← RECORD 004 / WRITING & REFERENCE BUILDSBUILD 01
DENSE INTERFACES · HYPOTHETICAL PRODUCT · CODED, KEYBOARD-OPERABLE
Kilnmoor Fleet Console
Making an anomaly noticeable instead of findable. A monitoring console for industrial equipment, built so the screen never claims a state it cannot justify from stored fact.
PROBLEM
One technician covers 43 channels for twelve hours. Every reading has the same visual weight, so the anomaly has to be searched for.
APPROACH
Rank by deviation without moving anything. Rows keep plant order; type size, height and glyph carry severity.
RESULT
Nine states kept distinct, each with its justification in the row. A 1:2.1 size ratio from calm to alarm that survives greyscale.
A REFERENCE BUILD · A WORKED EXAMPLE, NOT CLIENT WORK. KILNMOOR, BRACKENHURST WORKS AND ALL TELEMETRY ARE INVENTED.
01 · THE OPERATOR
Forty machines, one pair of eyes, and forty numbers of equal loudness.
Brackenhurst Works fires structural ceramics. One shift technician covers 43 monitored channels across a tunnel kiln, two spray dryers, three ball mills, a compressed-air house and the baghouse, for twelve hours. Forty minutes of every hour goes on logging, walking the floor and changeovers.
The console is glanced at, not watched. It has to survive being ignored for four minutes and then read in three seconds.
WHAT IT COSTS TO MISS ONE
A kiln zone outside the firing curve scraps a car of ware, about £9k. A mill bearing that fails instead of being called in costs roughly four hours of unplanned stoppage. Every alarm on the shift is actioned or explained in the handover note.
THE QUIET FAILURE
A channel that stopped reporting an hour ago, still showing the last number it sent, in the same grey as the healthy ones. Nobody has questioned it because it doesn't look like a question.
02 · WHY THAT IS A DESIGN FAILURE
The screen and the record disagree, and the screen wins.
The usual answer to the quiet failure is training: teach the operator to check timestamps. That fails on arithmetic. Checking the sample age of 43 channels at a glance is 43 comparisons against a clock, several times an hour, in the middle of other work. A procedure needing that many manual checks gets dropped inside a week, and the dropping is written up as operator error.
The failure is upstream of the operator. It happens when one status field has to describe a channel reading normally, a channel that stopped reporting, a channel whose sensor is lying, and a channel nobody has configured. Whatever the field cannot say, the screen gets wrong.
STALE LOOKS FINE
A channel that stopped reporting renders its last value in the same weight as a live one.
NO BAND LOOKS IN RANGE
A channel with nothing to judge it against reads as a channel that has been judged and passed.
SUPPRESSED LOOKS HEALTHY
A muted alarm disappears, so a machine nobody is watching looks like a machine behaving.
In all three, missing information renders as reassuring information. Absence of data is a state in its own right. It is not a zero and it is not a blank.
03 · THE CORE INSIGHT
A channel has three independent facts, not one status.
1 · IS THE SIGNAL ARRIVING
Outranks the value. A channel that stopped reporting while inside its band is unknown, not normal.
2 · IS THERE A BAND
Also outranks the value. A channel with no band has no position to report.
3 · WHERE IS THE VALUE IN IT
Only meaningful once the first two are answered. An operator overlay (acked or suppressed) sits on top and changes none of them.
The rule that follows: any state the screen asserts must be explainable by one line of stored fact, shown next to it. If a row says in band, the operator can see why without opening anything: last sample time, the band applied, distance from it, sensor health. That fixes four columns in place; none can be traded for whitespace. A state needing a click to explain means the state model is wrong, not the layout.
04 · THE READ-OUT
Nine states, each with its justification in the row.
A slice of the fleet: nine channels in plant order. Switch to the rejected sorted variant to see what re-ordering costs, and fire the 14:08 change to see how a returning operator learns what happened.
| CHANNEL | VALUE | STATE | BAND | AGE | WHY THE SCREEN SAYS SO |
|---|---|---|---|---|---|
| Kiln zone 3 · temp | 1194 °C | ALARM | 1150–1180 | 4 s | 14 °C above upper limit for 6 min |
| Kiln zone 4 · temp | 1186 °C | OUT | 1150–1180 | 4 s | 6 °C above upper limit |
| Kiln zone 5 · temp | 1176 °C | DRIFT | 1150–1180 | 5 s | rising 1.4 °C/min · limit in ~3 min |
| Kiln draught · ΔP | -42 Pa | IN BAND | -55 – -30 | 3 s | mid-band, steady 20 min |
| Dryer 1 · outlet temp | 118 °C | STALE | 105–125 | 71 min | no sample since 12:57 · last value shown |
| Dryer 2 · outlet temp | [104 °C] | SUSPECT | 105–125 | 6 s | failed rate-of-change test · sensor suspect |
| Mill 2 · bearing temp | 78 °C | ACKED | 40–72 | 8 s | acked 14:02 by R.O. · fitter called |
| Mill 3 · vibration | 6.1 mm/s | SUPPRESSED | 0–4.5 | 7 s | suppressed for maintenance · 2 h 14 m left |
| Compressor 1 · dewpoint | -31 °C | NO BAND | not judged | 11 s | no band configured · nothing to judge against |
Invented fleet, invented readings. Nothing here is a client system.
DECISION
An in-band row is 24px tall at 13px type; an alarm row is 60px with a 28px value. That 1:2.1 ratio is the primary severity encoding, so it survives greyscale, a failing monitor and a viewing distance of 2.4 metres.
DECISION
Every state carries a glyph, a type treatment, a row height and a written label. No state is signalled by colour alone; a red-green ramp is two muddy browns to a protanope and one grey in print.
05 · THE OTHER SURFACES
Four more places the same rule has to hold.
The read-out is the product, but it isn't the only surface. Each of these was designed against the same constraint: no state without the stored fact that justifies it.
SURFACE 01 · ESCALATION STRIP
The only region allowed to re-order. Capped at five entries, worst first, each one a link to its fixed row, so ranking exists without the table moving.
SURFACE 02 · ACKNOWLEDGE
Alarm fatigue is mostly people silencing things they believe they handled. So the panel states what acknowledging does not do, and nothing is prefilled.
ACKNOWLEDGE · KILN ZONE 3 · TEMP
1194 °C · band 1150–1180 · 14 °C over for 6 min
WHAT THIS DOES
Records that you have seen it, with your initials and the time. Stops the pager repeating.
WHAT IT DOES NOT DO
The channel stays out of band and keeps its weight. Nothing is fixed, hidden, or cleared.
REASON (REQUIRED, NOT PREFILLED)
e.g. burner trim adjusted, watching zone 4
SURFACE 03 · SUPPRESSION
Nothing is hidden irreversibly. The row stays visible on dashed rules, with a countdown and the breach still printed beside it. Maximum eight hours, then it comes back on its own.
6.1 mm/s · band 0–4.5 · breach still recorded6.1 mm/sSUPPRESSED
The rejected alternative was an indefinite mute, or removing the row. Both produce a healthy-looking machine nobody is watching.
SURFACE 04 · FIRST RUN
No default bands. A fabricated band is indistinguishable on screen from a real one, so day one would otherwise be the most dangerous day. The cost is an honestly loud first run.
no band configured1163 °CNOT JUDGED
no band configured1171 °CNOT JUDGED
All four specimens are static here. In the built console they are live screens with an annotation panel per state, plus a night theme retuned for 03:00 rather than inverted.
06 · WHAT WE TRIED FIRST
Four approaches, three of them dropped.
The organising idea was fixed early: rank by deviation, not by name. A well-behaved channel should compress toward a hairline and cost almost nothing to ignore. The work went into how ranking gets expressed, because the obvious answer moves the display.
REJECTED · A
Sort the table by deviation
Fastest layout in the set on a single failure. Plant grouping disappears though, so a kiln cascade reads as six unrelated alarms instead of one kiln problem. In the six-channel case the table re-sorted four times in ninety seconds, and a click landing mid-reorder acknowledges the wrong channel.
REJECTED · B
Collapse healthy channels
“38 channels normal” as one line buys a lot of space. The operator is reading a texture though, and waiting for it to change; take the texture away and a channel crossing into drift arrives out of nowhere. It also puts the product's summary between the operator and the record.
REJECTED · C
A severity colour ramp
A tile per channel, green through red, positions fixed. Severity was all it could say: stale, suspect and unbanded all had to borrow a colour from the value scale, the exact collapse that makes a stale channel look fine. A tile also has nowhere to print the age or the band.
KEPT · D
Fixed order, differential weight, bounded strip
Row order is plant topology and never changes. Deviation is carried by type size, row height, glyph and a gutter that reads as a shape down the left edge. Ranking lives in an escalation strip above the table: at most five entries, worst first, each linking to its fixed row.
07 · THE MOTION DECISION
Rank by deviation as a principle; refuse to express it by moving anything.
The tension is real. If rows re-order when a channel misbehaves, the display moves, and motion on a surface someone stares at for eight hours is its own hazard. It also destroys the spatial memory that lets an experienced operator glance at a corner and know what lives there.
Ranking is about attention; sorting is only one way to get it. Weight can change in place. So the table is ordered by plant topology permanently, and the only region that re-orders is the escalation strip: about 12% of the screen, in peripheral vision, capped at five entries so it cannot become the noise it exists to prevent.
Change blindness is the problem to beat, and animation is a poor defence because the operator is usually not looking when the transition plays. The defence is persistence: a state change leaves a durable NEW 14:08 marker until the operator marks it seen. Someone who looked away for a minute learns the same thing as someone who watched.
That makes the reduced-motion path a real path, not a fallback. With motion off, the wash goes; the marker, glyph, size step and words all stay. Nothing pulses, nothing blinks, and no value animates its own digits, because a number that moves as it changes is unreadable at a glance.
The cost, stated plainly:a channel in the worst state can be off-screen. The escalation strip, group roll-ups and edge markers on the scroll track are what pays for that. If validation shows time-to-notice for off-screen channels is materially worse than the sorted variant's, this decision loses.
08 · DECISION LEDGER
Every significant decision, with its price.
| # | DECISION | WHAT IT SOLVES | WHAT IT COSTS | REJECTED INSTEAD |
|---|---|---|---|---|
| 8.1 | Fixed row order | Spatial memory survives; related failures cluster and read as one event. | A channel in the worst state can be below the fold. Paid for with the strip and group roll-ups. | Auto-sort by deviation. Six reorders in ninety seconds, and mis-clicks land on the wrong channel. |
| 8.2 | Value size as severity | A 1:2.1 size ratio from calm to alarm survives greyscale, distance and colour-vision deficiency. | Row heights vary, so vertical rhythm is uneven and group boundaries need explicit rules. | Colour-only severity. Unusable for a protanope and worthless in print. |
| 8.3 | Justification in the row | The operator sees why the system believes a state, with no click: age, band, distance, sensor health. | Four columns are locked. State sentences wrap to two lines on degraded rows. | Facts on hover or in a detail panel. Invisible on a wall display, unusable in gloves. |
| 8.4 | Persistent change marker | Change blindness. A returning operator learns what a watching one learned. | Markers accumulate, and “mark all seen” can become a reflex that clears something unread. | Animated transitions as the signal. They play while nobody is looking. |
| 8.5 | Ack states its own limits | Alarm fatigue is mostly people silencing things they believe they handled. The panel says what it does not silence. | A confirmation step during the worst minutes of a shift. Nothing is prefilled. | One-click ack straight from the row. Fast, and it teaches that ack means “gone”. |
| 8.6 | Suppression expires, max 8 h | Nothing is hidden irreversibly. The row stays visible with a countdown and its breach printed beside it. | Long maintenance jobs need re-suppressing mid-shift, which is friction on a legitimate task. | Indefinite mute, or removing the row. Both produce a healthy-looking machine nobody is watching. |
| 8.7 | No default bands | A fabricated band is indistinguishable on screen from a real one, so the first day would be the most dangerous day. | First run is loud: 43 rows marked “not judged”, the opposite of the calm the product is for. | “±10% of current value” starter bands. Ship a plant running badly and you ship bad as normal. |
| 8.8 | Light substrate, two themes | Paper grey rather than white avoids glare in a dimmed room; the night theme is retuned for 03:00 rather than inverted. | Every state needs two contrast proofs and two review passes. | One dark theme for everyone. Wrong for a daylight plant floor behind polycarbonate. |
09 · HOW WE WOULD VALIDATE IT
Four measures, and the result that would prove us wrong.
Twelve technicians across three shifts, each a 40-minute session on recorded plant data with scripted faults injected, doing their normal secondary work between glances. Fixed-order and sorted builds counterbalanced.
MEASURE 1 · TIME TO NOTICE
Seconds from state change to first fixation on the row
Split by on-screen and off-screen channels. Proves us wrong:off-screen time-to-notice more than about 1.5× the sorted build's. That is the fixed-order bet failing on its own terms.
MEASURE 2 · MISATTRIBUTION
How often a state is read as a different state
Interrupt and ask what the channel is doing. The critical pairs are stale read as in-band, unbanded read as in-band, suppressed read as healthy. Proves us wrong: any stale-as-normal error at all. One is a design failure, not noise.
MEASURE 3 · FALSE ACKNOWLEDGE
Acks on conditions the operator had not diagnosed
Measured by asking, after each ack, what they think is happening and what they expect next. Proves us wrong: the does / does-not panel makes no difference to the rate. Then it is decoration and should be cut.
MEASURE 4 · RETURN TO GLANCE
What an operator can report after looking away for 60s
Run with motion on and off. Proves us wrong: the motion-on group recovers meaningfully better. The whole persistence argument rests on those being equal.
One more thing worth measuring that isn't a usability metric: how many suppressions expire without anyone acting on them. It tests whether being honest about hidden conditions changes behaviour or only records it.
10 · LIMITATIONS & STATUS
What this build does not settle.
200 CHANNELS BREAKS IT
The design rests on 43 channels fitting without scroll. At 200, most of the fleet is off-screen at rest and the strip becomes the primary surface. That is a different product, and we would design it as one rather than stretch this.
MULTI-SITE IS UNADDRESSED
Everything here assumes one plant an operator can walk. Across sites the question stops being which channel and becomes whose problem, which needs an ownership and routing model this design doesn't have.
PHONE CAN'T HOLD THE RULE
Tablet density works in gloves because it keeps the full row. On a phone there is no room for age, band and distance beside the value, so the justification rule fails. We would ship a strip-only phone view and say plainly it isn't the read-out.
DRIFT PROJECTIONS ARE WEAK
A linear projection over 30 minutes is wrong at batch changeovers, where a step change reads as a steep slope. A wrong projection spends attention on nothing, and we don't know how often it happens.
NOTHING FIXES BAD BANDS
The console judges against the band it is given. A band set too wide produces a calm screen over a plant in trouble, and the design cannot detect that. How often bands get reviewed is a process problem the product should prompt for, and doesn't.
FLOODS FROM ONE CAUSE
Six correlated channels cluster spatially, which helps. Twenty do not fit the strip's cap of five, and the product has no notion of a root cause. That is the next real piece of work.
STATUS · CODED, KEYBOARD-OPERABLE, INVENTED DATA · PUBLISHED BECAUSE THE ARGUMENT IS FINISHED
READ ALONGSIDE THIS