Seit Jahren steigen psychische und psychosoziale Belastungen im Arbeitsalltag von Ingenieuren* an, was unter anderem an der zunehmenden Zahl von Erkrankungen, die beispielsweise auf permanenten Stress zurückzuführen sind, erkennbar ist. Durch die Pandemie, die seit mehr als einem Jahr Alltag und Arbeitsleben maßgeblich beeinflusst, treten diese Belastungen noch deutlicher in den Vordergrund. Nach einer kurzen Einführung werden zunächst theoretische Grundlagen dargelegt und wesentliche Begriffe definiert. Mit Blick auf den Arbeitsplatz werden potenzielle Belastungen skizziert und die Bedeutung von Kompetenzen herausgearbeitet, die unterstützen können, um mit diesen Belastungen umzugehen. Außerdem wird der Frage nachgegangen, ob Ingenieure das nötige „Kompetenz bezogene Rüstzeug“ - sprich die persönlichen psychischen Ressourcen - haben, um mit den Anforderungen und Belastungen, die sich am Arbeitsplatz ergeben, adäquat umgehen zu können und welche Bedeutung der Hochschulausbildung dabei zukommt. Den Abschluss bildet ein Plädoyer für eine systematische (Neu-)Ausrichtung und regelmäßige Weiterentwicklung bzw. Anpassung der Aus- und Weiterbildung von Ingenieuren anhand von ermittelten Anforderungen bzw. Belastungen am Arbeitsplatz – nicht zuletzt basierend auf einem Constructive Alignment.

Major accidents in the process industries occurred mostly as an outcome of multiple failures in different safety barriers and their interrelation with unsafe acts by frontline operators. This has become the reason why safety analyses in terms of plant technical aspects cannot be performed independently from analysing human response to the changing technology. Unsafe acts and errors by operators must be seen as a symptom of system insufficiencies and underlying problems, rather than as the cause of an accident. With this paradigm, the need to optimally configure the system and the whole working condition to understand human’s limitation and requirements becomes very evident. It is too naive to desire that human operators make zero error by asking them to change their behaviour and to perfectly adapt to the system. Human Factors (HF) attempts to cope with the need to understand the interrelation between human operators, the technology they are working with and the management system, with the aim to increase safety and efficiency. In achieving this goal, HF must be incorporated into the whole plant lifecycle, from the earliest design stage to plant operation and modifications. Moreover, HF analysis must comprise all kinds of operators’ activities and responsibilities in operating process plants, which can include manual works in field and supervisory control conducted remotely from a control centre/room. This work has developed techniques that provide systematic way to incorporate HF into process plant lifecycle. The new HF analysis technique, PITOPA-Design, in a combination with the classic PITOPA, is applicable for an implementation during design and operation of a plant. With the awareness that safety analysis and HF cannot be performed separately, an interconnection with HAZOPs is made possible by means of this new technique. Moreover, to provide a systematic analysis of operators’ work in control room, an additional technique, the PITOPA-CR was also developed. This HF technique can as well be integrated into a general HF analysis both during design phase and plant operation. In addition to it, results coming from PITOPA-CR will provide information required to optimally configure control and alarm system, as well as the whole alarm management system to better understand the limitation and requirements of control room operators. The structure of the development can be described as follows: i) Development of HAZOPA (the Hazards and Operator Actions Analysis), which provides the interconnection between HF analysis and HAZOPs, ii) Development of PITOPA-Design, a technique to incorporate HF consideration into design phase, which is differentiated into 3 stages to comprise the conceptual design, the basic engineering and the detail engineering phase, iii) Development of PITOPA-CR, a technique for HF analysis in control room, iv) Integration of PITOPA-CR into alarm management system, development of a technique for alarm prioritization. / Schwere Unfälle in der Prozessindustrie erfolgen meist aus einem Zusammenspiel mehrerer verschiedener Fehler und der gleichzeitigen Wechselwirkung mit falschem menschlichem Handeln. Dabei sind diese Fehlhandlungen nicht als Unfallursache anzusehen, sondern sie resultieren aus Fehlern, die in dem System selbst zu finden sind. Aus diesem Grund kann bei der Sicherheitsanalyse die technische Analyse nicht unabhängig von der Betrachtung des Human Factors (HF) durchgeführt werden. Um eine Reduzierung der Fehlhandlungen zu erreichen, müssen das Anlagendesign, die Bedienbarkeit und die Arbeitsumgebung an die menschlichen Fähigkeiten angepasst werden. Human Factors (HF) betrachtet die Interaktion zwischen menschlichen, technischen und organisatorischen Aspekten einer Anlage, mit dem Ziel die Sicherheit und Effektivität der Anlage zu optimieren. Dafür ist eine Einbindung von HF in den gesamten Lebenszyklus einer Anlage notwendig. So müssen HF- Analysen nicht nur während des Betriebs einer Anlage und bei Prozessmodifikationen durchgeführt werden, sondern auch während des gesamten Design- Prozesses, da gerade in den frühen Design-Phasen das Optimierungspotential besonders hoch ist. Eine solche Analysemethode muss alle Aufgaben eines Operators erfassen, so dass zwischen manueller Arbeit und der Arbeit in der Leitwarte unterschieden werden muss. In dieser Arbeit wurden Analysentechniken entwickelt, die einen systematischen Ansatz zur Berücksichtigung des HF über den gesamten Lebenszyklus einer verfahrenstechnischen Anlage darstellen. Mit Hilfe der neuen Analysemethode, PITOPA-Design, können Untersuchungen sowohl während der Designphase als auch während des Betriebs einer Anlage durchgeführt werden. Da solche HF-Analyse immer in Verbindung mit einer klassischen Sicherheitsanalyse erfolgen muss, bindet die neue Methode die HAZOP-Analyse direkt ein. Darüber hinaus wurde ein weiterer Ansatz für die Analyse von Operatorhandlungen in einer Messwartenarbeit entwickelt. Diese neue Analysentechnik, PITOPA-CR, bildet die Grundlage für Verbesserungen im Alarmsystem und wird in das Alarmmanagementsystem eingebunden. Die Arbeit ist wie folgt strukturiert: i) Entwicklung von HAZOPA (the Hazards and Operator Actions Analysis). Diese Methode stellt die Einbindung der HF-Analyse in HAZOP dar. ii) Entwicklung von PITOPA-Design, zur HF-Analyse während des gesamten Designprozesses einer verfahrenstechnischen Anlage. Die Methode wurde in 3 Teile eingeteilt, um die drei Designsphasen Conceptual-, Basic-, und Detail-Design zu erfassen. iii) Entwicklung von PITOPA-CR, zur HF-Analyse in der Messwarte. iv) Einbindung von PITOPA-CR in das Alarmmanagementsystem und Entwicklung einer Technik zur Alarmpriorisierung.

The work of an engineer is closely intertwined with safety. An engineer’s perception of the “safety” task is traditionally inherent in his or her design. However, in the technical world most machines and systems designed by engineers contain a human element, which engineers have to consider in their work. In the oil and gas upstream industry – especially drilling, production and workover operations – petroleum engineers (including drilling and production engineers) are responsible not only for design but also for operational and organizational aspects. The human factor becomes more important in complex offshore operations. Incorporating safety into a sys-tem design requires identifying, analyzing and evaluating risks and ensuring that any not accounted for are taken into consideration. This process requires communication among everyone involved in the process. Analysis of accidents in the oil and gas industry shows that often a lack of that communication led to incident triggering events. In this thesis, the author proposes a novel communication model that improves this exchange of information and supposedly makes the process of risk assessment more effective. In addition, the new model also incorporates factors such as emotions, feelings, needs and imagination into the risk assessment process. This broadens the information base for the risk identification and analysis and creates an atmosphere of psychological ownership for the stakeholders in the process, which leads to a perceived safety climate in the organization where the new model is applied. The innovative communication or consultation model, as it is also referred to in risk assessments, is based on a structured process used in conflict resolution called mediation. Mediation is an alternative conflict resolution process that is centered on mutual under-standing and listening to each other’s needs. The process is composed of elements that characterize it. These elements of mediation are used to assess other communication processes and to develop new communication models. The application of the elements of mediation and the safety-mediation consultation into the risk assessment process enables this process to be enhanced with human factors such as emotions, feelings, intuition and imagination. The inclusion of all stakeholders creates psychological ownership, improves communication, enables organizational learning and expands the knowledge base for risk analysis. The applicability of the safety-mediation consultation process for a human factor-based risk assessment is presented and tested using illustrative examples and field cases from the international oil and gas industry. Possible concerns and limitations are also discussed. This thesis shows that mediation and elements of the mediation process can be applied to improve communication in the international oil and gas industry. This is facilitated by educated safety mediators, who help the petroleum engineer and operational crew on a drilling rig to achieve a better understanding by ensuring that they hear and fully register each other’s needs.

Major accidents in the process industries occurred mostly as an outcome of multiple failures in different safety barriers and their interrelation with unsafe acts by frontline operators. This has become the reason why safety analyses in terms of plant technical aspects cannot be performed independently from analysing human response to the changing technology. Unsafe acts and errors by operators must be seen as a symptom of system insufficiencies and underlying problems, rather than as the cause of an accident. With this paradigm, the need to optimally configure the system and the whole working condition to understand human’s limitation and requirements becomes very evident. It is too naive to desire that human operators make zero error by asking them to change their behaviour and to perfectly adapt to the system. Human Factors (HF) attempts to cope with the need to understand the interrelation between human operators, the technology they are working with and the management system, with the aim to increase safety and efficiency. In achieving this goal, HF must be incorporated into the whole plant lifecycle, from the earliest design stage to plant operation and modifications. Moreover, HF analysis must comprise all kinds of operators’ activities and responsibilities in operating process plants, which can include manual works in field and supervisory control conducted remotely from a control centre/room. This work has developed techniques that provide systematic way to incorporate HF into process plant lifecycle. The new HF analysis technique, PITOPA-Design, in a combination with the classic PITOPA, is applicable for an implementation during design and operation of a plant. With the awareness that safety analysis and HF cannot be performed separately, an interconnection with HAZOPs is made possible by means of this new technique. Moreover, to provide a systematic analysis of operators’ work in control room, an additional technique, the PITOPA-CR was also developed. This HF technique can as well be integrated into a general HF analysis both during design phase and plant operation. In addition to it, results coming from PITOPA-CR will provide information required to optimally configure control and alarm system, as well as the whole alarm management system to better understand the limitation and requirements of control room operators. The structure of the development can be described as follows: i) Development of HAZOPA (the Hazards and Operator Actions Analysis), which provides the interconnection between HF analysis and HAZOPs, ii) Development of PITOPA-Design, a technique to incorporate HF consideration into design phase, which is differentiated into 3 stages to comprise the conceptual design, the basic engineering and the detail engineering phase, iii) Development of PITOPA-CR, a technique for HF analysis in control room, iv) Integration of PITOPA-CR into alarm management system, development of a technique for alarm prioritization.:ACKNOWLEDGEMENT i ABSTRACT iii ZUSAMMENFASSUNG iv CONTENTS v TABLE OF FIGURES viii LIST OF TABLES x NOMENCLATURE xi ACRONYMS AND ABBREVIATIONS xii CHAPTER 1 1 INTRODUCTION 1 1.1 Background 1 1.2 Objectives 2 1.3 Scope of Work 3 CHAPTER 2 5 THEORETICAL BACKGROUND 5 2.1 Fundamentals of Human Error 5 2.2 Human Factors (HF) 8 2.3 Motivations to Consider HF in Process Safety 9 2. 3. 1 Accidents that Address HF in Process Safety 11 2. 3. 2 Regulation and Legal Requirements 16 2. 3. 3 Business Value 19 2.4 Work of Operators in Complex Systems 19 2. 4. 1 Role of Operators in Complex Systems 20 2. 4. 2 Problems with Computerisation and Automation 24 2. 4. 3 Allocation of Functions and Levels of Automation 25 2.5 Performance Influencing Factors (PIFs) 27 2.6 Distributed Control System (DCS) and Alarm Systems 29 2. 6. 1 Alarm, Alarm System and Alarm Management 30 2. 6. 2 Most Common Alarm Problems 33 2. 6. 3 Improving Alarm Performance through Prioritization 34 2.7 Safety Analysis Methods 38 2.7.1 Qualitative Safety Analysis 39 2.7.2 Quantitative Safety Analysis 43 2.8 Mathematical Algorithms 44 2.8.1 Techniques for Multi-Criteria Decision Making (MCDM) 44 2.8.2 Classification Methods 47 CHAPTER 3 50 RECENT DEVELOPMENTS IN HF STUDIES 50 3. 1 Methods for HF analysis 50 A. Task Analysis 50 B. Techniques for Operators Actions Analysis 51 3. 2 Human Reliability Analyses (HRA) 52 3. 3 Consideration of Human Error in HAZOP 53 3. 4 HF in Process Plant Design 54 3. 5 HF in Alarm Management and DCS-Design 55 3. 6 The Need for Further Development of HF Methods 57 CHAPTER 4 58 MOTIVATION OF THE WORK 58 CHAPTER 5 61 PROCESS INDUSTRY TOOL FOR OPERATOR ACTIONS ANALYSIS (PITOPA) 61 5.1 The New Technique for Operator Actions Analysis (OAA) 64 5.2 Technique for Performance Influencing Factors (PIFs) Evaluation 65 5.3 Validation of PITOPA in the Process Industry 67 CHAPTER 6 71 EXTENDING HAZOP TO INTEGRATE HF INTO 71 GENERAL SAFETY ANALYSIS 71 6.1 Development of HAZOPA (The Hazard, Operability and Operator Actions Analysis) 72 6.2 Case Study 75 CHAPTER 7 85 APPROACH TO INCORPORATING HF CONSIDERATION 85 INTO PLANT DESIGN 85 7.1 Development of an Approach for HF Analysis in Design – The PITOPA-Design 85 7.1.1 HF Analysis in Conceptual Design Phase (HFAD–Conceptual) 88 7.1.2 HF Analysis in Basic Engineering (HFAD – Basic) 93 7.1.3 HF Analysis in Detail Engineering (HFAD-Detail) 107 7.2 Technique for HF-Design Parameters Evaluation 109 7.3 Intermediate Summary 114 CHAPTER 8 115 IMPLEMENTATION OF THE NEW PITOPA-DESIGN: 115 A CASE-STUDY 115 8.1 Conceptual Design 115 8.2 Basic Engineering 123 8.3 Detail Engineering 127 CHAPTER 9 132 APPROACH FOR IMPROVING OPERATOR PERFORMANCE 132 IN CONTROL ROOM 132 9.1 Performance Influencing Factors (PIFs) for Supervisory & Monitoring Tasks 134 9.2 Development of PITOPA-Control Room (PITOPA-CR) 140 9.2.1 Analysis of Normal Operation 142 9.2.2 Analysis of Abnormal Operation 150 9.3 Alarm Prioritization 156 9.3.1 A survey on Alarm Prioritization 156 9.3.2 Incorporation of CROAA into Alarm Prioritization 157 9.4 Intermediate Summary 165 CHAPTER 10 167 INCORPORATION OF OPERATOR ACTIONS ANALYSIS INTO ALARM MANAGEMENT 167 CHAPTER 11 171 RESULTS AND FUTURE WORKS 171 11. 1 Results 171 11. 2 Future Works 172 BIBLIOGRAPHY 174 APPENDIX A A-1 APPENDIX B B-1 / Schwere Unfälle in der Prozessindustrie erfolgen meist aus einem Zusammenspiel mehrerer verschiedener Fehler und der gleichzeitigen Wechselwirkung mit falschem menschlichem Handeln. Dabei sind diese Fehlhandlungen nicht als Unfallursache anzusehen, sondern sie resultieren aus Fehlern, die in dem System selbst zu finden sind. Aus diesem Grund kann bei der Sicherheitsanalyse die technische Analyse nicht unabhängig von der Betrachtung des Human Factors (HF) durchgeführt werden. Um eine Reduzierung der Fehlhandlungen zu erreichen, müssen das Anlagendesign, die Bedienbarkeit und die Arbeitsumgebung an die menschlichen Fähigkeiten angepasst werden. Human Factors (HF) betrachtet die Interaktion zwischen menschlichen, technischen und organisatorischen Aspekten einer Anlage, mit dem Ziel die Sicherheit und Effektivität der Anlage zu optimieren. Dafür ist eine Einbindung von HF in den gesamten Lebenszyklus einer Anlage notwendig. So müssen HF- Analysen nicht nur während des Betriebs einer Anlage und bei Prozessmodifikationen durchgeführt werden, sondern auch während des gesamten Design- Prozesses, da gerade in den frühen Design-Phasen das Optimierungspotential besonders hoch ist. Eine solche Analysemethode muss alle Aufgaben eines Operators erfassen, so dass zwischen manueller Arbeit und der Arbeit in der Leitwarte unterschieden werden muss. In dieser Arbeit wurden Analysentechniken entwickelt, die einen systematischen Ansatz zur Berücksichtigung des HF über den gesamten Lebenszyklus einer verfahrenstechnischen Anlage darstellen. Mit Hilfe der neuen Analysemethode, PITOPA-Design, können Untersuchungen sowohl während der Designphase als auch während des Betriebs einer Anlage durchgeführt werden. Da solche HF-Analyse immer in Verbindung mit einer klassischen Sicherheitsanalyse erfolgen muss, bindet die neue Methode die HAZOP-Analyse direkt ein. Darüber hinaus wurde ein weiterer Ansatz für die Analyse von Operatorhandlungen in einer Messwartenarbeit entwickelt. Diese neue Analysentechnik, PITOPA-CR, bildet die Grundlage für Verbesserungen im Alarmsystem und wird in das Alarmmanagementsystem eingebunden. Die Arbeit ist wie folgt strukturiert: i) Entwicklung von HAZOPA (the Hazards and Operator Actions Analysis). Diese Methode stellt die Einbindung der HF-Analyse in HAZOP dar. ii) Entwicklung von PITOPA-Design, zur HF-Analyse während des gesamten Designprozesses einer verfahrenstechnischen Anlage. Die Methode wurde in 3 Teile eingeteilt, um die drei Designsphasen Conceptual-, Basic-, und Detail-Design zu erfassen. iii) Entwicklung von PITOPA-CR, zur HF-Analyse in der Messwarte. iv) Einbindung von PITOPA-CR in das Alarmmanagementsystem und Entwicklung einer Technik zur Alarmpriorisierung.:ACKNOWLEDGEMENT i ABSTRACT iii ZUSAMMENFASSUNG iv CONTENTS v TABLE OF FIGURES viii LIST OF TABLES x NOMENCLATURE xi ACRONYMS AND ABBREVIATIONS xii CHAPTER 1 1 INTRODUCTION 1 1.1 Background 1 1.2 Objectives 2 1.3 Scope of Work 3 CHAPTER 2 5 THEORETICAL BACKGROUND 5 2.1 Fundamentals of Human Error 5 2.2 Human Factors (HF) 8 2.3 Motivations to Consider HF in Process Safety 9 2. 3. 1 Accidents that Address HF in Process Safety 11 2. 3. 2 Regulation and Legal Requirements 16 2. 3. 3 Business Value 19 2.4 Work of Operators in Complex Systems 19 2. 4. 1 Role of Operators in Complex Systems 20 2. 4. 2 Problems with Computerisation and Automation 24 2. 4. 3 Allocation of Functions and Levels of Automation 25 2.5 Performance Influencing Factors (PIFs) 27 2.6 Distributed Control System (DCS) and Alarm Systems 29 2. 6. 1 Alarm, Alarm System and Alarm Management 30 2. 6. 2 Most Common Alarm Problems 33 2. 6. 3 Improving Alarm Performance through Prioritization 34 2.7 Safety Analysis Methods 38 2.7.1 Qualitative Safety Analysis 39 2.7.2 Quantitative Safety Analysis 43 2.8 Mathematical Algorithms 44 2.8.1 Techniques for Multi-Criteria Decision Making (MCDM) 44 2.8.2 Classification Methods 47 CHAPTER 3 50 RECENT DEVELOPMENTS IN HF STUDIES 50 3. 1 Methods for HF analysis 50 A. Task Analysis 50 B. Techniques for Operators Actions Analysis 51 3. 2 Human Reliability Analyses (HRA) 52 3. 3 Consideration of Human Error in HAZOP 53 3. 4 HF in Process Plant Design 54 3. 5 HF in Alarm Management and DCS-Design 55 3. 6 The Need for Further Development of HF Methods 57 CHAPTER 4 58 MOTIVATION OF THE WORK 58 CHAPTER 5 61 PROCESS INDUSTRY TOOL FOR OPERATOR ACTIONS ANALYSIS (PITOPA) 61 5.1 The New Technique for Operator Actions Analysis (OAA) 64 5.2 Technique for Performance Influencing Factors (PIFs) Evaluation 65 5.3 Validation of PITOPA in the Process Industry 67 CHAPTER 6 71 EXTENDING HAZOP TO INTEGRATE HF INTO 71 GENERAL SAFETY ANALYSIS 71 6.1 Development of HAZOPA (The Hazard, Operability and Operator Actions Analysis) 72 6.2 Case Study 75 CHAPTER 7 85 APPROACH TO INCORPORATING HF CONSIDERATION 85 INTO PLANT DESIGN 85 7.1 Development of an Approach for HF Analysis in Design – The PITOPA-Design 85 7.1.1 HF Analysis in Conceptual Design Phase (HFAD–Conceptual) 88 7.1.2 HF Analysis in Basic Engineering (HFAD – Basic) 93 7.1.3 HF Analysis in Detail Engineering (HFAD-Detail) 107 7.2 Technique for HF-Design Parameters Evaluation 109 7.3 Intermediate Summary 114 CHAPTER 8 115 IMPLEMENTATION OF THE NEW PITOPA-DESIGN: 115 A CASE-STUDY 115 8.1 Conceptual Design 115 8.2 Basic Engineering 123 8.3 Detail Engineering 127 CHAPTER 9 132 APPROACH FOR IMPROVING OPERATOR PERFORMANCE 132 IN CONTROL ROOM 132 9.1 Performance Influencing Factors (PIFs) for Supervisory & Monitoring Tasks 134 9.2 Development of PITOPA-Control Room (PITOPA-CR) 140 9.2.1 Analysis of Normal Operation 142 9.2.2 Analysis of Abnormal Operation 150 9.3 Alarm Prioritization 156 9.3.1 A survey on Alarm Prioritization 156 9.3.2 Incorporation of CROAA into Alarm Prioritization 157 9.4 Intermediate Summary 165 CHAPTER 10 167 INCORPORATION OF OPERATOR ACTIONS ANALYSIS INTO ALARM MANAGEMENT 167 CHAPTER 11 171 RESULTS AND FUTURE WORKS 171 11. 1 Results 171 11. 2 Future Works 172 BIBLIOGRAPHY 174 APPENDIX A A-1 APPENDIX B B-1

The work of an engineer is closely intertwined with safety. An engineer’s perception of the “safety” task is traditionally inherent in his or her design. However, in the technical world most machines and systems designed by engineers contain a human element, which engineers have to consider in their work. In the oil and gas upstream industry – especially drilling, production and workover operations – petroleum engineers (including drilling and production engineers) are responsible not only for design but also for operational and organizational aspects. The human factor becomes more important in complex offshore operations. Incorporating safety into a sys-tem design requires identifying, analyzing and evaluating risks and ensuring that any not accounted for are taken into consideration. This process requires communication among everyone involved in the process. Analysis of accidents in the oil and gas industry shows that often a lack of that communication led to incident triggering events. In this thesis, the author proposes a novel communication model that improves this exchange of information and supposedly makes the process of risk assessment more effective. In addition, the new model also incorporates factors such as emotions, feelings, needs and imagination into the risk assessment process. This broadens the information base for the risk identification and analysis and creates an atmosphere of psychological ownership for the stakeholders in the process, which leads to a perceived safety climate in the organization where the new model is applied. The innovative communication or consultation model, as it is also referred to in risk assessments, is based on a structured process used in conflict resolution called mediation. Mediation is an alternative conflict resolution process that is centered on mutual under-standing and listening to each other’s needs. The process is composed of elements that characterize it. These elements of mediation are used to assess other communication processes and to develop new communication models. The application of the elements of mediation and the safety-mediation consultation into the risk assessment process enables this process to be enhanced with human factors such as emotions, feelings, intuition and imagination. The inclusion of all stakeholders creates psychological ownership, improves communication, enables organizational learning and expands the knowledge base for risk analysis. The applicability of the safety-mediation consultation process for a human factor-based risk assessment is presented and tested using illustrative examples and field cases from the international oil and gas industry. Possible concerns and limitations are also discussed. This thesis shows that mediation and elements of the mediation process can be applied to improve communication in the international oil and gas industry. This is facilitated by educated safety mediators, who help the petroleum engineer and operational crew on a drilling rig to achieve a better understanding by ensuring that they hear and fully register each other’s needs.