ISA-101 — The HMI design philosophy that reserves color for trouble.
Most industrial HMIs look like a Las Vegas Strip aerial photo — color everywhere, animations crawling, alarms blinking, three blinking pumps in three different colors at the corner of every screen. ISA-101 is the international standard that says stop doing that.It's the design philosophy behind every operator console worth trusting. Here's the 10-minute version of what it actually says and why following it is harder than it sounds.
The 30-second version
ISA-101 (Human-Machine Interfaces for Process Automation Systems) is the International Society of Automation's published standard for HMI design. It codifies what the Abnormal Situation Management (ASM) Consortium and Bill Hollifield's High Performance HMI work pioneered in the 1990s-2000s: build operator screens that reduce cognitive load and surface only the abnormal.
The single biggest visual signature of ISA-101 is: grayscale by default. Color reserved for abnormality. A well-designed ISA-101 screen is mostly black, white, and gray — and the moment something appears in red, amber, or magenta, the operator's eye snaps to it instantly because the rest of the screen has nothing competing.
The "fairground HMI" vs the high-performance HMI
The single best way to internalize ISA-101 is to look at side-by-side examples of an unrationalized HMI and a rationalized one. The unrationalized screen is what the industry inherited from the 1990s. The rationalized version is what ISA-101 prescribes.
✗ FAIRGROUND HMI (PRE-ISA-101)
Equipment in saturated greens / blues. Operator's eye drifts everywhere; no salience.
3D-rendered equipment. Looks impressive, hides operational state.
All values displayed always. Cognitive load = total. Pattern detection = impossible.
Animations on running equipment. Distract from things that aren't running.
Alarms blink in the corner. Operator habituates within a week and stops seeing them.
✓ HIGH-PERFORMANCE HMI (ISA-101)
Equipment in flat grayscale. Visual hierarchy emerges naturally.
2D schematic, no skeumorphism. Form follows operational function.
Hierarchical information disclosure. Level-1 = situation. Drill down for detail.
No animation on normal operation. Movement signals abnormality only.
Alarms surface contextually. Color and motion deployed sparingly so they keep their salience.
The four-level hierarchy
ISA-101 prescribes a 4-level information hierarchy. Every operator screen in a well-designed system belongs to exactly one of these levels, and the level dictates what's on it, how dense it is, and what color it's allowed to use.
The hierarchy is fractal: navigating from L1 → L2 → L3 should feel like zooming in. Same visual language, increasing detail. ISA-101 explicitly requires that navigation between levels be obvious, fast (≤ 2 clicks), and reversible — operators get lost in HMI navigation constantly, and that lostness causes incidents.
The color rules
ISA-101 is famous for its color discipline. Every color on the screen serves a purpose. Decorative color is forbidden.
| Color | Meaning | Used for |
|---|---|---|
| Gray (multiple shades) | Normal operation | All equipment, piping, normal-state indicators |
| White | Normal data values | Numerical displays in normal range |
| Red | Critical alarm / safety-critical | P1 alarms, ESD activations, safety conditions |
| Amber / orange | High-priority alarm | P2 alarms, abnormal conditions requiring attention |
| Yellow | Caution / advisory | P3 alarms, advisory conditions |
| Magenta | Bad data / sensor failure | Stuck values, communication failures, sensor diagnostics |
| Cyan / teal | Active operator action | Selected element, currently being acted upon |
| Green | (Often reserved or omitted) | "Running" is implicit — green tends to add salience without information value |
The non-obvious rule: green is treated with suspicion in ISA-101 because "running normally" is the default state and shouldn't draw attention. A green icon on every running pump is just visual noise. Use grayscale for "normal" and let the eye find the abnormal.
The lifecycle ISA-101 actually defines
ISA-101 is a lifecycle standard, not just a style guide. It defines a process from HMI System Standards through HMI Design through Implementationthrough Operation. The phases that matter:
- HMI System Standards (HSS). The site-wide rulebook. Defines color palette, typography, page hierarchy, navigation, naming conventions. Written once, applied everywhere.
- HMI Style Guide. Concrete shapes and components — what a pump looks like in grayscale, what a valve looks like, how alarm severity is visually encoded. Component library, basically.
- HMI Design. Screen-by-screen design against the HSS. Includes task analysis (what is the operator trying to do?), screen storyboarding, and review.
- Implementation. Build the screens in your vendor SCADA/HMI tool. Most vendors have ISA-101 component libraries now (Ignition has Symbol Factory, AVEVA has High Performance HMI templates).
- Operation & continuous improvement. Measure operator performance, gather feedback, iterate. ISA-101 is explicit that HMI design is never "done."
Why "do ISA-101" is harder than it looks
ISA-101 has been published since 2015 (current edition 2018) and most industrial sites still don't follow it. Three reasons:
1. The cultural shift is brutal
Operators trained on fairground HMIs find ISA-101 screens "boring" at first. Reviewers, managers, and executives who haven't internalized why color discipline matters push back on the grayscale aesthetic. The first weeks of a properly-implemented ISA-101 system generate complaints; the first months of operating it generate measurably fewer incidents.
2. Vendor defaults still aren't compliant
Every major SCADA/HMI vendor has ISA-101 component libraries — but their defaultsstill ship with saturated colors, 3D equipment, and the old visual conventions. You have to actively turn ISA-101 on; it isn't free.
3. Retrofitting is more expensive than greenfield
Migrating an existing fairground HMI to ISA-101 means rebuilding every operator screen, retraining every operator, and going through a multi-month validation period. That's a capital expense. Many sites that "follow ISA-101" actually only apply it to new screens and leave the legacy ones alone — creating an inconsistent operator experience that is arguably worse than either extreme.
How Aevus follows ISA-101
Aevus's operator-facing surfaces — the embedded control room on aevus.io, the production console, the alarm management views — are designed against ISA-101 from inception, not bolted on later. Specifically:
- Dark theme, grayscale equipment. Page background near-black; equipment rendered as flat gray schematics; piping shown as thin lines. No 3D.
- Color reserved. Cyan, teal, and signal violet are used for brand and current-action highlighting only. Red, amber, yellow for alarm severity per ISA-101 palette. Magenta for bad data / sensor failure.
- 4-level hierarchy. L1 site overview → L2 unit overview → L3 detail → L4 configuration. Navigation across levels via consistent breadcrumb.
- Information disclosure. L1 shows situation; details one click away. Detail pages are dense by design; overview pages are deliberately sparse.
- No decorative animation. Status-dot pulses signal "live"; one-shot draws on load. No infinite particle loops. No alarm blinking (alarms surface via persistent visual placement, not motion).
- WCAG 2.1 AA contrast. Every text-on-background pair meets 4.5:1 (body) or 3:1 (large text) per WCAG. ISA-101 doesn't mandate this; we do.
Why this matters for evaluators. Most "AI for SCADA" startups ship consumer-SaaS aesthetics into a control room and lose operator trust on day one. Aevus looks like operations software because it is operations software. The visual discipline is a credibility signal — and a competitive moat that most software-team-led startups don't know how to build.
That's ISA-101 in 10 minutes.
If your control room is migrating away from fairground HMI — or you're greenfielding a new site and want to do it right from day one — Aevus is built on the same standard you should be building toward.
Related Articles
Where they differ, where they overlap, and what to call yours.
Interactive demo grounded in EEMUA 191 and ISA-18.2.
One transmitter failure cascades into 1,217 alarms.
Ready to see how this applies to your operation? Start a pilot conversation — no commitment, no field changes.