Confusing Controls: Fix the Design Trap

Human Performance weekly series: lesson 50 of 52.

A 5–10 minute crew discussion, plus time to verify the actual controls. The crew talk and Word version are public. Separate supervisor and attendance records are included with free Safety & Systems membership.

Why this matters

Two similar controls, an unreadable label or a display that hides important information can make the wrong action easier. Repeated reminders do not remove that problem. Capture the specific difficulty and involve the people authorized to improve the equipment or interface. Ask users from other shifts whether they encounter the same difficulty.

Learning objective

Identify one interface problem and trace it to an authorized correction, safe interim arrangement and user review.

Key hazards or failure points

Similar controls; unclear labels; poor visibility; inconsistent displays; improvised markings; a change that creates a different error.

Practical controls

• Describe the difficult task and the exact confusing feature. Include operating and maintenance users. Keep the report factual: what information is missing, what appears similar and under what normal conditions the problem occurs.
• Hold an action when identity or expected response is uncertain. Use the site’s approved escalation and interim protection. Do not operate a likely control to see what happens or rely on an informal memory rule.
• Route changes through the responsible equipment, engineering and change-control roles. Evaluate effects on instructions, training and other users. Do not relabel, relocate, reprogram or modify equipment without the required review and authorization.

Verify It in the Field

• At a safe standstill or using an approved image, have a user explain the intended item and action against the current instruction. Capture ambiguity without touching controls, exposing confidential information or reproducing the hazardous action.
• Confirm the issue reaches an identified owner. Record the interim restriction, correction decision and review point. A submitted request does not establish a safe interface; keep required protection in place while the issue remains open.
• After authorized correction, involve affected users in the approved safe review. Compare the result with documented requirements and check updated instructions. Record source, method, actual finding, checker and time; retain HOLD for unresolved required criteria.

Stop and reassess

Pause affected use for uncertain identity, unreadable essential information or an unauthorized change. Escalate recurring confusion. Resume only after required checks, communication and release; this discussion does not approve a design or operational test.

Crew discussion questions

• Which feature makes the intended action unclear?
• Who can authorize a durable correction?
• How will users safely confirm the improvement?

For each required control, record its acceptance source and criterion, safe verification method, responsible checker, actual result and time. Use VERIFIED, HOLD/NOT VERIFIED, or N/A with a reason. A tick alone is not evidence. Complete all applicable task inspections; do not enter danger or improvise a test to fill out a form.

Leader preparation and practical detail

Capture the task, not a judgment about the worker

Illustrative situation: several users hesitate between neighboring controls because the identifiers are difficult to distinguish from the working position. Record the position and missing distinction without staging a wrong operation. Include the people who maintain or troubleshoot the equipment; a change that helps one group can obstruct another.

Improve through the proper design process

HSE design guidance recommends involving users and considering operation, maintenance and foreseeable abnormal conditions. It is UK regulator guidance, not a US technical specification. The responsible specialists determine suitable labeling, layout and display requirements. This lesson supplies no universal colors, spacing, font sizes or control arrangements.

Temporary identification is a different tool

TBT135 addresses approved temporary component flagging. This lesson addresses the persistent interface problem that made recognition difficult. A temporary aid must not hide formal identification, conflict with required safety tags or become an unreviewed permanent modification. Confirm correction through the approved process and tell affected shifts what changed.

Short supervisor field check

• Exact interface difficulty documented.
• Affected action safely restricted as needed.
• Design owner and interim arrangement confirmed.
• Authorized review includes affected users.
• Instructions, findings and release status updated.

Confirm the relevant trained/authorized people, unresolved items, interim protection, correction owner and recheck. Record required release authority and rebrief anyone affected. The separate sheet supports these records; it does not replace a specialist inspection, permit or engineering determination.

Attendance and follow-through

Use the separate attendance sheet for participants, roles, discussion concerns, actions and late-arrival rebriefs. Attendance is not proof of competence, functioning controls or authorization to work. Keep completed records private under employer procedures.

Source acknowledgment

This resource draws on the U.S. Department of Energy’s DOE-HDBK-1028-2009, Human Performance Improvement Handbook, Volume 1 (June 2009). Todd Jerome Jenkins makes no claim of authorship or copyright ownership in the original U.S. Government work. New explanations, examples, exercises and layouts are Todd Jerome Jenkins adaptations. No endorsement by DOE or the U.S. Government is implied. Third-party material credited in the handbook remains attributed to its source; this notice does not claim rights in that material.

Source excerpt: Volume 1/VOLUME 1 CHAPTER 5 - HUMAN PERFORMANCE EVOLUTION INTRODUCTION.pdf; Chapter 5, printed pp. 5-4 through 5-6 (PDF pages 4–6). The June 2009 handbook supplies concepts; this lesson uses original explanations and exercises.

Technical scope and references

References reviewed October 9, 2026. DOE human-performance tools and OSHA recommended practices support preparation and discussion; they do not establish universal technical acceptance criteria. Apply the current task procedure, manufacturer instructions, permit and required competent or qualified decisions. A successful exercise does not replace required training, technical verification or work authorization.

1. DOE-HDBK-1028-2009, Volume 1 — Chapter 5, printed pp. 5-4 through 5-6 (PDF pages 4–6); June 2009 conceptual background only. Selected original excerpt pages read and visually inspected, not whole chapters.
2. HSE — Design — Why design matters and key principles: user involvement, operability, maintainability and foreseeable conditions. UK guidance, not universal technical design criteria.

Connect this discussion to your JHA/JSA

Use the JHA/JSA planning and field-verification worksheet to record the actual task steps, hazards, responsible roles and controls. No task-specific worked example is linked for this topic yet. Return to What Changed Today? when the plan or conditions change.

Related Todd Jerome Jenkins articles: How to Conduct a Job Safety Analysis and What Is Human and Organizational Performance?.

Related crew discussions

• Component Flagging: Confirm the Right Item
• Observe the Work: Study Conditions Before Judging Actions

Continue the weekly series

• Lesson 49: What Does This Control Actually Do?
• Lesson 51: When the Schedule Pushes Against the Safety Plan

Put one check into practice

Use the free JHA/JSA planning and field-verification worksheet to record today’s change, the required protection and the evidence needed before exposure.