A monitoring tool for cold-storage operators. The first version put the floor plan at the centre: every alarm appeared on the map. It looked right in reviews, then failed a simulation with simultaneous alarms. I stopped the release, changed the model rather than the colours, and kept following the product through a pilot that surfaced a different problem.
The original work is under NDA. This reconstruction uses illustrative names, data and flows; it is not a demonstration of the live product.
The first version put the floor plan at the centre of monitoring. It seemed like the natural choice: operators needed to know where the alarmed equipment was. Every event appeared on the map and opened its detail. In internal reviews the solution was clear, and people liked it.
Before release, we ran a simulation with several alarms at the same time. Each operator got a scenario with several events, only one of them critical. Most operators took charge of a non-critical event first.
Finding the equipment wasn't the problem. Choosing which alarm deserved attention first was. The position of the points on the map, and their almost identical treatment, drew more attention than severity did.
I had designed location well, and taken priority for granted.
I proposed stopping the release of that version and fixing the model, instead of just changing the colours. Recolouring the markers by severity would have kept the map as the entry point: operators would still have scanned by position first.
The choice had a cost: a revision of the navigation and a delayed delivery. To contain the work we reused the map and the panel we'd already built, and gave up the customisable filters planned for that version.
In the second round, the same operators faced new scenarios with the same structure. All of them selected the critical event first.
The comparison suggested the hierarchy was more readable. But familiarity with the system and the small sample didn't allow general conclusions.
We released the corrected version in a single site first. During the pilot, a shift lead kept a short diary on triage difficulties and on the moves between list and map.
No new cases of misread priority came up. A different problem did: alarms reassigned at shift change. The incoming lead couldn't tell who had been handling an alarm, or what had already been done.
Before extending the release, we made the owner and the time of the last action visible on every alarm taken in charge, including what was handed over.
The project didn't end with a successful test. The first check changed the structure, the pilot surfaced a different problem, and the second release included both fixes.
Whether the list order holds up under real load, not just in scenarios.
A direct read on whether the handover information is enough.
If operators keep jumping to the map before choosing, the list isn't telling them enough.