety on offshore petroleum platforms - Part I: Perception
of risk. Safety Science, 15, 39 - 52.

Rundmo, T. (1993) Occupational accidents and objective risk on North Sea offshore installations
Safety Science, 17, 103 - 116.

Rundmo, T. (1996) Associations Between risk perception and safety. Safety Science 24, 107 - 209.

Rundmo, T., Hestad, H. & Ulleberg, P. (1998) Organizational factors, safety attitudes and workload
among offshore oil personnel. Safety Science, 29, 75 - 87.

Sanders, M. S. & McCormick, E. J. (1992). Human factors in engineering and design. Maidenhead,
UK: McGraw-Hill.

Stanton, N. A.; Chambers, P. R. G. & Piggott, J. (2001) Situational awareness and safety. Safety
Science 39 189-204.
Stanton, N. A. & Marsden, P. (1996). From fly-by-wire to drive-by-wire: Safety implications of
automation in vehicles. Safety Science, 24, (1), 35-49.

Stanton, N. A., Salmon, P., Jenkins, D. & Walker, G. (2010). Human factors in the design and
evaluation of central control room operations. Boca Raton, FL: CRC.

Toftum, J. (2005). Thermal comfort indices. In N. A. Stanton, A. Hedge, K. Brookhuis, E. Salas, & H.
Hendrick. (Eds.), Handbook of human factors and ergonomics methods. Boca Raton, FL:CRC Press.

Woods, D. D. & Cook, R. I. (2002). Nine steps to move forward from error. Cognition Technology
and Work, 4(2), 137-144.

Zuboff, S. (1988). In the age of the smart machine: the future of work and power. London:
Heinemann.