The Meeting Point - Human-Machine Interfaces

Can a poorly designed user interface lead to a large loss? You better believe it.

Who among us has not occasionally hit the wrong button on the remote control, or had trouble getting a device to work correctly because it was left in the wrong mode? Ever leave your smartphone volume up too high after watching a video earlier in the day? In day to day life, the results of these mistakes are just mild annoyances or the occasional ringing eardrums. When we see the same mistakes made with machines, vehicles, or process controls, the consequences can be far more serious.

Large losses resulting from poor interface design are not a new problem. One of the contributing factors to the 1979 Three Mile Island nuclear accident was a poorly designed indicator light. The light indicated when a close command was sent to a valve, rather than activating based on feedback from the valve itself. For several hours, as the situation at the nuclear plant deteriorated, the operators believed the valve was closed when in fact it was stuck in the open position. The resulting confusion delayed proper action for several hours, exacerbating an already bad situation.

The Root of the Problem

These days, automation is becoming ubiquitous in everyday life. We now automate everything from our homes, to commercial buildings, to industrial plants. As we place the control of increasingly complex machinery and processes into the hands of computers and controllers, the way in which people interact with these systems has demanded increased scrutiny. Investigations into incidents and accidents have repeatedly shown that a poorly designed interface can seriously confuse, impede, or even mislead the people tasked with operating a system. The result of this confusion will inhibit or delay operator response to abnormal situations, turning manageable situations into disasters.

The manufacturers of consumer electronics, such as smartphones and tablets, spend a great deal of time and resources working on user interfaces. A product with a clunky, confusing, or non-intuitive interface will quickly find itself driven out of the market by better-designed competitors. For commercial and industrial control systems however, the design of the interface has historically taken a back seat to other performance measures, sometimes with catastrophic results.

Investigations into commercial and industrial accidents and workplace safety have found that human error caused over 90%of reported incidents. “Human error” can mean a wide variety of things, but a primary factor in commercial and industrial incidents is often a lack of, or loss of, situational awareness by the system operators. The consequences of operators lacking or losing awareness can range from energy waste, to production loss or business interruption, to facility and equipment damage, to environmental contamination, or even injury and death.

Mode Confusion

Mode confusion (sometimes called “mode drift”) is being confused about, or simply forgetting, what mode of operation a system is in. It is simply the result of human nature, but it’s often overlooked when human-machine interfaces (HMI’s) are designed. Who among us hasn’t missed a phone call because we forgot we switched the phone to silent mode during a meeting? It seems like a simple concept, but as the automated systems have grown in complexity, so has the number of modes under which they can operate. The more modes available, the greater the chance of confusion.

An example of just how dangerous mode confusion can be, took place in 2013. The Seastreak Wall Street, a passenger ferry, slammed into a Manhattan pier, injuring 79 people and causing hundreds of thousands of dollars in damage to the vessel and the pier. The ferry captain had selected a seldom-used control mode during the voyage. Forgetting this, when he transferred control from one bridge station to another in preparation for docking, the engines did not respond as expected. By the time the confusion was resolved only a few moments later, it was already too late, and the vessel could not be slowed in time to avoid a collision. The National Transportation Safety Board report on the incident cited, among other factors, that “…the propulsion control system on the Seastreak Wall Street used poorly designed visual and audible cues to communicate critical information about mode and control transfer status”.

The result of mode confusion is not always so dramatic. A commonly encountered issue with building management systems(or alternatively, building automation systems) occurs when a single piece of equipment is left in the wrong mode. Building engineers often have to disable automatic or remote control of a device to perform maintenance. If that device (say a chiller or valve) is left in local/manual control mode and operators are not alerted to this fact, the result can be massive energy waste, flooding, or premature failure of the equipment.

PART 2: DIGITAL DATA, ALARMS, AND HOW THEY CAN CONTRIBUTE TO LARGE PROBLEMS.

Digital Information Overload

In the manufacturing and industrial arenas, operations are often overseen or run from a centralized control room. In days gone by, these rooms were often filled with large control panels, or control walls, filled with buttons, switches, and gauges. When these systems were designed, each and every device on the control panel had to be wired individually, so great care was exercised in selecting what functions and measurements were included.

In modern times, these control panels have been replaced with computer screens, and even the heaviest industrial machinery is commonly connected to a control system network. The practical takeaway from this is that where each piece of machinery used to have a few key parameters to monitor, they often each now have hundreds of available data points. Building management system interfaces can often display data from hundreds of devices, crammed into one or two confusing screens.

The result is that operators are overwhelmed with digital data. In a corresponding development, this data is often displayed numerically, sometimes in dozens of places on a single screen. Studies have shown that the human brain doesn’t easily process numerical values. It requires an operator to read a number and compare that number mentally to a known “good” value, and then make a judgment. When this is done with a single value, it’s not all that difficult. When keeping track of dozens of numbers, it becomes problematic.

Alarm Management

Another byproduct to the digital and networking revolution is the almost limitless ability of designers to create alerts and alarms. In those old-style control rooms, audible alarms had to be individually wired to annunciators, to trigger horns and flashing lights. Since each had to be wired individually and had measurable installation costs, great care was exercised to ensure that only the critical information was included. In modern systems, creating an alarm costs nothing in terms of additional hardware design, and is often accomplished by a few clicks of a mouse.

Again, we can see how this quickly became overwhelming for system operators. Alarm “floods” have become a major issue and instituting alarm management programs has become an important element of control system design.

Color, Animation, Graphics, and Layout

Control systems were, in the days of yore, their own world. The hardware and methods used were unique to control applications. As modern systems developed, they began to utilize more and more off-the-shelf technology. This led to the use of modern computers, monitors, touch-screens, and more recently, smartphones and tablets in control systems. This gave designers an almost unlimited palette with which to create these interfaces and at the time, there were almost no standards or best practices to follow.

The results were predictable. Some designers tried to recreate engineering diagrams and schematics on a screen. Others tried to paint a picture of the physical reality, actually drawing the machinery and equipment on the screen, peppering the displays with numerical information. The addition of wild color schemes, animation, and graphics has led to displays which are confusing, distracting, hard on the eyes, and provide lots of data, but very little useful information to the operator. Poor arrangement of the information and selectable objects can also create problems. In January of 2018, an emergency drill at the Hawaii Emergency Management Agency was in progress. One employee mistook the drill for a real event and initiated a “push notification” sending an emergency alert to all cell phones in Hawaii notifying them of an inbound missile attack. It took 38 minutes to cancel the alert and notify Hawaiians of the false alarm. One of the key items identified in the investigation was a poorly designed software interface that allowed a drill to initiate a real alarm but had no means of sending a cancellation or false alarm notice.

Industry Standards and Best Practices

The good news is that industry groups and professional organizations have closed the gap between the development of the interface technologies and the development of associated standards. The International Society of Automation (ISA), and the Electric Power Research Institute (EPRI), amongst other industry groups, have studied the problems and developed standards and guides for better interface design. The many details and factors are beyond the scope of this article, but here are some of the key ideas:

• HMI’s should be intuitive, enhance the situational awareness of the operator, and assist in the detection of, and response to, abnormal situations. There should be no confusion or guess-work on the part of the operator in determining what is taking place or in what mode the system is operating.

  
  

• Grayscale color design should be used to reduce eye-strain and enhance the use of other colors. Use of color should be judicious and consistent (e.g. if the color red is used to indicate an alarm, it should be used for no other purpose).

  
  

• Key performance data should be displayed in an analog format, or in graphs and trends. Values should be presented in context, not just as raw numbers.

Human Factors in Design

While progress has been made, many interfaces are still poorly designed. Engineers and system designers tend to design for humans as they would like them to be, rather than how they are. A growing movement in recent decades has emphasized design based on the needs of the user. A central premise of this movement has been to resist the urge to blame the operator anytime something goes wrong. As Earl Weiner, a renowned pilot and safety expert who advocated for human-focused design for the airlines and NASA once famously stated: “…there is no problem so great or so complex that it cannot be blamed on the pilot.”

Indeed, when things do go awry, the response from both the government and the business world has been to focus on the operator, training, checklists, and procedures, etc. In reality, it’s time to take a closer look at the crucial interface between the human and the technology.

About the Author

Taylor A. Russell, P.E., CFEI, is a consulting engineer with our Oakland, CA office. Mr. Russell provides consulting services in the areas of power systems (industrial, commercial, and residential) and in commercial and industrial automation. His expertise includes code compliance, failure analysis, damage assessment, and repair/replacement analysis, power generation and distribution systems evaluation, building automation systems (BMS/BAS), and industrial instrumentation and control systems (PLC/SCADA/DCS).