what SCADA knows

On March 28, 1979, operators at Three Mile Island unit 2 faced 100 alarms simultaneously in the first few minutes after the incident began. The control room was saturated — lights blinking, buzzers competing, every indicator demanding attention at once. A critical valve was stuck open. The indicator said it was closed. Not because the sensor lied, but because the indicator only told operators whether the solenoid was commanded closed, not whether the valve actually was.

They made the wrong call. The reactor core was exposed for hours.

TMI didn’t happen because operators were incompetent. It happened because the interface was designed by people who hadn’t thought carefully about what happens when everything screams at you at the same time.

The industrial automation world spent the next three decades developing an answer to that question. What came out of it is called High-Performance HMI — formalized now in ISA-101, the standard for control system display design. It’s not glamorous. It doesn’t trend on design Twitter. But it’s the most serious thinking about UI design that exists, because the stakes for getting it wrong are measured in lives and refinery fires.

The core insight is deceptively simple:

Normal is gray. Color means something is wrong.

In a high-performance HMI, everything running as expected looks muted. Pumps are gray. Tanks are gray. Flow rates, temperatures, pressures — all rendered in neutral, low-contrast tones. There are no green “everything is fine” indicators pulsing confidently at you. No blue informational badges. No gradient backgrounds celebrating the good health of your process.

When a pump trips, it turns red. That’s it. That’s the whole system.

The reason is signal theory. When everything has color, nothing has meaning. An operator who works a twelve-hour shift staring at a display where running pumps are green, stopped pumps are gray, maintenance holds are yellow, and override states are blue — that operator’s brain stops reading the colors. They become wallpaper. The nervous system tunes them out. And then the day something actually turns red, it blends into the existing visual noise and the operator misses it.

There’s a name for this: alarm fatigue. It’s not a metaphor. It’s a clinical phenomenon with documented consequences. When an alarm system produces more signals than operators can meaningfully respond to, operators stop responding meaningfully. They acknowledge alarms to silence them. They develop workarounds. They build mental models that exclude the noisy channels — because you can’t function if you treat every flicker as critical.

The fix wasn’t better training. The fix was quieter screens.

ISA-101 prescribes specifics: use a medium gray background, not white (too bright on long shifts), not black (reduces color discrimination). Reserve red for conditions requiring immediate action. Limit the color palette ruthlessly. The screen at rest should look almost boring. That’s not an aesthetic failure — that’s the whole point.

Silence is the message. No signal means everything is fine.

You don’t need the system to confirm normal operation. You already know normal operation is happening because the interface isn’t yelling at you. The absence of red is your green. If you force green onto the screen anyway, you’ve wasted the signal, trained the operator to ignore the color, and made the next real alarm slightly harder to notice.

Now look at a modern SaaS billing dashboard.

Green badges everywhere — plan active, payment current, last invoice successful. Blue chips for informational states. Yellow warnings about usage thresholds. And yes, red too, somewhere, for actual problems — buried in a sea of its louder cousins.

The billing page isn’t a nuclear reactor. Nobody dies if the operator misses a status badge. But the psychology is identical.

Every non-critical color signal you put in front of a user is a small withdrawal from their attention budget. Stack enough of them and the budget is exhausted before the important thing appears. The user stops reading colors the same way a TMI operator stopped reading alarms. They scan past the green badges because green badges are always there. When something actually needs attention — a failed charge, a declined card, a subscription about to lapse — it arrives wearing the same visual vocabulary as all the noise that preceded it.

Green is fine when it’s meaningful. It’s actively harmful when it’s ambient.

The design instinct that causes this isn’t bad design instinct in isolation. It comes from a reasonable place: feedback. Users like to know things are working. Positive confirmation feels reassuring. “Active” should look active. So designers reach for green — the conventional success color — and paste it onto every healthy state in the interface.

What they’ve done is import the vocabulary of critical alerts into decorative use, and then expect it to retain its critical-alert function.

It doesn’t work that way. Color is not unlimited. Every non-critical use of a signal color dilutes its signal value. By the time red shows up on a failed payment, it’s the twelfth colored element on the screen. The user has been trained, by the interface itself, not to snap to attention when color appears.

The solution SCADA figured out: make normal invisible.

Not hidden — invisible in the sense of not demanding attention. Remove the green from successful states. Don’t replace it with red; replace it with nothing. A paid invoice shouldn’t announce itself as paid. The user knows it’s paid because it’s not flagged. An active subscription doesn’t need a green pill. It’s active. The absence of any indicator is the indicator.

Reserve color for the only message that needs it: something requires your attention right now.

When that principle is applied well, the UI becomes quieter and faster to read. The user’s eye is trained — correctly, this time — to move to color as a signal of required action. Scanning a list of invoices takes less cognitive effort because there’s nothing competing for attention except the things that actually need attention.

The interface stops being a status board and starts being a to-do list.

That’s what SCADA knows. Industrial designers learned it after decades of accidents, investigations, and formal standards work. The alarm that mattered got lost in the alarm that didn’t. They stripped the noise until the signal was unmistakable.

Consumer software is still mid-lesson. The classroom is just quieter.