1 Introduction

Presentation of information is an important issue in the design of process control system interfaces from an ergonomic (Moray 1997) as well as from a legal perspective in the EU (e.g. HSF Directive 1989; VDU Directive 1990). Visual display units (VDUs) for monitoring and control operations at process control work stations are part of the work system (CEN 2004a) and thus human–computer dialogue interfaces have to be designed as to safeguard operational safety, effectiveness, and efficiency of process control as well as to optimise operator work load, which in turn will contribute to operational safety in process control (Nachreiner 1998). Therefore the design of dialogue interfaces should be related to principles of human information processing (Wickens and Hollands 2000), which can be transformed into design requirements (e.g. Wickens and Carswell 1995), since these interfaces can be conceived as a kind of information presentation which are critical to systems safety, reliability, and productivity, as they act as both, production control devices and job aids for operators. In order to achieve suitability for the task (CEN 2006) for a dialogue interface its design is to be based on task analysis and an adequate presentation of information (referring to, e.g. displays and controls) necessary to perform the operator tasks effectively and efficiently, i.e. avoiding impairing effects of work strain such as stress responses, reduced vigilance, or mental fatigue, and, as a consequence, reducing the risk of system instability (CEN 2000b, c; Nachreiner 1989; Schmidtke 1966).

In monitoring and control operations the task of the operator is to detect and recognise—potential—deviations from normal operations as early as possible, to carry out diagnostic activities (if included in her/his duties), to derive possible responses/solutions, and (if allowed to do so) to apply appropriate interventions to avoid or correct such deviations from set points. Task performance in this situation is rather complex since the operator (as a dynamic human subsystem) interacts with a dynamic process control system controlling a dynamic process within the work system (Meshkati 2003; Nickel and Nachreiner 2004; Sheridan 2006). Appropriate dialogue interface design—appropriate for such dynamic tasks—is required (1) to allow the operator to effectively allocate mental resources, (2) to provide orientation for the operator especially in case of indicating deviations from normal operations, as well as (3) to provide the operator with information both on the systems state and its progress as well as on the technical subsystems’ state and its progress. Therefore, information is usually presented using different monitors or panels in order to present in parallel relevant sections of the process via individual functional mimic displays and/or trend displays and/or alarm displays.

A common concern in VDU based process control operations is the (minimal) number of VDUs necessary for suitable task performance—sometimes as if this would lead to a substantial increase in the costs of the total system. This often becomes relevant when process control rooms are renewed from former control panels and consoles to VDU representations—with the consequence of splitting the information formerly presented simultaneously on display and control boards into a great number of functional mimic displays, organised (hopefully) in a hierarchical structure and presented sequentially on a rather small number of VDUs, depending on the number of VDUs available. This is often found in practice with control centres which were designed without consideration of an appropriate interaction interface layout or when plants had ‘naturally’ grown without taking associated changes in operator tasks into account. Reducing the number of available VDUs or providing too few VDUs (usually for reasons of saving costs) necessitates sequential (instead of parallel) monitoring and control, since not all the information required can be simultaneously presented on a restricted number of VDUs, necessitating operators to sequentially switch between relevant screen pages. Such a restricted number of VDUs will thus only allow for sequential access to displays and controls, which will be inappropriate if the task requires parallel processing of information and/or operation of control actuators (on the VDU) for controlling the process safely and reliably. Violation of ergonomic design requirements such as task adequate presentation of information (e.g. see ‘parallel versus serial processing’ in CEN 2000b), should thus deteriorate performance and substantially increase mental work load of the operator, both cognitive and emotional, especially if safety is at stake.

Therefore, in an experimental study in a process control setting, this study investigated whether different design solutions for the presentation of information on VDUs are indeed reflected in parameters of system performance and operator mental work load.

2 Methods and design

The study was carried out in the process control room of the Work and Organisational Psychology Unit’s Usability Laboratories at the University of Oldenburg, Germany (see Fig. 1). The laboratory cabin (7.5 m × 5 m × 2.4 m; Industrial Acoustics Company GmbH, Germany) used for the process control operations was sound-protected and air conditioned with climatic conditions held constant at 22°C dry temperature, 50% relative humidity, and <0.1 m/s air velocity. The process control work station was furnished with industrial consoles equipped with a commercially used process control system (I/A series, Invensys Systems GmbH, Germany). The consoles contained an integrated full scale, real time simulation of a benzene/toluene distillation plant (with 1,200 interrelated parameters of the plant being processed and updated in 5 s intervals). Information was presented on 21″ CRT monitors by industrial dynamic interaction interfaces, i.e. functional mimic displays for a process overview and four process sections, displays for eight trend groups, an alarm manager, and all displays with selectable additional overlays.

Fig. 1
figure 1

Process control centre used for the experiment (Work and Organizational Psychology Unit, Universität Oldenburg, Germany)

Full size image

While the operator was performing her/his tasks in interaction with the process control system the experimenter had the possibility of implementing system disturbances in real-time. For this purpose the process control work station was networked with another Solaris Unix work station for the experimenter, providing the same functionality but also control of the simulation, including the control of about 20 process failures (different in type, dynamics, and level of difficulty). Analyses of the task and the interaction interfaces for the benzene/toluene distillation—as provided by the manufacturer—yielded several violations of ergonomic design principles (Nachreiner et al. 2006) and resulted in an interface redesign—appropriate to realise an experimental variation of interfaces for the present study.

Two student operators were selected as participants, based on their level of expertise in process control operations with the system, gained from extensive on-the-job training (on process engineering, chemistry, process control operations, normal operations, handling of process disturbances) and participation in courses in Work and Organisational Psychology on ergonomics in complex human–machine systems. Participation was voluntary and financially compensated. The two participants had normal or corrected-to-normal vision and according to a questionnaire reported neither impairments in health nor effects of preceding tasks that could have had affected their performance during the experimental sessions. They had been informed in general that the experiment concerned an investigation on the design of presentation of information.

The participants performed monitoring and process control tasks in two different sessions, lasting about 2 h each, on subsequent days at the same time of day in order to avoid any circadian effects. In the first session the participants were free to use two VDUs for the assignment of all available displays. In the second session the presentation of information on one VDU was restricted to display alarms or trends, while the other VDU could be used for a free assignment of all functional mimic displays. If there were any effects of training from the repetition of sessions, it would only tend to improve performance for the second session requiring sequential processing, i.e. training cannot superimpose or contaminate any positive effects to be expected in the parallel processing session/condition. Effective monitoring and control activities for both sessions required parallel processing of information from different functional mimic displays (e.g. monitoring/control of the temperature profile of the rectification column in parallel with the feed section), because an assessment of normal operations or deviations requires information from different sources and thus comparisons were to be made among different sources of information, located on different functional mimic displays. Per session a sieve and a pump disturbance (both in the feed flow) were used to induce system deviations and initiated by the experimenter following periods of normal operations. The participants were neither informed about the fact that and what kind of process disturbances, nor how many or when these disturbances might occur.

During operator task performance all process control system parameters and operator and experimenter actions were continuously recorded, the sessions were audio and video taped and psychophysiological parameters were continuously recorded. In order to investigate the effects of parallel versus sequential presentation of information on system performance and operator work load (a) upon completion of a session the participants were interviewed about perceived difficulties with and specific problems experienced during the process control operations, (b) from the available system performance data the pressure in the feed pipe before heating up was selected as a relevant parameter for performance, (c) operator performance data for sequences of disturbances, and (d) psychophysiological parameters (from the electrocardiogram (ECG) and respiration) were analysed. The psychophysiological parameters were registered with the equipment and the procedure described in Nickel and Nachreiner (2003), i.e. the inter-beat interval was detected from the ECG and spectral analyses with profile technique were performed in order to calculate the 0.1 Hz component of heart rate variability (HRV) as an indicator of general activation and/or the affective component of mental work strain. Since there were no effects of respiration in the 0.1 Hz band of HRV no further results will be reported for respiration.

Participants were asked to perform their monitoring and control tasks so as to maintain normal operations (as a primary task) and maintain productivity on a high level of quality and quantity (as a secondary task). A session started with the process and the control system in normal operations and the participants were given a warm-up period of about 30 min, performing some control operations supervised by the experimenter. When the system was back to normal operations the 90 min probe period started. Within the first 15 min of this period the experimenter did not intervene and hereafter, when the process remained in normal operations for some time, the experimenter initiated the two process disturbances with a period of return to normal operations between both. The operator had to proceed with her/his task until 90 min were over.

In the feed flow section of the benzene/toluene distillation process, as represented by the functional mimic display in Fig. 2, process disturbances were initiated by the experimenter, i.e. a failure of pump P101, P102, or P103 and of a creeping blockage of the sieve between valves V1 and V2 or V4 and V5. If the operators were not to identify the disturbances by deviations for the pressure indicator P401 she/he would be informed about these disturbances by an alarm for the rectification column (displayed on the alarm management system) indicating a problem in the head of the column, not in the feed, since the column control units are more sensitive than the feed flow pressure measurement. In order to identify disturbances at an early stage the operator can refer to the digital and/or analogue display elements on the functional mimic displays available and/or one among the eight trend displays available.

Fig. 2
figure 2

Dynamic functional mimic display for the feed section of the benzene/toluene distillation process (originally coloured)

Full size image

3 Results

During task performance none of the technical safety devices were released and therefore no emergency shutdown occurred. No significant differences in product quality or quantity could be identified for the conditions of information presentation on session level. It could therefore be assumed that system performance remained effective and that no impairment of system safety occurred. However, a more finely grained analysis of markers indicating efficiency of performance of the human subsystem (as part of the total system) revealed compensational effects to prevent for impairments of total system performance and to prevent the technical subsystem from triggering the automatic fail-safe system.

Figures 3 and 4 show results for the 0.1 Hz component of HRV (behavioural response of the human subsystem) and the pressure of the feed flow as indicated by sensor P401 (response of the technical subsystem) during sequences of disturbance (creeping blockage of sieve) as performed by operator A with free assignment of two VDUs (Fig. 3) and one VDU only (Fig. 4). With increasing blockage of the sieve (initiated by the experimenter) the pressure in the feed flow started to decline from 3,200 hPa to about 2,000 hPa, as indicated by the lower bold line in Figs. 3 and 4. In parallel the 0.1 Hz component of HRV (thin line in Figs. 3 and 4; scale inverted for reading compatibility) becomes increasingly suppressed, indicating a strong increase in activation due to a sudden detection of system instability by the operator. Since the operator is aware about the intense effects of feed disturbances in the column she is under increasing time pressure to identify the source of the disturbance and to initiate the necessary interventions to maintain normal operations as soon as possible (e.g. a bypass or a reduction in rectification) before further diagnosing possible failures and initiating repairs. The operator is aware of the fact that choosing the wrong intervention will lead to extensive delays in re-gaining system stability, simply because most interventions (including wrong ones) in dynamic systems show delayed effects. Therefore there is good reason to assume that the increase in suppression of the HRV is caused by the decrease in feed pressure along with an increasing risk of system instability and threat of failure (Nickel and Nachreiner 2002, 2003).

Fig. 3
figure 3

Feed flow pressure (P401, bold line) and 0.1 Hz component of HRV (thin line), operator A, sieve disturbance, free assignment of information to two monitors

Full size image
Fig. 4
figure 4

Feed flow pressure (P401, bold line) and 0.1 Hz component of HRV (thin line), operator A, sieve disturbance, free assignment of information to one monitor only

Full size image

During ongoing performance of this disturbance sequence the operator correctly diagnosed the source of the disturbance in the feed section and set a bypass in order to gain feed flow on adequate level (see increases in pressure at P401 in Figs. 3 and 4). This part of the feed flow now is the bottle neck for system safety and availability since having another failure in the parallel flow must result in a shut down of the rectification process. When the operator realised that the system went back in direction to normal operations she calmed down, as indicated by the decrease in suppression in the HRV measure, and started to diagnose the failure of the technical component in order to initiate a repair. The following ‘bump’ in the pressure level is related to the bypass to use the former pipe flow in order to assure that the repair chosen was correct and had become effective. In parallel with these activities of the operator the suppression of her HRV component decreased over time until it reached a normal level, indicating that the operator realised a return to normal operations (level of pressure according to the set point) without further risks of system instability.

A comparison of both sequences presented in Figs. 3 and 4 shows that in the condition of sequential (due to presentation) processing of information (Fig. 4) it takes much longer to perform this sequence and HRV remains on a comparably high level, i.e. indicating longer lasting effects for the affective component of mental work strain. The results for operator B for the performance of the same disturbance sequence (not shown here) in general revealed similar effects. However, this time the operator performed relatively faster in the condition of sequential access to information but there was a stronger suppression of the 0.1 Hz component of HRV in sequential compared to parallel processing of information, indicating a stronger effect on the affective component of mental work strain. Performing the disturbance sequences with a pump failure under both conditions (see Figs. 5 and 6 with results for operator B) showed results comparable to those presented above. When operators had to perform tasks requiring parallel processing of information under conditions of sequential presentation the operators were subjected to an increased and extended level of work stress, resulting in an increased level of work strain and/or a lower level of performance.

Fig. 5
figure 5

Feed flow pressure (P401, bold line) and 0.1 Hz component of HRV (thin line), operator B, pump failure, free assignment of information to two monitors

Full size image
Fig. 6
figure 6

Feed flow pressure (P401, bold line) and 0.1 Hz component of HRV (thin line), operator B, pump failure, free assignment of information to one monitor only

Full size image

After the sessions the operators clearly reported more difficulties to perform the tasks under the condition of sequential access to information. They usually felt not clear about the operational state since they were not always able to diagnose the current operational state in an appropriate manner because there were more tasks to be carried out than just simply monitoring what was going on. During disturbance sequences it seemed to be more difficult to identify whether the system was back to normal operations or if it was still in a risky state. Furthermore operators referred to difficulties in accessing different functional mimic displays in parallel (e.g. feed section and head of rectification column) or a section of the process flow and different trends. Moreover, it was not even possible to rapidly switch between the different displays required for the acquisition of information since parallel presentation is different from speedily alteration of sight of different information and since the delay until the presentation of the required display appeared was too long, being partly due to the controls (trackball, software control/button on screen and processing of command). According to the statements of the operators they in general experienced more confidence when performing the tasks with free assignments to two monitors, which made them more certain in their assessments of the current operational state. However, to have two monitors available for free assignment was not rated as sufficient for effective process control operations in general. It was recommended to improve the design of the interaction interface, e.g. of the control buttons for switching between displays and of the trend displays to better be able to identify deviations in early stages. It was stated that in general and especially in case of the occurrence of more than one system failure there should be a minimum of at least three monitors, i.e. one for paging (through the hierarchy of sections of the whole flow), one for an overview and/or critical process sections and one for the alarm manager and/or trends—and with a forth monitor from the perspective of the experimenter to implement control operations and to monitor their impact on related sections.

4 Discussion and conclusions

According to the results of this study on performance and work load no significant differences in design solutions appeared under normal operational conditions. Differential effects on these measures occurred, however, in abnormal operational states, with increasing demands, tighter temporal constraints, and with a resulting threat to safety and reliability. Although the task performed during the whole session required parallel processing and thus simultaneous presentation of information this was especially crucial for the sequences of process disturbances. In order to provide an appropriate orientation for the operator during performance of either the sieve or the pump failures information to be compared or to be observed in parallel should be presented in parallel and simultaneously in order to derive suitable decisions on safety critical processes under control. For the disturbance sequences this information was spread over different functional mimic displays and therefore (for the interface design solution given) parallel presentation on different VDUs would be the solution required.

It can therefore be concluded that decisions on the minimal number of VDUs necessary must refer to the tasks to be performed and the presentation of information necessary for a safe, effective, and efficient task performance under safety critical conditions. Such design decisions must not only be considered in early stages when tailoring interaction interfaces and reassessed to allow for appropriate integration of modifications or extensions in process engineering. They must also be addressed from an operator’s task point of view that sometimes requires functional display cutting focusing on interactions between (neighbouring) plant units rather than on plant units itself with the unit centred within the functional display. Also they must take into account the dynamics in the processes under control, which may be different for normal and abnormal operations, including delayed or lagged interactions between distant sections of plant units (e.g. CEN 2004b explicitly asks to refer to all operational states for defining the number of VDUs required). It thus becomes obvious that design requirements as stated in CEN (2000b) are not merely based on theoretical assumptions but can be supported by empirical evidence, as demonstrated with the results presented above. There is thus empirical evidence for the necessity to take ergonomic design principles related to mental work load in the design of (safety critical) work systems into account. Simulation studies like the one presented would seem to offer an approach to address such problems close to real work situations.

However, there are some specific limitations with regard to assessments of mental work load available for an evaluation of system design. The first refers to the obviously multidimensional nature of the concept of mental work load (Nickel 2002; Manzey 1998) with no single measurement technique to be expected to tap all or at least the most important aspects of the concept (Kramer 1993). HRV is a good example in this respect. There is a lot of problems associated with this indicator (Nickel 2002) one of the most important that it is not sensitive or diagnostic with regard to cognitive work load, but rather with emotional work load only, which would seem to catch only a rather small proportion of the problem at hand, and where it is not quite clear, how well it does at that. Some more research on these problems, making use of simulation studies, might be quite appropriate to increase knowledge.

Next, due to a lack of appropriate criteria, these measures may be used for formative evaluation during the design process to compare and improve alternative solutions—but not for absolute decisions, e.g. whether certain limits or requirements have been met, a distinction relevant in the context of legal or quasi-legal requirements.

Finally, for the process control system used in the present study, there are much more appropriate dialogue design solutions available (even in practice) than those used here. But it seems to be rather difficult to either convince manufacturers of process control systems or their customers to insist on suitable ergonomic design solutions—and to convince both that questions of an ergonomic interface design cannot be solved in the last stage of the project as an add on since ergonomics have already to be involved right from the beginning (Moray 1997; Nachreiner et al. 2006) in order to be effective, as specified already in existing ergonomics standards, e.g. CEN 2000a, c, 2004a.