White Paper ISA101 - Maximize Operator Effectiveness Part 1

Maximize Operator Effectiveness:
High Performance HMI Principles and Best Practices

Part 1 of 2
A PAS White Paper

Version 3.0
Bill Hollifield
Principal Alarm Management and HMI Consultant, PAS
Hector Perez
HMI Product Manager, PAS
High Performance HMI 3.0 - Part 1 | Cover

© PAS Global, LLC 2017
Table of Contents
Introduction and Overview ......................................................................................................................................................... 1
HMIs Past and Present ………………………………………………….................................................…....…………...................................... 3
Justification for HMI Improvement .......................................................................................................................................... 5
Proper Graphic Principles ........................................................................................................................................................... 6
Show Information Instead of Raw Data ................................................................................................................................. 7
Proper Use of Color ....................................................................................................................................................................... 9
Elements and Depictions of HPHMI ........................................................................................................................................ 10
Depicting Process Values ......................................................................................................................................................... 10
Depicting Alarms ......................................................................................................................................................................... 11
Depicting Profiles of Temperature or Pressure ................................................................................................................ 13
Depicting Dynamic Equipment .............................................................................................................................................. 13
Bars vs. Pointers .......................................................................................................................................................................... 14
Depicting Level Indication ....................................................................................................................................................... 14
Depicting Control Valves and Shutoff Valves ................................................................................................................... 14
Depicting Equipment Commands ........................................................................................................................................ 15
Use of Trends ................................................................................................................................................................................ 16
Depicting Tables .......................................................................................................................................................................... 16
Depicting Advanced Process Control (APC) .................................................................................................................... 17
Depicting Shutdown Activation ............................................................................................................................................ 17
Depicting Interlock Functionality ......................................................................................................................................... 18
Startup Map ................................................................................................................................................................................... 20
Navigation and Command Buttons ...................................................................................................................................... 20
Display Layout and Faceplate Handling ............................................................................................................................. 21
Avoiding “Blob” Graphics ......................................................................................................................................................... 23
Display Hierarchy ......................................................................................................................................................................... 23
Level 1 – Operation Overview ................................................................................................................................................. 24
Level 2 – Unit Control ................................................................................................................................................................ 25
Level 3 – Unit Detail .................................................................................................................................................................... 26
Level 4 –Support and Diagnostic Displays ........................................................................................................................ 26
Conclusion of the Part 1 Document ...................................................................................................................................... 27
About the Authors ...................................................................................................................................................................... 28
References ..................................................................................................................................................................................... 29
High Performance HMITM | Table of Contents

Introduction and Overview
The process control and automation industry has spent billions on improving process safety
via complex, instrumented systems. Yet, we continue to frequently see industrial incidents,
accidents, and fatalities in the news. The causes are generally not the failure of such automated
systems, but are instead the result of a wide variety of human errors. PAS firmly believes that
addressing the causes of human error and the improvement of Operator Effectiveness is of
the highest importance. The proper use of such technologies as High Performance HMI and
Alarm Management can actually save lives and prevent injuries. Detailed information on these
should not be withheld, and that is why we offer this and other white papers freely. They can
also significantly lessen process upsets, improve process efficiency, and increase productivity.
The human-machine interface (HMI) is the collection of screens, graphic displays, and other
technologies used by the operator to monitor and interact with the control system (typically
DCS or SCADA). Several major accidents, such as the Texas City refinery explosion in 2005,
have cited poor HMIs as a significant contributing factor. The design of the HMI plays a critical
role in determining the operator’s ability to effectively manage the operation, particularly in
quickly detecting and resolving an abnormal situation, which is the most important task of an
operator. A poor HMI can actively interfere with this ability.
For several reasons, the current designs and capabilities of most HMIs are far from optimal
for running the kinds of complex operations we have in industry. Most HMIs consist simply of
schematic or P&ID style graphics covered in numbers. Such displays provide the operator large
amounts of raw data, but almost no real information. They are difficult to interpret and provide
inadequate situation awareness to the operator.
Since we published The High Performance HMI Handbook in 2008, improving HMI has become
on of the hottest topics in the automation industry. In that book, we explained exactly why
most current HMI practices were poor, and we put forth the proper principles and details for
making graphics significantly better. Many companies have adopted those principles and have
completed migrations to improved graphics. Many more have such efforts currently underway.
This two-part paper provides a history, justification, and detailed plan of action for the
improvement of a process control HMI. Here is an overview of the contents.
High Performance HMI 3.0 - Part 1 | Page 1

Part 1
Examples: We provide typical examples of common but poor HMIs, along with highly
detailed depictions of improved methods that provide for much better operator situation
awareness and control.
Principles: We cover the most important aspect of High Performance HMI™ (HPHMI),
the display of information to the operator rather than raw data. Many other necessary
graphic principles including the correct way to use color are provided. Depictions of
detailed graphic elements are included.
Hierarchy: HPHMI graphic designs must reflect a proper hierarchy – the exposure of
additional detail as needed. We include examples of graphics that illustrate this hierarchy,
along with the work processes used to design such graphics.
If your facility utilizes a process control system with a computer-based HMI, you will find this
information useful. This white paper augments the detailed content in The High Performance
HMI Handbook.
Part 2 (Separate Document)

Case Studies: Since the publication of our 2008 book, many projects have provided
for the development of real-world case studies. We include two such studies in this
paper. The first was conducted by the Electric Power Research Institute (EPRI), but is
applicable to all types of process operations. The second shows how a major company
has improved performance and significantly lowered costs via company-wide adoption
of standardized High Performance graphics. This has led to a major HPHMI product
innovation for the power industry: PowerGraphiX®.
We also provide an example as to how “out-of-the-box thinking” can address HMI issues,
in the discussion of a Pipeline System Overview Display.
Standards Review: Two standards documents available on HMI are discussed, including
the ISA-101 HMI Standard released in August 2015.
HPHMI Work Processes and Implementation Guidance: The work process for HMI
improvement is described. We also address the most common issues encountered in
HMI improvement, and cost effective ways to transition to High Performance graphics.

HMIs Past and Present
Before the advent of sophisticated digital control systems, the operator’s HMI usually consisted
of a control wall concept such as Figure 1.
The control wall had the advantages of

providing an overview of the entire operation,
key trends, and a limited number of well-defined
alarms. A trained operator could see the entire
operation almost at a glance. Spatial and
pattern recognition played an important role
in the operator’s ability to detect burgeoning
abnormal situations.
These systems had several disadvantages.

They were difficult to modify, the addition of
Figure 1: Example of a Control Wall
incremental capabilities was problematic, and
the ability to extract and analyze data from
them was almost non-existent. In the 1980s-1990s, the modern electronic control systems (DCS/
SCADA) replaced them for such reasons.
When the modern systems were introduced, they included the capability to create and display
graphics for aiding in the control of the operation. However, there were no guidelines available
as to how to create effective graphics. Early adopters created graphics that mimicked P&ID or
schematic drawings, primarily because they were readily available. The limited color palette was
used inconsistently, and screens
began to be little more than
crowded displays of numbers on
a P&ID.
Graphics such as Figures 2

and 3 were developed over 20
years ago and remain common
throughout the industry. Indeed,
inertia, not cost, is the primary
obstacle to the improvement of
HMIs. Engineers and operators
become accustomed to this style
of graphic, and are resistant to
change.
Figure 2: An Early Graphic Showing Many Problematic Practices

As a result, industries that
use modern control systems
are now running multi-
million dollar operations
from primitive HMIs created
decades ago at a time that
little knowledge of proper
practices and principles was
available.
As control system hardware

progressed, the manufacturers
began to develop very flashy
Figure 3: A Typical Crowded, P&ID-Style Graphic
example graphics which were
used for marketing purposes. While fit for that purpose, they were quite ineffective for actually
controlling a process. Many companies and projects, however, began to create graphics similar
to those examples. The results were displays that are actually suboptimal for operators.
To illustrate this point, Figure 4 is an example of flashy design taken from a power generation
facility. The graphic dedicates 90 percent of the screen space to the depiction of 3-D equipment,
vibrantly colored operation lines, cutaway views, and similar elements. However, the information
actually used by the operator consists of poorly depicted numerical data, which is scattered
around the graphic, and only makes up 10 percent of the available screen area.
There are no trends, condition

indicators, or key performance
elements. You cannot easily
tell from this graphic whether
the operation is running well
or poorly. That situation is true
for more than 90 percent of
the graphics used throughout
industry today because
they were not designed to
incorporate such information.
Instead, they simply display
dozens to hundreds of
raw numbers lacking any Figure 4: A Flashy Graphic Inappropriate for Actual Operational Control
informative context.

Justification for HMI Improvement
Poorly performing HMIs have been cited time and again as significant contributing factors to
major accidents. Yet, our industry has made little significant change in HMI design. There is
another industry that learns from its accidents and has made phenomenal advancement in HMI
design based on new technology. That industry is avionics. The resulting improvement in pilot
situation awareness is one of the largest contributing factors in the decades-long decline in
aviation accidents.
Figure 5: Garmin G2000® Avionics Package in a Small Plane
Modern avionics feature fully-integrated electronic displays as shown in Figure 5. These depict
all of the important information, not just raw data, needed by the operator (i.e., pilot). Position,
course, route, engine diagnostics, communication frequencies, and automated checklists are
displayed on moving maps with built-in terrain proximity awareness. Real-time weather from
satellite is overlaid on the map. Detailed database information on airports is available with just a
click. Situation awareness and abnormal situation detection is far improved by these advances.
This capability – impossible even a dozen years ago in multi-million dollar airliners – is now
standard on even the smallest single engine aircraft.
There have been tests involving actual operators running realistic simulations using traditional
graphics vs. High Performance ones. PAS participated in such a test at a large power plant,
sponsored by the EPRI and detailed later in this paper. The results were consistent with a
similar test run by the ASM® (Abnormal Situation Management) Consortium on an ethylene
plant. The test showed the High Performance graphics provided significant improvement in the
detection of abnormal situations (even before alarms occurred) and significant improvement in
the success rate for handling them. In the real world, this translates into a savings of hundreds
of thousands of dollars per year.
Since safety is significantly improved with modern HMIs, it is only logical that we would want all
operators to have access to them. Yet most companies have done little to upgrade.

Proper Graphic Principles
Ineffectively designed graphics are easy to find. Simply search the internet for images under the
category “HMI.” Problems with these graphics include:
● Primarily a schematic or P&ID representation
● Lots of displayed numbers
● Few or no trends
● Spinning pumps/compressors, moving conveyors, animated flames, and similar
distracting elements
● Brightly colored 3-D equipment
● Highly detailed equipment depictions
● Attempts to color code piping with contents
● Long, cryptic tagnames shown on the screen
● Brightly colored liquid levels displaying the full width of the vessel
● Lots of crossing lines and inconsistent flow direction
● Inconsistent color coding
● Bright colors on dark backgrounds
● Misuse of alarm-related colors
● Limited, haphazard navigation
● A lack of display hierarchy
Ineffective graphics encourage poor operating practices, such as operating by alarm. By

contrast, High Performance graphics have:
● A generally non-schematic depiction except when functionally essential
and at Level 3
● Limited use of color, where color is used specifically and consistently
● Gray backgrounds to minimize glare and reflection issues
● No animation, except for specific alarm-related graphic behavior
● Embedded, properly-formatted trends of important parameters
● Analog representation of important measurements, including their value
to normal, abnormal, alarm, and interlock conditions
● A proper hierarchy of display content providing for the progressive exposure
of detailed information as needed
● Simple and straightforward depictions in 2-D not 3-D
● Consistent flow depiction and layout to minimize crossing lines
● Embedded information in context (via right-click menus or similar methods) such
as alarm documentation and rationalization, standard operating procedures, and
more.
● Logical and consistent navigation methods
● Techniques to minimize operator data entry mistakes
● Validation and security measures

Show Information Instead of Raw Data
A primary difference of High Performance graphics is the underlying principle that, wherever
possible, operational values are shown in an informational context and not simply as raw
numbers scattered around the screen.
Information is data in context made useful.

As an example, consider this depiction of a
compressor shown in Figure 6. Much money has 190.5 psig
been spent on the purchase of instrumentation. 55.7 psig 155.2 °F 108.2 °F 166.1 F °
65.1 °F 135.1 Cooler
2.77
MSCFH
Yet, unless you are specifically trained and psig
Oil 155.2 F °
experienced with this compressor, you cannot Oil 85.1 psi
tell if it is running at peak efficiency or is about

West East
to fail.
W. Vibration: 2.77 E. Vibration: 3.07
The mental process of comparing each
number to a memorized mental map of Drive: 232.2 amps
“what is good” is a difficult cognitive process.

Operators have hundreds (or even thousands) Figure 6: All Data, No Information
of measurements to monitor. Thus the results vary by the experience and memory of the
operators, as well as how many abnormal situations they have personally experienced with this
particular compressor. Training new operators is difficult because the building of these mental
maps is a slow process. Adding more numbers to a screen like this one does not aid in situation
awareness; it actually detracts from it.
By contrast, a bank of analog indicators, as in Figure 7, can represent these numbers much more
effectively. Analog is a powerful tool because humans intuitively understand analog depictions.
RECYCLE COMPRESSOR K43

Cool Suct Inter Dsch Suct Inter Dsch E. Vib N. Vib W. Vib Motor Oil Oil
gpm psig psig psig degF degF degF mil mil mil Amps psig degF
Alarm
2 Indicator
Interlock
Threshold
Alarm
Range
Desirable
Operating
Range
Alarm
Range
42.7 38.7 93.1 185 95 120 170 12 8 9 170 80 290
Figure 7: Analog Depiction of Information

Moving Analog indicators with Normal Range, High, Hi-Hi, Low, and Lo-Lo alarm
indications, Interlock indication, and recent range
When
FLOW FLOW FLOW FLOW Measurement
gph gph gph gph Is Invalid
3 2 4
Alarm
Hi-Hi Alarm
indicator is Priority 2
Range
always Hi-Hi
Hi Alarm based on alarm is Dark blue bar
Range the highest in effect shows
Abnormal priority measurement
and Hi
High Range alarm in variability in a
Alarm is
Desirable effect on still in specified time
Operating the sensor effect period such
Range shown as prior 2
Priority 3 hours.
as a light blue Hi Alarm
shaded area (possible on
is in some control
effect systems)
Abnormal Low
Range
Low Alarm
Lo-Lo Alarm
32.1 81.1 91.1 63.5 BAD ----
Interlock Function
Figure 8: Further Explanation of Moving Analog Indicators
We are hard-wired for pattern recognition. With a single glance at this bank of properly designed
analog indicators, the operators can tell if any values are outside of the normal range, by how
much, and the proximity of the reading to both alarm ranges and the values at which interlock
actions occur. Analog depictions such as these moving analog indicators are a key element of
HPHMI.
In just a second or two of examination, the operator knows which readings, if any, need further
attention. If none do, the operator can continue to survey the other portions of the operation.
In a series of short scans, the operator becomes fully aware of the current performance of their
entire span of control.
The knowledge of what is normal is embedded into the HMI itself, making training easier and
facilitating abnormal situation detection – even before alarms occur, which is highly desirable.
Similarly, depiction of PID controllers is accomplished with the addition of easily scanned
setpoint, mode, and output information, as in Figure 9. If the final control element has a position
feedback signal, deviation is easily and effectively shown on the output scale. Mechanical
deviations are prime causes of abnormal situations, and they should be made easy to spot.
The subtle, slight gradients and shadows are intended to increase prominence of the live
elements. Images in printed form are often significantly different than images shown on a
screen. For that reason, other modifications to increase printed visibility have been made on
some depictions in this paper. Actual design of HPHMI elements concerns their appearance on
the screen.

Analog Controller Controller with With Position
Depiction Device Feedback Deviation Alarm
Damper Position
Description
Units (psig) A B C D E F G H
2
A A A A M A A A
Diamond
for
Setpoint 2 2
Device
Feedback
Output on same
Indicator scale
0-100%
Black
Outline 562.1 562.1 602.1
PV, Mode, 74 77 45 74 50 50 75 51
Indicates
MAN Setpoint & AUTO 22% AUTO 22% 73 78 78 75 51 50 65 55
Mode is 560.0 560.0 23% 485.0 55%
Abnormal Output
22% Values
Figure 9: Analog Depiction of PID Controllers and Position Feedback
Proper User of Color

Color must be used consistently. People have several types of common color-detection
deficiency (e.g., red-green, white-cyan, green-yellow). For this reason, the most important rule
for color is this:
Color, by itself, is never used as the sole differentiator of an important condition or status.
Most graphics throughout the world violate this principle. A color palette must have a limited
number of distinguishable colors used consistently. Bright colors are primarily used to bring
or draw attention to abnormal situations, not normal ones. Screens depicting the operation
running normally should not show brightly saturated colors, such as bright red or green pumps,
equipment, valves, and similar items.
When alarm colors are chosen, such as bright red and yellow, they are used solely as an aspect
of the depiction of an alarm-related condition, and for no other purpose. If color is used
inconsistently, then it ceases to have meaning. Figure 10 is a workable HPHMI color palette, and
the example figures in this paper generally follow it. There should not be very many colors, and
all colors must be easily distinguishable.
Graphics with color-neutral gray backgrounds on LCD screens are effective. They also enable
the lights in the control room to be turned back to bright – where they should be. Poor graphics
began with dark backgrounds and bright colors due to 1980s-90s CRT hardware limitations.
This scheme resulted in major glare and reflection problems, which were addressed by dimming
the control room lights. For operator alertness, the control room lighting should actually be
brighter than a typical office, all day and all night.

Color RGB Values Sample Defined Uses
Gray 213, 213, 213 Overall graphic background
White 255, 255, 255 Highlighting of some small items, e.g., PV Quality indications
Light Gray 243, 243, 243 ON indication for equipment
Gray 136, 136, 136 Off indication for equipment
Dark Gray 74, 74, 74 Some text, minor process lines
Black 0, 0, 0 Text and labels, major process lines, process vessel outlines.
Dark Gray (64, 64, 64) can also be a good choice.
Dark Blue 0, 0, 215 Process values, controller modes and outputs, similar special
purposes. Trend line for a single trended value.
Dark Green 0, 128, 0 Controller setpoints and other operator inputs, trend trace of
setpoints
Light Green 153, 255, 102 Possible “faint green” for some specific highlighting
Light Blue 187, 224, 227 Desired operating ranges or conditions
Cyan 0, 255, 255 Vessel level strips, trend lines
Brown 204, 102, 0 Trend lines, position feedback indiciation
Pale Red (Pink) 255, 153, 204 Possible “faint red” for some specific indications
Red 255, 0, 0 Top level, priority one alarm
Yellow 255, 255, 0 Priority two alarm
Orange 255, 102, 0 Priority three alarm
Magenta 255, 0, 255 Priority four alarm for diagnostics
Dark Magenta 204, 0, 102 Trend lines
Figure 10: An Example HPHMI Color Palette
Elements and Depictions of HPHMI

This section shows many of the common situations that a process graphic must depict, and how
to accomplish those depictions by following High Performance HMI principles.
Depicting Process Values

The display of live values on the screen should be shown in a different way than static text:
● The choice of a bold, dark blue is a good choice with the gray background, and
differentiates live values from static text done in black or dark gray as in Figure 11.
● Leading zeros are not displayed, except on fractional values (e.g., 0.27). Values are
shown only to the precision needed by the operator.
● In tables or columns, generally align numbers on the decimal point.
● Units of measurement are displayed in non-bold text near the value.


● Point names should not be shown on the screen by default. It should never
be necessary for an operator to have to type in a point name in the entire HMI.
● Process values can have a variety of diagnostic conditions. Figure 11 shows a clear,
concise, and visible way for depicting those. Color coding is not recommended.
● When items are “selected”, that status should be indicated. Surrounding the
selected item with a white outline is a good practice.
Display of process values. No alarm conditions are in effect.

480.1 psi BAD ----- psi OOR ----- psi
Normal Bad Value Out of Range

Note that the BAD or OOR condition is normally alarmed, and the
additional alarm element would be shown (see depiction of alarm
conditions).
It may be possible to show the Last Good Value of a BAD or OOR
measurement, rather than showing dashes. If this is the case,
the depiction will be:
?LG 480.1 psi
Bad or Out of Range Value
Discrete (“digital”) conditions are shown using the same blue

color and in bold, using easily understood words
Vent Valve
Pump 14: Damper 7: SW 66:
Stopped Moving Locked Auto
Closed
Selection of an item causes the relevant faceplate to appear

and the selected item is highlighted. See Faceplate section.
480.1 psi 480.1 psi
Invisible selection area Selection indication
Figure 11: Depicting Process Values
Depicting Alarms
Proper alarm depiction should also be redundantly coded based upon alarm priority
(color / shape / text). Alarm colors should not be used for non-alarm related functionality.
When a value or object comes into alarm, the separate alarm indicator appears next to it, as
shown in Figure 12. The indicator flashes while the alarm is unacknowledged (one of the very
few proper uses of animation) and ceases flashing after acknowledgement, but remains visible
as long as the alarm condition is in effect. People do not detect color change well in peripheral
vision, but movement such as flashing is readily detected. Alarms thus readily stand out on a
graphic (and on multiple screens) and are detectable at a glance.
Figure 12 shows that the most common methods of alarm indication are a direct violation of the
basic rule of color use, as they are different solely by the use of color.

Poor Alarm Depictions Violating the Basic Color Rule
Similar 480.1
480.1 psi 480.1 psi 480.1 psi 480.1
Bad
No Alarm In Alarm In Alarm Depictions 480.1
480.1 psi 480.1 psi 480.1 psi 480.1 psi

Diagnostic Priority 3 Priority 2 Priority 1
Priority
480.1 psi 480.1 psi 480.1 psi 480.1 psi
Diagnostic Priority 3 Priority 2 Priority 1
Priority
Improved Alarm Depictions With Redundant Coding

4 3 2 1
480.1 psi 480.1 psi 480.1 psi 480.1 psi
Priority 4 Priority 3 Priority 2 Priority 1

Diagnostic
The symbol’s outlines
Suppressed S
480.1 psi above are important!
Alarm
Symbols without
them would not be as
Overall Alarms Summary element effective in standing
out on a graphic:
Alarms 1 2 3 4 S
4 3
Total 0 4 8 1 12
Un-Ack 0 0 2 1 2 1
Figure 12: Depiction of Alarms
It is highly beneficial to include access within the HMI

to the alarm rationalization information contained in X
Embedding Alarm
the Master Alarm Database as show in Figure 13. If Documentation TI-468-02 Column
Overhead Temperature
these terms are unfamiliar, you are advised to read Alarm: PV HIGH
Category: Minor Financial
the ISA 18.2 standard for Alarm Management in the Priority: 3
Setting: 120 deg F
Process Industry, or read the API RP-1167 Alarm 3 Response Time: <15 min
122.1 deg F
Alarm Consequences:
Management Recommended Practice if you are in Right-click Off spec Production
callup Lowered efficiency
the pipeline industry. PAS offers free white papers
Alarm Causes:
explaining both documents. Information Excess steam
called into the Pressure excursion
shape & size of a Insufficient reflux
Feed composition variance
standard
faceplate Corrective Actions:
Adjust base steam rate.
Link to Check pressure and feed
Procedures parameters vs. SOP 468 -1
-
Adjust reflux per
computation; check
Controller for cascade mode.
Check feed composition
Figure 13: Linked Alarm Information

Depicting Profiles of Temperature or Pressure
Consider these alternative distillation column
A Column Temperature Profile
temperature profile displays. When only numbers
Alarm Ranges
are shown, even an experienced operator may easily
20.1
miss a suboptimal condition. Additionally, a new 20.1 18.2
24.2
24.2 24.0
operator will find it difficult to build a mental map
25.6
25.6 25.6
of a proper profile. The desire is for all operators to 27.8
27.8 29.8
recognize normal and abnormal profiles at a single 28.9
28.9 32.9 2
glance.
Normal
range
A correct profile can be seen at a glance as a
straight line.
Is this a This one is. Too hot at the
good profile? bottom, too cold
at the top.
Depicting Dynamic Figure 14: Measurement Profile
Equipment
So what about the paradigm of using bright green to depict “on” and bright red for “off” (or
vice versa in the power industry)? This is an improper use of color. The answer is a depiction
such as Figure 15.
Wrong Better The relative brightness of the object shows

its on-off status, as does the use of a process
Pump Not
Running STOPPED
(Shape is Filled value word next to it. Equipment items
Darker)
brighter than the background are on (think of
Pump a light bulb inside them). Items darker than
Running
RUNNING the background are off. If equipment has no
(Shape is Filled
Wrong Better
Brighter) status that is sensed by the control system, but
is desired on the graphic anyway, it is shown
Dynamic equipment without instrumentation sensing
of process states can be depicted with a fill the same
as transparent to the background color. The
as the background.
status word can indicate several conditions,
Showing choices from predefined Limiting the displayed conditions as shown. Remember, if any of those are also
conditions to only those in effect:
alarm conditions, the separate alarm indicator

will appear next to the equipment when it is
Running
Interlocked
Running
Interlocked
Running
in an alarmed state.
Stopped – Error Stopped – Error
Stopped with Condition Stopped with Condition
Stopped – Needs Reset Stopped – Needs Reset
Stopped – OK to Start Stopped – OK to Start
Repair State Repair State
Stopped – Needs Reset
Figure 15: Depicting Status with Redundant Coding

and Proper Color Usage

Bars vs. Pointers
Attention to detail is important. It is typical to use bar graph elements to show relative
positions and values. While this may be better than simply showing numbers, it is inferior
to the use of moving pointer elements, since the bar disappears as the bar’s value gets low.
The human eye is better at detecting the presence of something than its absence. And, the
low condition may be more
Analog Position – Poor but Typical Analog Position - Better
important than the high
0% 25% 50% 75% 100% 0% 25% 50% 75% 100%
condition and should have Valve Valve

V-1 100% V-1 100%
V-2 100% V-2 100%
equal visual prominence. V-3 95% V-3 95%
X-1 88% X-1 88%
The example in Figure 16 is X-2 100% X-2 100%
X-3 100% X-3 100%
superior in showing relative X-4 75% X-4 75%
S-1 0% S-1 0%
values, besides the color S-2 55% S-2 55%
K-1 100% K-1 100%
improvement. K-2 100% K-2 100%
Figure 16: Bars vs. Pointers
Depicting Level Indication

Vessel levels should not be shown as large blobs of saturated color. A simple strip depiction
showing the proximity to alarm limits is better. A combination of trend and analog indicator
depictions is even better such as Figure 17. The right-hand edge of the trend replaces the pointer
and provides context.
Depiction of Vessel Level Indication

2
Crude
Feed
TK-21
56.5% 2 Hrs 49.5% 2 Hrs 81.5%
Better: Thin bar Trend with Best:

Very Poor Poor level strip with dotted lines for Combination
normal and normal range, with full context
alarm range tic marks for analog indicator
context alarm settings
Figure 17: Vessel Levels
Depicting Control Valves and Shutoff Valves

Control valves turn out to be one of the more complicated items to depict. The tendency is
to want to cram too much data into a small space. Traditionally, we depict a control valve
(throttling, variable position) with a domed head depiction and an automated block valve (only
on-off) with a rectangular head depiction.

In keeping with equipment depictions, the valve body is filled darkly for closed and brightly
for open. This also follows the P&ID paradigm for block valves. The same method can depict
the state of three-way valves. The solenoid and position switch statuses can also be shown if
desired.
Control Valves Control Valves Same Principles for On-Off

(no feedback) (with Analog Feedback) Valves, with Status Words
Output Output
Valve Head
determines No determines Valve
is Unfilled
valve head feedback valve head Traveling
Valve
Open
33%
O: 33% Open Open Trav
A: 38%
Actual determines
Valve valve body fill.
Closed O% and A %
0% numbers are shown Closed Closed
Output % Shown
Valve Fail Direction Solenoid: When Position Showing All The
Fail Fail Fail de-energized, Switches: Options: Confusing!
Open Closed Last valve moves to Made and
fail position Unmade
O: 100%
0% 0% 0% A: 99%
Avoid Tiny If You Can’t Resist, at 3-Way Valves Showing

Output Bars! Least Use a Slider Open Flow Paths
Figure 18: Control and Automated Block Valves
Depicting Equipment Commands

When DCS/SCADA points are built that indicate equipment state, the control engineer can
usually decide which words to display to represent the current state. The choices they make
are often poor. The most common example is “RUN” and “STOP.” Do these represent the
equipment’s status, or a command to it? “RUNNING” and “STOPPED” are much better status
indication words. “STOP” and “START” are commands, not statuses.
Similarly, the graphics need to differentiate clearly between status indications and command
possibilities. In general, the graphic indicates the current state, and faceplate interactions are
used to command changes to that state. It is
common to have a point type that includes Digital Composite
Point Depiction:
both a switch-type (binary) output command Pump 22 3
Command
and binary status feedback, commonly called (“setpoint”) to Run
a Digital Composite Point. Figure 19 shows a the device: Stopped Mismatch
Feedback from alarm if
compact graphic presentation of those statuses.
the device: applicable
Selecting the graphic element would call up the
faceplate for the actual interaction. Figure 19: Digital Composite Point Depiction

Use of Trends
The most glaring deficiency in HMI today is the general West Comp Flow MSCFH
55.0
lack of properly implemented trends. Every graphic
PV
generally has one or two values on it that would be far 49.1
SP
better understood if presented as trends. However, the 50.5
graphics rarely incorporate them.

45.0
-90
- --60 -30
- 2 Hours
West Comp Discharge Temp °C
Instead, engineers and managers believe vendor claims 50.0
that their operators can easily trend any value in the PV

44.1
control system on demand with just a click. This is
incorrect in practice; a properly scaled and ranged trend
40.0
-90 -60 -30 2 Hours
may take 10 to 20 clicks/selections to create, and usually
5000
15
disappears into the void if the screen is used for another Main
Steam
purpose (like calling up a different graphic). 4150
Feed
Water
3280
This deficiency is easily provable; simply walk into the Drum
Level
-0.5
control room and count how many trends are displayed. 0
1 Hr
-10
Our experience in hundreds of control rooms is that

trends are vastly underutilized and situation awareness Figure 20: Trend Depiction of
Desirable Ranges
suffers due to that.
Trends should be embedded in the graphics and appear, showing proper history, whenever
the graphic is called up. This is generally possible, but is a capability often not utilized. Trends
should incorporate elements that depict both the normal and abnormal ranges for the trended
value. There are a variety of ways to accomplish this as shown in Figure 20. The range indicator
could also indicate the alarm and interlock ranges (see the later Level 1 Overview Example;
Figure 33).
Table Design
Improper Practice Better Practice HPHMI Startup Permissives Table
Abc abc abc Abc abc abc X Breaker 15 Power OFF
Abc abc abc Abc abc abc X
Abc abc abc
Abc abc abc
Abc abc abc
Abc abc abc
Abc abc abc
X
Oil Temp 16-33
Oil Pres Status
NOT OK
NOT OK Depicting Tables
Abc abc abc Level in TK-8776 NOT OK
Gen System Status OFF
Even tables and checklists can
HPHMI Equipment Status Table Comp 88 in Auto OK
Lineup Ready
incorporate proper principles as
Air Status Mode Diagnostic NOT OK
Comp Sys Status Checks NOT OK shown in Figure 21. Consistent
Bearing Readouts OK
C #1 RUNNING AUTO OK
Comm check NOT OK colors and status indication can
C #2 STOPPED MAN OK Outlet Temp < 250 NOT OK
C #3 RUNNING AUTO OK Cooling Flow OK be integrated. The intent is to
Internal Circuit Check NOT OK
C #4 STOPPED AUTO FAULT 3
Bypass Closed NOT OK
make the abnormal stand out.
AFS Function NOT OK
Another Better Practice Status Table
Pump Status
A2 CWP A2 HWP C2 HWP A2BFPT
ON 2 ON ON ON
B2 CWP B2 HWP SUBFP B2BFPT
ON OFF ON
3 ON
Figure 21: Tables and Checklists

Depicting Advanced Process Control
Advanced Process Control (APC) is also known as Multi-Variable Control. It is the method by
which a sophisticated computer program monitors the process and adjusts controllers in real
time to continually optimize performance.
Advanced Process Control (APC)
Not all controllers are “touched” by the APC
APC is ON: Indicators for Simplified
system, and it is useful for the operator to see increase, decrease, and maintain: Alternative
which ones are, and what the APC system is APC APC APC
doing with them. Small indicators next to the
affected controllers are useful for this. Figure APC in effect on a controller:
22 shows this with an alternative, non-analog APC TK21 Level

P 75.1 %
PID controller representation that is useful in S 77.0
O 88.5 %
some circumstances. Auto
A Level 2 or 3 screen showing overall health APC is Off: APC X X

and functionality of the APC system itself is
Figure 22: Advanced Process Control
desirable.
Depicting Shutdown Activation

Operators must have the ability to shut down operating equipment manually and quickly.
However, when an important action with significant consequences is based upon operator
input, the input should have a confirmation mechanism that avoids inadvertent activation. The
“cancellation” option should be consistently implemented.
It should never be possible to make a single selection on a screen that results in an inadvertent
shutdown. A “Shutdown button” should call up at least one and perhaps two layers of
confirmation before it is possible to actually cause such a significant event.
The “defaults” of such mechanisms should be Reactor 7

X
Reactor 7
Manual Reactor 7
Manual
on the safe option. Always consider what an Shutdown
Shutdown “Continue” Shutdown
SHUT brings
inadvertent “ENTER” will do and label screen DOWN CONTINUE
CONTINUE up standard
REACTOR ACCESS Digital Shut
Shut Down
items with full clarity. 7 ACCESS
Reactor 7
Output
Down
Reactor
Manual7
Manual
Shutdown Faceplate:
Shutdown
Switch Normal
Normal
Major process upsets have occurred by
Screen button Switch
mistyping an input (for example, opening a selection calls

up a CANCEL
CANCEL
slide valve to 47 percent instead of 4.7 percent). confirmation

CANCEL
CANCEL
faceplate. Reactor 77
Older DCSs using membrane keyboards are Reactor
“Cancel” is the Manual
Manual
default: Shutdown
Shutdown
particularly susceptible to this type of error.
Error checking methods should be used to
require confirmation of numerical entries that Figure 23: Layers of Confirmation
seem inappropriate.

Depicting Interlock Functionality
Interlocks are functions whereby normal
Interlock Not Interlock in Interlock in
control actions are overridden by in Effect Effect Bypass
Interlock
predetermined process conditions. An Symbology
I I I
example would be to override a steam valve I-57D I-57D I-57D
to the closed position if the equipment Bank of Interlocks, Status and Actions
temperature or pressure is too high. I-5A I-5B I-5C Interlock Actions:

I Feed I ADTV-1 I ADTV-2 Stop Feed OFF
There are several HMI-related issues to be Stop ADTV-1 OFF
I-5D I-5E I-5F Stop ADTV-2 OFF
addressed for interlocks, and these must be I Temp I Pres I Level Max Cooling OFF
Max Vent ON
handled regardless of whether the interlock
is implemented in the DCS or in a separate Figure 24: Interlock Symbology
Safety Instrumented System.
Interlocks are implemented using logic structures – usually “blocks” or “points” or “ladders.”
These are usually complicated and cryptic to understand, when displayed using the native
capabilities of the DCS (e.g., logic point detail). They may activate infrequently, since they are
usually designed to protect against an abnormal situation. Due to this, the operator may not
encounter them for months. When they activate, the operator may not remember being told
about “the new column interlock” implemented a year ago, and have no idea why he cannot
start feed to the column. If this occurs at 2 a.m. on a Saturday night, then the engineer is
(deservedly) likely to get a phone call and production may be delayed.
Therefore every interlock, when activated, needs to indicate that activation on the appropriate
Level 2 and 3 display. The strategy
Interlock Depiction D-101
may be different for those displays. Pre-Alarm has occurred psig
Controller is in Auto 2
For Level 2 displays, a small bank of and block valve is still Open
interlock symbols can be created,

with functionality as shown in Main Feed
Figures 24 and 34. An element next Feed1 Flow D-101
P 108.5 gph
to it can indicate the interlock action S 110.0 202.0
O 52.0 %
conditions. When an interlock Auto Open Open
becomes active, any element that Interlock Depiction

D-101
psig
it is affecting (such as a pump Pre-Alarm still in effect. Interlock
has Activated with alarm. 2 2
or control valve) should have the Controller is overridden to I
Manual and both valves
interlock symbol appear next to it. are Closed
I-57D
In this manner, the operator can Main Feed

I
Feed1 Flow I-57D D-101
clearly see which interlocks are
P 0.0 gph
in effect and what items they are S 0.0 222.0
O 0.0 %
affecting. Man Closed Closed
Figure 25: Interlock Before and After Activation

For Level 3 displays, a more
I W-1A I W-1B I W-1C
detailed view of the interlock can West Compressor Interlock Initiators Mech Flow Pres
be shown such as in Figure 26. Comp in Overspeed NO 1 Stg Pres is High YES
Winding Temp is High NO 2 Stg Pres is High YES
When active, the specific interlock
Vibration is High NO Suction Pres is Low NO
symbol can be displayed next to
Oil Pres is Low NO Total Flow is Low NO
each initiator signal and affected
West Compressor Interlock Actions
output. For Level 3 displays, an
W. Comp Shutdown NO Flow Cascade to Manual YES
interlock diagnostic element
Inlet Block Valve OPEN Maximum Flow Bypass OPEN
should be created, clearly Outlet Block Valve Maximum Cooling
OPEN NORM
showing the possible initiators E. Comp Override to 100% NO Winding Purge OFF
and possible actions taken by the
interlock. This does not have to
Figure 26: Interlock Diagnostic Table
be complicated; a table such as
the following can often suffice.
When an interlock shuts down a piece of equipment, a first-out indication is often desirable
since some of the other initiators may activate after the shutdown trip occurs. Figure 27 is a
simple example of a Shutdown “First Out” Table:
Compressor 43 Shutdown Initiators
Overspeed OK
West VIB >25 X 1.5 First Out

West Bearing Temp >220 160.3
East VIB >25 1.3
East Bearing Temp >220 155.3
Suction Pressure <20 X 12.3
Discharge Temp >240 148.7
Oil Pressure <10 X 3.3
Figure 27: Shutdown Initiator Table with First Out
Shortly after the compressor shuts down due to high vibration, the oil pressure also drops,
which produces another shutdown initiator. As a result of equipment isolation, the suction
pressure may also drop sufficiently to activate another shutdown initiator. Thus by the time the
diagnostic graphic is consulted, three separate shutdown causes are present and the question
is – which is the original culprit? Two are a consequence of the immediately prior shutdown, and
the actual cause of the shutdown is shown via the “First Out.” The vibration reading depicted is
“currently” much less than the shutdown limit (since it quits shaking after the shutdown), thus
the high vibration indication (the “X”) needs to be latched until reset.

Startup Map Reactor 7 Startup
Interlocks are functions whereby Temp 80

Deg C 60
normal control actions are overridden 65.1
40
by predetermined process conditions. 20
An example would be to override a 0

20
steam valve to the closed position if the Feed
Rate 15
MPH
equipment temperature or pressure is too 10
21.1
5
high. There are several HMI-related issues
0
to be addressed for interlocks, and these 8
Additive
must be handled regardless of whether Flow 6
MPH 4
the interlock is implemented in the DCS 6.9
2
or in a separate Safety Instrumented 0
+30 +60 +90
System.
Figure 28: High Performance Element Designed for Startup Use
Navigation and Command Buttons

Multiple methods of navigation should be provided. The operator should be able to go up and
down through the hierarchy, side to side through the process, and call related details, trends,
and shutdown status displays from any graphic. This navigation capability should work with
all available methods provided by the DCS vendor – mouse or touch screen target selections,
keyboard keystrokes, context sensitive menus, or others.
Every screen (particularly Level 2) should have navigation targets to the most likely other screens
that the operator would access. When a P&ID depiction is used, any process line entering or
exiting the screen should contain a navigation link to the relevant graphic. Navigation buttons
or targets should be consistent and simple (and not look identical to command buttons).
Most control systems provide pre-made navigation button objects, including many that are
inappropriately colored, needlessly 3-D, and overly intrusive.
The system and graphics should be configured so it is never necessary for the operator to
type in a point name or graphic name. Some DCSs have arrays of programmable keys, which
can be assigned to call up certain
Navigation Buttons Faceplate or Special
Scrubber
Purpose Element
displays or combinations of
Main Menu Callup Buttons
Navigation displays. For systems that do
Target L2 Reactor M5 Pres Control
not, programmable key arrays
L2 Feed System APC are inexpensive on the computer
Non-navigation
depiction L3 M5 Agitator Product Change accessory market.
Tank Farm 2
L3 Analyzers Feed Change
Figure 29: Navigation Buttons and Targets

Implementing an entire navigation structure in a single windows-type pull-down hierarchical
menu (i.e., one with “sub-menus” that pop-out of the side) is generally not recommended,
particularly a structure more than two levels deep.
The Main Menu: It is desirable for the operator to have two-click access from any graphic to any
other graphic, to supplement any other navigation method used. Every graphic should have a
consistently placed “Main Menu” navigation button. It opens a simple text screen, logically and
hierarchically arranged, with one-click navigation links to all graphics.
Display Layout and Faceplate Handling

Displays need a consistent “look and
feel.” Different DCSs have unique Typical reserved control system menu bar and status area
embedded structures and paradigms
around the location and type of Reserved
navigation abilities, faceplates, faceplate
area,
“change zones,” programmable keys, desirable
and similar items. These features Rectangular narrow

1/16th of
should be implemented in such a way Process screen

faceplate
as to comply with the principles of
Depiction Area shown
High Performance displays.

Wider 16x9 screens Area for
It is important to use these built-in should be used to navigation
enlarge the Process buttons or other
abilities to their maximum potential. Depiction Area useful fixed
information
It is inadvisable to attempt to make a
“Brand XYZ” DCS look like a “Brand Typical reserved “status line” area
ABC.” The results will usually be far

Figure 30: Typical Screen Layout
from optimum.
Layout for a typical screen is shown in Figure 30. Screen layout usually includes these
elements:
● A top menu and status area shows a variety of information, such as screen and
alarm controls. This element is provided by the DCS manufacturer, is often
mandatory, fixed in size, and usually configurable in several ways.
● A bottom “status line” area, usually optional, depicts information about a selected
object, a command, or similar condition.
● A process depiction area is where the graphic is created.
● A reserved area for faceplates is provided. (This reserved area is a High
Performance practice.)

When screen objects are selected, additional information about them should be shown. This
is typically in the form of a faceplate popup. If the operator can interact with or manipulate
the object, the interface for that interaction is contained in the faceplate. A reserved area in
which the faceplate appears is important. It is undesirable for a faceplate to appear randomly
on the screen, obscuring the primary graphic, and then requiring it being manually dismissed
or moved. Reserved areas should be a rectangular area on the upper or lower right side of the
screen, or a narrow strip across the bottom or right-hand side.
The size of the reserved faceplate area is determined by the brand of DCS. Ideally, faceplates are
tall and narrow. This provides for placing them adjacent to the right-hand edge of the graphic,
leaving a large, contiguous, mostly rectangular area for the process depiction. But, some DCSs
have faceplates that are large, square, clunky, and poorly organized, making a reserved area for
them difficult to accomplish. If you own such a system, encourage the manufacturer to move
into the 21st century and modify their standard faceplates.
Only one item on a screen should be selectable at a time. Any new selection on the screen
should replace any prior faceplate from a prior selection, without any manual “closing” of
the prior faceplate needed. On a few screens, it might be desirable to enable more than one
faceplate at a time.
Faceplates are usually supplied as standard elements by the DCS manufacturer. It may or may
not be possible to alter them, and they may not follow some of the principles you desire for
your HMI, such as proper and consistent use of color. However, rebuilding or replicating dozens
of standard faceplates from scratch to correct minor consistency issues may not be worth the
effort, since future vendor software upgrades may override that work.
The faceplate should show the point name and description, since point names should not
normally be shown on a graphic. Exposing even more configuration information (i.e., Level 4
“point detail” or configuration data) about the point should be possible from the faceplate
element. Faceplate interaction should not be modal (i.e., preventing other graphic action until
the faceplate is closed).
We have seen a presentation advocating that faceplate functionality (altering setpoints, outputs,
modes, states, etc.) be incorporated into the graphics themselves, and the use of the standard
faceplate interaction eliminated. Now, as you can imagine, we are always open to evaluating
new ideas, but not every new idea is a good one! The claim is made that “it is speedier and the
operator might save fractions of a second per interaction that way, which will add up to maybe
several hours saved per year.” This is a bad idea, because huge amounts of additional custom
coding and its upkeep are needed and significant layout and consistency problems must be
addressed. Stick with faceplates.

Depending on DCS HMI capabilities, other methods for point information manipulation are
possible, such as right-click menu access.
64.2 C-42
22 %
Avoiding “Blob” Graphics
Some places have carried the gray-scale principle 65.1
too far and created extremely low-contrast “blob” 68.2
graphics shown in Figure 31. These are gray-on-gray, 70.5 107.56
typically without even thin black boundary lines 72.6
defining the various elements. These are a bad idea;

we have seen many operators squinting at these to 80 %
figure out what is happening. Graphics should be C-44
clear and unambiguous, and blob graphics are not

recommended. The key is to provide easy visibility
of elements, but to reserve emphasis for abnormal
situations. Figure 31: “Blob Graphic” Elements
with Insufficient Contrast
Display Hierarchy
Displays should be designed in a hierarchy that provides progressive exposure of detail. Displays
designed from a stack of P&ID schematic designs will not have this; they will be “flat” like a
computer hard disk with one folder for all the files. This does not provide for optimum situation
awareness and control. A four-level hierarchy is desired.
Level 1 Note: Possibly More than one

Process Area Overview Display available,
Overview designed for significantly
Display different operating states
Level 2 Level 2 Level 2 Controllers,

Process Unit Process Unit Abnormal Values, Alarms,
Control Display Control Display Situation Tasks Trends, Status
Level 3 Level 3 Level 3 Smaller equipment

groups, Controllers,
Process Unit Process Unit Process Unit
Alarms, Values, Trends,
Detail Display Detail Display Detail Display
ESD Displays, Equipment
Status
Level 4 Level 4 Level 4 Interlocks, Details,

Diagnostics, “First-Outs,”
Process Unit Process Unit Process Unit
Procedures,
Support Display Support Display Support Display
Documentation, Help
For Each Overview Display, Multiple Level 2 Process Unit Detail Displays
For Each Level 2 Display, Multiple Level 3 Process Unit Detail Displays
For Each Level 3 Display, Multiple Level 4 Process Unit Support Displays
Figure 32: High Performance HMI Display Hierarchy

Level 1 – Operation Overview
5000 7500 1200
Unit 2 5000 1250 1200
15 5 3000
Overview
Steam Air Steam
05-31-14 KLBH KLBH °F
13:22:07 4100 5820 990
Total Fd Wtr Coal Reheat
Alarms KLBH KLBH °F
4580 980 1005
1 0 Drum Furn Steam
Lvl in. Pres psig
5 -0.5 -0.5 2400
2
0 0 600
3 8 0 0 600
-15 -45 -30 -15 1 HR -5 -45 -30 -15 1 HR 0 -45 -30 -15 1 HR
Status Alarms Pump Status Fan Status

PULV D-ON B-ON A B C D PUMPS A2 CWP A2 HWP C2 HWP A2BFPT A2 ECW A2 FD B2 FD A2 PA
E-ON H-ON AND ON ON ON ON ON ON ON ON
C-ON A-OFF E F G H FANS B2 CWP B2 HWP SUBFP B2BFPT B2 ECW A2 ID B2 ID B2 PA
F-OFF G-ON ON OFF ON ON ON ON ON ON
Turbine-Generator LPT-A LPT-B H2 H2 Turb Oil Stator Condenser-Feed Wtr HW Lvl Drum Lvl DA Lvl DA Wide Cond Hdr
Gross MW Net MW MVAR HZ in.hg in.hg psig °F °F GPM A2 BPFT B2BPFT in.H2O In. H2O in.H2O FT H2O psig
2
702.1 640.1 -5.2 60.00 0.2 0.2 49.1 104 115 351 3.1 3.1 20.1 -0.5 0.0 9.0 400
Auto Auto Auto Auto
Boiler BBD Econ Econ Gas Aux Stm Fans A2ID A2FD B2ID B2FD Econ Sec Air CEMS NOX SO2 CO Inst Air
A/F Ratio pH pH Out °F psig F. in.H2O Stall Stall Stall Stall % O2 in. H2O % Opac #/MMBTU #/MMBTU ppm psig
2
7.1 9.4 9.4 775 300 -0.5 25 25 25 25 6.0 7.0 21 0.45 0.9 200 90
Auto
Figure 33: Example Level 1 Display
This is a single graphic showing the operator’s entire span of control, the big picture. It is an
overall indicator as to how the operation is running. It provides clear indication of the current
performance of the operation by tracking the Key Performance Indicators as in Figure 33.
Level 1 Overview graphics are usually not designed for making control interactions (i.e., no
faceplate zone).
The Figure 33 example is from a large power plant. We often hear “But it doesn’t look like
a power plant!” Correct! Does your automobile instrument panel look like a diagram of your
engine surrounded by numbers? The display is designed so that it is easy to detect if the plant
is running well or poorly, and that important abnormal conditions and alarms stand out clearly.
The Level 1 graphic is ideal for display on a large, perhaps off-console monitor. Many have
purchased such large screens with little idea of how to make the best use of them.

Level 2 – Unit Control
Feed Composition Coolant: Cat. Purge Conv. Feed ADTV-1 ADTV-2 Temp Pres
%A %B %C GPM °C Act% MCFH Eff. % MPH MPH MPH
Product:Thionite State: Mid-Run RTAM: ON-OK Reserved
°C psig
Run Plan: Faceplate Zone
2
Actual:
I-5A I-5B I-5C SHUT When any item

I I I
Feed ADTV-1 ADTV-2 DOWN M5
on the screen is
I-5D I-5E I-5F selected, the
I Temp I Pres I Level FREEZE
faceplate for that
M5
item appears in
Interlock Actions:
Stop Feed OFF Max Cool OFF ISOLATE this reserved
80.5 15.5 4.0 80.5 15.5 4.0 80.5 15.5 77.5 11.9 4.0 45.0 112.2 Stop ADTV-1 OFF Max Vent OFF M5 area.
Auto Auto Auto Auto Auto Stop ADTV-2 OFF Max Circ OFF
All control
27 17 48 53
manipulation is
80.0 % % % % VENT SYS accomplished
Open 48 % through the
Feed 35 %
MPH
standardized
faceplates.
Open Open Open Open Lvl Prod Material Balance
OP % MPH In: 19.7 Out: 19.3
To Coils
72.0
-90 -60 -30 2 Hrs Reactor
Reactor M5
M5 Agitator IN OUT
4
ON
14.0 +10%
Analysis: Purity %
ADTV 40.0
Main Menu
1 0%
MPH
L2 M5 Startup
OP
-10% L2 M5 Scram
10.0
-90 -60 -30 2 Hrs 75.9 92.0 %DIFF
32.0 Auto Calc Diff: 2.1 % L2 Feed System
-90 -60 -30 2 Hrs 75.0
6.0 54.3% Hours: 238.1
ADTV Analysis: Inhibitor Concentration % L2 Prod Recovery
2 6.0
MPH L2 Compression
OP L2 RX Summary
2.0 PRODUCT ---- Level 3 ----
-90 -60 -30 2 Hrs Open 5.0 % 74.3 %
Daystrom Pumps
48.0 4.0 M5 Circ Pumps Needed: 1
-90 -60 -30 2 Hrs M5 Interlocks
Temp Pump A Pump B
°C 75.8 Backup Lvl % Running Stopped M5 Cooling Sys
Open
OP OK Fault M5 Vent Sys
40.0 3
-90 -60 -30 2 Hrs M5 Agitator
Figure 34: Example Level 2 Display of a Reactor
Every operation consists of smaller, sub-sectional unit operations. Examples include a single
reactor, a pipeline segment, a distillation train, or a compressor station. A Level 2 graphic exists
for each separate major unit operation. It is designed to contain all the information and controls
required to perform almost all operator tasks associated with that section, from a single graphic
as shown in Figure 34.
Notice how the analog indicators and controllers are lined up for easy scanning, rather than
being scattered all around a P&ID depiction. Ease of abnormal situation detection is an important
HPHMI design consideration.
When properly designed, most operator actions will occur at Level 2, and the Level 3 graphics
will be used only for more detailed troubleshooting.

Level 3 – Unit Detail
West Compressor
Reserved
20.1 psi MANUAL ACTIONS
Speed Tot Flow 1 Stg 2 Stg CLR In CLR Out Winding Faceplate Zone
OH EAST COMP
% MSCFH psi psi °C °C °C
WEST WC Speed IDLE PURGE
P 90.8 %
WEST WEST When any item
COMP S 90.0
OPEN O COMP COMP on the screen is
RUNNING 90.0 %
CAS selected, the
faceplate for that
111.0 °C item appears in
95.1 Oil psi this reserved
SHUT
ISOLATE area.
48.0 psi DOWN
WEST
65.0 °C 90.8 76.8 48.0 90.0 65.0 32.0 111 WEST All control
1st Cas Auto COMP
COMP manipulation is
Stage 20.0 °C accomplished
Inter- through the
cooler CW
standardized
44.0 °C 2nd 28.0 °C Flow Demand faceplates.
P 76.8 MSCFH FLOW-SPEED
Stage 32.0 °C EAST COMP S 76.0 CASCADE
O 88.5 % IN EFFECT
AUTO
OPEN 90.0 psi 48.4 MSCFH
RECOVERY
Main Menu
50.0 West Comp Discharge Temp °C 55.0 West Comp Flow MSCFH 95.0 West Comp Speed %
L2 Compression
L2 Recovery
---- Level 3 ----
Seq. Overlay
40.0 45.0 85.0 Startup Overlay

-90 -60 -30 2 Hours -90 -60 -30 2 Hours -90 -60 -30 2 Hours
West Interlocks
I W-1A I W-1B I W-1C
West Compressor Interlock Initiators Mech Flow Pres West Compressor Interlock Actions West Cooling
Comp in Overspeed NO 1 Stg Pres is High NO W. Comp Shutdown NO Flow Cascade to Manual NO East Comp
Winding Temp is High NO 2 Stg Pres is High NO Inlet Block Valve OPEN Maximum Flow Bypass CLOSED ---- Level 4 ----
Vibration is High NO Suction Pres is Low NO Outlet Block Valve OPEN Maximum Cooling NORM Logic Diagrams
Oil Pres is Low NO Total Flow is Low NO E. Comp Override to 100% NO Winding Purge OFF
Procedures
Figure 35: Example Level 3 Display
Level 3 graphics provide all of the detail about a single piece of equipment. These are used for
detailed diagnosis of problems. They show all of the instruments, interlock status, and other
details. A schematic or P&ID type of depiction is often desirable for a Level 3 display.
The Figure 35 example shows what could be created “from scratch” as a Level 3. Besides the
P&ID depiction, other HPHMI elements are included. In existing systems, most graphics are
actually Level 3. See the “HPHMI Implementation on a Budget” section in the Part 2 document
for guidance about this.
Level 4 –Support and Diagnostic Displays

Level 4 displays provide the most detail of subsystems, individual sensors, or components.
They show the most detailed possible diagnostic or miscellaneous information. A “Point Detail”
display is a typical example. The dividing line between Level 3 and Level 4 displays can be
somewhat gray.

Conclusion of the Part 1 Document
The principles of High Performance HMI are specifically developed to deal with the needs of
today’s operators regarding the complex systems they manage. A High Performance HMI is
designed to be the best tool for operator interaction with the process control system. It is
designed to maximize operator situation awareness and abnormal situation detection and
response.
In the separate Part 2 document, we provide case studies supporting that a High Performance
HMI accomplishes these goals. In addition, there is discussion of a major HMI-related advance
in the power industry, a review of HMI Standards, and an example Table of Contents of HMI
Philosophy and Style Guide documents.

About the Authors
Bill R. Hollifield, PAS Principal Alarm Management and HMI Consultant
Bill is the Principal Consultant responsible for the PAS work processes and
intellectual property in the areas of both Alarm Management and High
Performance HMI. He is a member of the American Petroleum Institute’s API
RP-1167 Alarm Management Recommended Practice committee, the ISA SP-
18 Alarm Management committee, the ISA SP101 HMI committee, and the
Engineering Equipment and Materials Users Association (EEMUA) Industry
Review Group.
Bill has multi-company, international experience in all aspects of Alarm Management and HMI
development. He has 28 years of experience in the petrochemical industry in engineering and
operations, and an additional 12 years in alarm management and HMI software and services for
the petrochemical, power generation, pipeline, pharmaceutical, and mining industries.
Bill is co-author of The Alarm Management Handbook, The High Performance HMI Handbook, and
The Electric Power Research Institute (EPRI) Guideline on Alarm Management.
Bill has authored several papers on Alarm Management and HMI, and is a regular presenter on
such topics in such venues as API, ISA, and Electric Power symposiums. He has a BSME from
Louisiana Tech University and an MBA from the University of Houston. In 2014, Bill was made an
ISA Fellow.
Hector R. Perez, PAS High Performance HMI Product Manager
Hector oversees the High Performance HMI business line at PAS. He is a

chief designer of High Performance graphics intended to facilitate situation
awareness in a variety of industries. At PAS, Hector oversees PAS software
directions to improve product design and capabilities.
Prior to working with PAS, Hector was a senior engineer at Schlumberger. His
strength in design contributed to his success in creating new and improved
HMIs for reservoir evaluation services and interfaces for business Key
Performance Indicator tracking.
In addition to his expertise in High Performance HMI, Hector has widespread experience in all
aspects of Alarm Management. He has facilitated numerous Alarm Management workshops,
conducted alarm rationalization projects, and developed Alarm Philosophy documents for a wide
range of clients in the petrochemical, power generation, pipeline, and mining industries.
Hector has authored technical articles on High Performance HMI. In 2009, he and Bill collaborated
with the Electrical Power Research Institute (EPRI) on a comparative research study evaluating
High Performance graphics and operator effectiveness. Hector holds a Bachelor of Science in
Chemical Engineering from Rice University.

References
API-RP-1165: Recommended Practice for Pipeline SCADA Displays, American Petroleum Institute
(2006)
Crawford, W., Hollifield, B., Perez, H., Electric Power Research Institute Operator HMI Case Study:
The Evaluation of Existing “Traditional” Operator Graphics vs. High Performance Graphics in a
Coal Fired Power Plant Simulator, Product ID 1017637 (2009)
Hollifield, B. Oliver, D., Nimmo, I., and Habibi, E., The High Performance HMI Handbook. PAS (2008)
Hollifield, B. and Habibi, E. 2006. The Alarm Management Handbook, 2nd edition. PAS (2010)
ANSI/ISA-101.01-2015: Human Machine Interfaces for Process Automation Systems, International

Society for Automation, August 2015

About PAS
PAS Global, LLC is a leading provider of software solutions for process safety, cybersecurity, and
asset reliability to the energy, process, and power industries worldwide. PAS solutions include
industrial control system cybersecurity, automation asset management, alarm management, high
performance HMI, boundary management, and control loop performance optimization. PAS
solutions are installed in over 1,000 facilities worldwide with more than 40,000 users.
For more information, visit www.pas.com.
Connect with PAS on Twitter @PASGlobal or LinkedIn.
© PAS Global, LLC 2017. Ideas, solutions, suggestions, hints and procedures from this document
are the intellectual property of PAS Global, LLC and thus protected by copyright. They may not be
reproduced, transmitted to third parties or used in any form for commercial purposes without the
express permission of PAS Global, LLC.


White Paper ISA101 - Maximize Operator Effectiveness Part 1

Загружено:

Сведения о документе

Оригинальное название

Авторское право

Доступные форматы

Поделиться этим документом

Поделиться или встроить документ

Параметры публикации

Этот документ был вам полезен?

Это неприемлемый материал?

Авторское право:

Доступные форматы

White Paper ISA101 - Maximize Operator Effectiveness Part 1

Загружено:

Авторское право:

Доступные форматы

Maximize Operator Effectiveness:

High Performance HMI Principles and Best Practices

A PAS White Paper

High Performance HMI 3.0 - Part 1 | Cover

High Performance HMITM | Table of Contents

High Performance HMI 3.0 - Part 1 | Page 1

Part 2 (Separate Document)

High Performance HMI 3.0 - Part 1 | Page 2

The control wall had the advantages of

These systems had several disadvantages.

Graphics such as Figures 2

High Performance HMI 3.0 - Part 1 | Page 3

As control system hardware

There are no trends, condition

High Performance HMI 3.0 - Part 1 | Page 4

Figure 5: Garmin G2000® Avionics Package in a Small Plane

High Performance HMI 3.0 - Part 1 | Page 5

Ineffective graphics encourage poor operating practices, such as operating by alarm. By

Information is data in context made useful.

tell if it is running at peak efficiency or is about

“what is good” is a difficult cognitive process.

RECYCLE COMPRESSOR K43

Figure 7: Analog Depiction of Information

High Performance HMI 3.0 - Part 1 | Page 7

Figure 8: Further Explanation of Moving Analog Indicators

High Performance HMI 3.0 - Part 1 | Page 8

Figure 9: Analog Depiction of PID Controllers and Position Feedback

Proper User of Color

High Performance HMI 3.0 - Part 1 | Page 9

Light Gray 243, 243, 243 ON indication for equipment

Gray 136, 136, 136 Off indication for equipment

Dark Gray 74, 74, 74 Some text, minor process lines

Light Blue 187, 224, 227 Desired operating ranges or conditions

Cyan 0, 255, 255 Vessel level strips, trend lines

Brown 204, 102, 0 Trend lines, position feedback indiciation

Red 255, 0, 0 Top level, priority one alarm

Yellow 255, 255, 0 Priority two alarm

Orange 255, 102, 0 Priority three alarm

Magenta 255, 0, 255 Priority four alarm for diagnostics

Dark Magenta 204, 0, 102 Trend lines

Figure 10: An Example HPHMI Color Palette

Elements and Depictions of HPHMI

Depicting Process Values

High Performance HMI 3.0 - Part 1 | Page 10

Display of process values. No alarm conditions are in effect.

Normal Bad Value Out of Range

Bad or Out of Range Value

Discrete (“digital”) conditions are shown using the same blue

Selection of an item causes the relevant faceplate to appear

480.1 psi 480.1 psi

Invisible selection area Selection indication

Figure 11: Depicting Process Values

High Performance HMI 3.0 - Part 1 | Page 11

480.1 psi 480.1 psi 480.1 psi 480.1 psi

Improved Alarm Depictions With Redundant Coding

Priority 4 Priority 3 Priority 2 Priority 1

Figure 12: Depiction of Alarms

It is highly beneficial to include access within the HMI

Figure 13: Linked Alarm Information

High Performance HMI 3.0 - Part 1 | Page 12

Depicting Dynamic Figure 14: Measurement Profile

Wrong Better The relative brightness of the object shows

alarm conditions, the separate alarm indicator