The system was designed for full connectivity and complete data. In the degraded conditions it was actually used in, it displayed stale positions with the same confidence as live ones - the most dangerous possible failure mode.
STUDY 27 / 30 · ANONYMISED · NDA · DEFENCE & GOVTECH · US · DEFENCE PRIME
DEFENCE & GOVTECH · US A common operating picture that degrades gracefully.
RoleLead designer + systems
Timeline20 weeks
Team3 designers, 1 researcher, 1 PM, 4 frontend, 2 domain SMEs
VerticalMission planning system · joint operations
Made data age and confidence a permanent visual property of every element, and specified explicit degraded modes rather than allowing silent degradation.
Operators could distinguish live from stale at a glance under load. The degraded-mode work became a programme requirement across adjacent systems.
0STALE-POSITION MISREADSin evaluation
2.1 secTIME TO ASSESS PICTURE CONFIDENCEfrom 47 sec
4.4 / 5OPERATOR TRUST, RATEDfrom 2.6
THE ARGUMENT
Why the obvious solution was wrong.
The study matters because the product problem was reframed before the interface was polished.
Systems built for ideal conditions fail dangerously rather than gracefully. This one rendered a position report from forty minutes ago identically to one from four seconds ago, and under cognitive load an operator will read both as current. That is not a display preference. It is a system that misleads most convincingly at exactly the moment its output matters most, and it had passed every functional test because functional tests assume the data arrives.
Age and confidence are now permanent visual properties carried by every element on the picture, legible peripherally without inspection. Degraded modes are explicit and declared: the system announces which feeds are lost and what the picture can and cannot support, rather than continuing to render a confident-looking display from partial inputs. Under evaluation, operators assessed picture confidence in roughly two seconds against forty-seven before, and no stale position was misread as live. The specification was subsequently adopted as a requirement on adjacent programmes.
THE INTERFACE CRAFT
The interaction, rendered as a working product surface.
The specimen below is code-native and uses the study's own design logic. The client interface remains protected.
DEFENCE & GOVTECH
DEGRADED MODE
3 sources delayed
DESIGN DECISIONS
Positions we would defend.
Each decision names the principle and the product consequence, not a stylistic preference.
Degradation must be visible
A system that fails silently under load is more dangerous than one that fails loudly. Silent confidence is the failure mode.
Peripheral legibility, not inspection
Under load an operator will not hover or click. Anything requiring inspection to assess is information that does not exist.
Specify the degraded mode first
Design the partial-data condition before the ideal one, because the partial condition is the operational norm.
PRODUCT LEADER READOUT
What transfers, and what should remain specific to this product.
A case study is useful when its operating principle travels without turning the original interface into a template.
Read the operating condition
For Mission planning system · joint operations, the transferable lesson is not a copied screen. It is the condition the interface had to make legible: Every element carries its data age legibly at peripheral vision, without inspection, without hover, without a legend. Rebuild that visibility for your own roles, risk, terminology, and operating cadence.
Protect the design rule
A system that fails silently under load is more dangerous than one that fails loudly. Silent confidence is the failure mode. Keep that rule in the acceptance criteria, component states, and production QA record so later visual cleanup cannot erase why the interaction exists.
Measure behaviour after ship
The evidence record is 0 for stale-position misreads, in evaluation. Recreate the baseline and outcome window before rollout, segment the result by role and context, and state clearly what the measure cannot prove.
RESEARCH RECORD
The work behind the interface.
These artefacts connect the final interaction back to the evidence and product model that produced it.
Degraded-condition observation
Observed operators in exercise conditions with deliberately degraded feeds, recording every misread and its consequence.
Age-encoding test
Tested seven visual encodings for data age against peripheral recognition under time pressure and cognitive load.
Degraded-mode taxonomy
Defined six named degraded states with domain SMEs, each wit a declared capability envelope.
Handover error analysis
h Traced handover errors between roles to divergent role-specific views built on inconsistent underlying data.
“It tells you when it does not know. That is the whole difference between a picture you can use and one you cannot.”
Programme lead, defence systems integrator · under NDA
NEXT STUDY · 28 / 30 · DEFENCE & GOVTECH