SYMPOSIUM SERIES NO 166 HAZARDS 29 © 2019 IChemE
Control room design - guidance document EEMUA 201 3rd edition
updated 2018
Andy Brazier, Associate Consultant, Wilde Analysis
The work described in this paper was jointly funded by Wilde Analysis Ltd and the Engineering Equipment and Materials
Users Association (EEMUA) and supported by the EEMUA Process Control Desk Design Working Group with input from
the Health and Safety Executive (HSE)
The role of the Control Room Operator in managing risks of modern process plant is indisputable. Detecting
deviations early, diagnosing the causes reliably and responding promptly and appropriately all contribute to the
avoidance of major accidents and reduces reliance on automated systems. To do this, Control Room Operators
need to maintain good situational awareness. This is achieved by accessing data via the Human Machine
Interfaces (HMI) provided in the control room and accessing other sources of information, including
communication with colleagues. However, their ability to perform this critical role will depend on them being
healthy and alert.
Control room design can have a big influence on the ability of the Control Room Operators to perform their role
effectively. In particular:
A good quality HMI can ensure they have the data they need in a useful format;
The working environment can affect health and alertness;
Physical design and provision of equipment can support effective communication.
Unfortunately, despite the availability of standards and guidance, the design of many control rooms fails to
achieve good practice. EEMUA has recognised an opportunity to update and develop its existing guidance
document EEMUA 201 to become a more complete, practical and useable guide to control room design. EEMUA
have contracted Wilde Analysis Ltd to rewrite the guide.
Two barriers to adoption of existing standards and guidance have been identified:
1. Engineers assigned the responsibility for designing control rooms do not recognise the importance of
adopting human factors principles;
2.
In order to overcome these barriers the updated guidance reflects the practicalities of engineering projects. Also,
input has been gained from experienced Control Room Operators in addition to Human Factors Consultants,
Control Room Designers and Regulators to determine what the guidance needs to say and how it should be
presented.
This paper summarises the contents of the updated guidance, highlighting how it can be used to optimise control
room design in order to reduce process safety risks. It will discuss the issues where views of experienced Control
Room Operators differ significantly from current theory and explain how these can be rationalised in practice.
Key messages will include the requirement to consider human factors from the very inception of a control room
project and to ensure active participation of Control Room Operators throughout. The updated version of
EEMUA 201 includes a number of templates that can be used by project teams to guide them through the various
design stages so that they develop an optimum solution whilst utilising best practices.
Keywords: Control room design, human machine interface (HMI), human factors, ergonomics, situational
awareness, process safety.
Introduction
The Engineering Equipment and Materials Users Association (EEMUA) publish a range of guidance documents to assist its
members and industry as a whole to identify and implement good practice. In 2002
control desks utilising human-computer interfaces - Guide to design, operational and human-
updated second edition was published in 2010.
In 2018 Wilde Analysis was commissioned to write a third edition of EEMUA 201 in response to changes in technology and
practice. As well as updating the existing content it was decided to develop the document into a more complete guide for
designing Control Rooms taking in the building, physical aspects of the Control Room, working environment, console design
and the Human Machine Interface (HMI) including displays and graphics. Emerging issues such as control devices used
outside of the Control Room and current and recurring security issues were covered. A stronger focus on human factors was
included throughout.
The aim of the current update EEMUA 201 is to provide improved guidance to people involved in the design and evaluation
of Control Rooms including new build and modification projects.
EEMUA Publication 201 is not a standard and is not intended to replace any. Designers will be expected to identify and adhere
to any applicable standards and regulations; and any company and project specifications. The role of EEMUA 201 is to
provide guidance on how compliance can be achieved as part of a wider context of striving to provide the best Control Room
possible to end users.
1
SYMPOSIUM SERIES NO 166 HAZARDS 29 © 2019 IChemE
How does Control Room design affect safety?
People working in a Control Room have to be protected from harm. This means that hazards should be eliminated, reduced
and controlled, local building regulations should be adhered to and occupied building risk assessments should be carried out
where appropriate.
From a process safety perspective the actions performed by Control Room Operators (CRO) are a concern because the errors
they make can contribute to hazardous events, and failure to respond to events can allow events to escalate, leading to
potentially damaging consequences.
The primary focus of EEMUA Publication 201 is how the design of a Control Room and associated systems can affect:
Situational awareness;
Health and alertness of CROs.
Situational awareness
mental awareness of the state of the system they are monitoring and controlling and their ability to project the future state
based on the information available. A key factor in achieving good situational awareness is making sure the HMI presents
information in an appropriate way allowing quick and efficient interaction with the system. This will be supplemented by
other information available to the CRO through communication with other personnel and direct perception.
Operator health and alertness
Supplying the best technical facilities does not guarantee success if the people using it are not in the position to perform
effectively. If a CRO is fatigued mentally or physically, stressed, demoralised, lacking competence or distracted they will be
less likely to act proactively and will have a reduced ability to detect, diagnose and/or respond to events promptly and reliably.
The design of the Control Room and how it affects the working environment can have a significant effect on this and should
be considered as a critical factor in managing process safety risks.
Development of the third edition of EEMUA 201
Whilst changes in technology prompted the updating of the guidance document, the opportunity was taken to develop it further.
The aim was to make it a more useful document. A number of strategies were taken to achieve this including collecting
practical experience and focussing on real life design processes.
Learning from practical experience
Although standards and guidance (including previous editions of EEMUA 201) have been available for many years,
observations suggest that the design of Control Rooms often fails to fulfil the requirements of CROs and other users. On closer
inspection it appears that in many areas it is often not clear what constitutes a good design and in other cases theory and
practice do not appear to be aligned.
In order to make EEMUA 201 as useful as possible it was decided to distribute a questionnaire to ask for practical experience
on a range of topics where existing guidance did not appear to be clear. The intention was not to provide statistical data but
to determine if there was a general consensus on a topic or significant differences of opinion. 37 responses were received from
active and past CROs, Control Room designers, ergonomists and regulators.
In order to collect additional practical input the findings from the questionnaire were presented at a seminar (EEMUA 2018)
where some of the issues were discussed. Comments made by participants were recorded and incorporated into the updated
guidance document.
Real life design
In the ideal world the design of a Control R
and work backwards from there. That would determine the equipment required, the size and shape of the console desk, which
would then determine the size, shape and layout of the control room. However, the real world does not always work like this
and the process followed is often the exact opposite. Unfortunately, instead of providing the CROs with what they need the
result often requires them to fit to the system that they are given.
One of the aims of rewriting EEMUA 201 has been to support project teams involved in implementing new or modified Control
Rooms. It recognises that the ideal situation is for a team of competent ergonomists to be engaged to drive a human centred
approach but that in the real world this is often not possible. It is hoped that presenting clear guidance will result in a better
appreciation of the human factors during design and result in more effective Control Rooms.
Findings
The objective of the new edition of EEMUA 201 is to optimise Control Room design in order to reduce process safety risks.
The objective of this paper is to highlight some of the more interesting issues encountered during the rewrite. In particular
issues where views of experienced CROs differ significantly from theory, or where theory appears to be lacking.
2
SYMPOSIUM SERIES NO 166 HAZARDS 29 © 2019 IChemE
A number of findings and observations related to situational awareness and CRO health and alertness are discussed below.
They are not in any particular order of importance.
Types of displays (graphics)
Previous editions of EEMUA 201 introduced the concept of providing different types of display or graphic for CROs to use to
monitor and control the system (e.g. overview, control, detail, status etc.). However, only limited information was provided
about what each type should display.
Overview displays have been identified as of particular importance because they help the CRO maintain situational awareness
and recognise potential problems early. To achieve this they sho
current state of the system being controlled and convey essential information to determine whether any particular parts of the
plant need attention.
In general the information shown on an Overview display should be sufficient to allow the CRO to confirm that the system is
running as intended and achieving its main objectives. This is likely to include an indication of system throughputs, mass
and/or energy balance (indicating if inputs and outputs are equal), status of critical equipment (e.g. online, standby or tripped),
data from parts of the system that are known to be sensitive to process variations or have the greatest impact on overall system
performance.
Trend displays are often the most effective way of presenting data on Overview displays. They are consistent with human
strengths to detect patterns and subtle changes, which is not the case for numerical values. Also, gauge type displays allow
the CRO to quickly establish if a parameter is within a desirable range without having to mentally process data.
The alarm status of sub-systems can be shown on Overview displays using colour. This may not indicate the specific cause
of the alarm (i.e. which parameter is outside specification) but direct the CRO to the sub-system that requires attention.
However, to be effective this requires good performance of the alarm system, otherwise Overview displays will be showing
multiple alarms too often, which is of very little value to the CRO (see EEMUA 191 for further information about alarm
management).
Providing more than one Overview display may be useful to the CRO for use during different modes of operation (e.g. start-
up, shutdown, steady state, emergency).
The general expectation is that an Overview graphic is kept permanently displayed. It is provided for quick and frequent
glances rather than a working graphic. Large screen displays have the added advantage that they can be shared by others but
normal sized screens on the Console Desk can be also be used.
Use of colour on displays
There has been a recent trend towards reducing the use of colour on control system displays
approach. However, this has often been unpopular with CROs who tended to feel the traditional, colourful displays were more
useful. It is not always clear if this is purely because they find it difficult to change or because there is a fundamental problem
with the concept of minimal colour. Another explanation may be that many existing systems have been poorly configured so
that CROs do not use the graphics to identify active alarms and instead rely on alarm lists.
The idea of the grey screen or minimal use of colour was to ensure that the most important information (typically alarms)
would stand-out from other information. Therefore, if the same colour is used in a number of different ways the impact of the
colour is likely to be reduced. For example, if red is used exclusively to show high priority alarms it will be very easy to notice
active alarms on a graphic. However, if it is also used to indicate shut valves and stopped pumps the visibility of alarms will
be reduced and they may be more likely to be missed.
The reaction of the CROs indicates that they see value in some use of colour for status indications other than alarms. This is
a good illustration that there is no single correct solution and a compromise is required. On balance reduced use of colour has
advantages, but full minimisation is not necessarily the best solution. This means colour can be used to show routine status
information as long as it does not detract from critical information. So bright colours can be used for alarms and pastel or less
saturated colours could be considered for status information. Whatever colour scheme is selected it needs to be fully
documented and applied consistently on every display and graphic.
Showing data on displays
There are many different ways of showing data, but often the default is to provide numerical values, which does little to support
the CRO in detecting changes or understanding what is happening.
Where possible, data should be shown in context, which will usually require it to include an indication of whether targets are
being achieved and how close the parameter is to specified thresholds such as alarms and trip points. The figure below shows
how an analogue display can be used to present this context.
3
SYMPOSIUM SERIES NO 166 HAZARDS 29 © 2019 IChemE
Figure 1: Method of showing data in context
An advantage of this approach is that multiple data points can be shown for easy comparison and the CRO can quickly detect
which parameters are off target or in alarm.
Number and arrangement of screens
CROs will often say they would like more screens to view displays and graphics. When asked, the minimum number of
screens preferred ranged from four to 12; and the maximum from four to 22.
be
sufficient for the CRO to fulfil their role effectively. This is based on what a human can handle in practice. If more screens
are considered necessary this is generally a sign that either the displays are badly designed (i.e. the information required is
scattered across displays) or the CRO is overloaded (i.e. they have to monitor more information than can be reasonably be
handled). Up to four additional screens may be provided, but these would be considered as secondary screens, that could be
used by the CRO to monitor other parts of the system if required, and may be available for others to use (e.g. at very busy
times, during training etc.).
row on the desk, or whether a double row arrangement (one on top of the other) is acceptable. The concern with the double
row is that they require the CRO to look up to view, which can put strain on their neck. However, double rows are relatively
common and CROs very rarely (if ever) complain about them.
The conclusion was that screens are used for different purposes as follows:
Work screens - used by the CRO when interacting with the system using input devices (e.g. mouse, keyboard).
Display Screen Equipment (DSE) rules should be observed, which normally requires them to be around eye height
of the CRO when sat at the console desk;
Monitor screens - used by the CRO detect situations requiring their attention and to confirm system status. Location
in terms of ergonomic requirements are less important and visibility and legibility are the main requirements.
Overall, it was found that a and is considered
acceptable in most instances.
Figure 2: Use of quad groups of screens, shown with an additional screen alongside used for standard office applications etc.
