HMI design that helps operators: layout, colour and alarms

A good HMI screen makes abnormal conditions stand out more than normal ones, uses colour only for specific meanings, and arranges information from overview to detail.

An HMI (human machine interface) is the screen where an operator sees the process and gives commands. It can be a small panel on one machine or a set of operator stations on top of a SCADA system or a DCS. This guide is about the design of those screens: layout, colour, hierarchy and alarms, with notes from Citia projects.

An HMI exists so that an operator notices a problem early and acts correctly. Everything on the screen should serve that purpose.

In a PLC system, the HMI shows the machine state, accepts start and stop commands and displays faults. In SCADA or a DCS, operator stations add plant-wide overviews, trends, alarm lists and navigation across many units. The ISA-101 series, published by the International Society of Automation, covers how such interfaces are designed, deployed, operated and maintained, with improved situational awareness as one of its stated aims.

Situational awareness means the operator knows what is happening, understands what it means and can predict what comes next. A screen packed with bright pump icons and live numbers can look impressive and still fail that test, because the one value that matters is lost among the rest.

At a fuel terminal, HMIs appear at several levels: a panel on the loading gantry or pump skid, the SCADA stations in the control room, and sometimes a DCS. Each should follow the same style rules. Otherwise an operator who moves between them reads the same colour in two different ways, and a habit learned on one screen becomes a mistake on another.

Many plant screens were drawn to look like the equipment. Newer practice draws them to show the state of the process.

The difference is easiest to see side by side. The table describes the two styles in general terms; it is not a copy of any client screen.

None of this means old screens must be thrown away. The value of the comparison is in the questions it raises: does each colour on this screen mean something, and can a new operator find the one abnormal value without help?

An alarm is a request for the operator to act. If the screen raises more requests than a person can handle, the important ones get missed.

ISA-18.2-2016 is the ISA standard for managing alarm systems in the process industries. A Control Engineering article on implementing it, published by Yokogawa in 2013, gives the alarm rates from the standard as practical limits of human capability; the figures are shown below. Use them as a yardstick when reviewing an alarm list, not as a target to fill.

The work that fixes an alarm list is called rationalisation. Each alarm is reviewed for its cause, its consequence, the operator action and its priority, and alarms that need no action are removed or turned into events. ISA-18.2 places this step inside an alarm management lifecycle, so the list stays clean after the project ends.

False alarms are as harmful as too many real ones. At the Lomanis fuel terminal, Citia traced alarms one by one through the DCS alarm and event log after a power failure, separated genuine from false ones and corrected the alarm logic, because persistent false alarms can draw attention away from real process alarms. See the Lomanis alarm clean-up.

Most HMI work at Indonesian sites is adding data to existing screens or fixing screens that no longer match the plant. The examples come from Citia project records.

• At Eltech in Bekasi, busbar power, humidity and temperature data that could only be seen locally were brought into the central SCADA. Validating the Modbus register mapping was essential so the values on screen matched the devices. See the Eltech HMI integration.
• At the Pertamina Bitung integrated terminal, an AVEVA InTouch HMI in the central control room now shows pump pressure and VSD status, so operators no longer walk to the field to check them. See the Bitung pump restoration.
• At the Balongan effluent water treatment plant, PLC, HMI and SCADA integration went through loop checks, I/O tests, functional tests and a site acceptance test before handover. See the Balongan EWTP work.

At Lomanis, the review also found DCS pages that were not updating and product tanks on the HMI that might differ from the real ones. Screens drift away from the plant when changes in the field are not carried back into the graphics.

A short checklist catches most HMI problems before operators meet them. Run it with an operator in the room, not only with the engineer who drew the screen.

The items below are practical checks rather than clauses from a standard. They fit any package, from a local panel to a SCADA or DCS station. For how the HMI fits next to PLCs, DCS and SCADA, see PLC vs DCS vs SCADA vs HMI.

Repeat the checklist after every significant change, such as new equipment, a protocol gateway or a SCADA upgrade. Screens rarely break at handover; they drift over the years that follow.