Operations — Cabrillo Coast style guide

ALARM LEDGER / 4 EVENTS1 REQUIRES ACK

TIME	PRIORITY	STATE / QUALITY	CONDITION	ACKNOWLEDGMENT
08:52:14Z	▲ WARNING	ACTIVE / UNACKVALID	GPU-RACK-07GPU TEMPERATURE HIGH
08:52:11Z	◆ CAUTION	ACTIVE / ACKVALID	FABRIC-220PACKET LOSS DEVIATION	OPS-07 / 08:52:30Z
08:51:58Z	● ADVISORY	ADVISORY / ACKVALID	RUN-184CHECKPOINT LAG	OPS-07 / 08:52:05Z
08:49:33Z	? UNKNOWN	STALESTALE	PDU-009TELEMETRY SAMPLE LOST	NOT REQUIRED

TRAINING CONTROL / RUN-184CONTROL / AUTOMATIC

CHECKPOINT INTERVAL / ACTUAL15 min15 minTARGET / 10–20 minLIMIT / 30 minTREND / +1 min / 30 min◆ VALID / 08:52:14Z

PROPOSED SETPOINT: 12 min
AUTHORITY: TRAINING-OPS / LEASE CURRENT
PRECONDITION: RUN-184 / HEALTHY / REV 184
STATUS: READY / NOT REQUESTED

Operational state model.

PROFILEREGISTERED DICTIONARY / ARRAY

PROFILE
PATH	VALUE
VALUE	system-wide interface baseline. Product-specific deployment acceptance requires target-hardware and representative-user verification

SCOPEREGISTERED DICTIONARY / ARRAY

SCOPE
PATH	VALUE
VALUE	Inspired by nuclear, aerospace, and process-industry human-interface standards.

TYPEREGISTERED DICTIONARY / ARRAY

TYPE
PATH	VALUE
[0].acceptance	rendered glyph meets deployment visual-angle target
[0].css	16 / 24 px
[0].role	UI-01
[0].use	frequently read values, controls, and primary interface labels
[1].acceptance	at least 16 arcminutes at maximum intended distance
[1].css	14 / 20 px
[1].role	UI-02
[1].use	secondary interface, chart, graph, table, and state context
[2].acceptance	never the sole alarm, limit, unit, mode, relation, or quality cue
[2].css	12 / 16 px
[2].role	UI-03
[2].use	nonessential provenance only

PRINCIPLESREGISTERED DICTIONARY / ARRAY

PRINCIPLES
PATH	VALUE
[0]	The overview answers what is abnormal, where it is, how severe it is, whether it is worsening, and what requires action now.
[1]	Values show unit, target or safe range, limit, recent trend, sample time, and data quality when these affect a decision.
[2]	Normal operation is visually quiet. Strong salience is scarce and belongs to abnormal or action-relevant state.
[3]	Overview, subsystem, control detail, and diagnostic evidence use stable direct paths. Search does not replace these paths.
[4]	Selection, armed, engaged, live, warning, caution, advisory, validation, and destructive action remain distinct states.
[5]	A consequential command shows current value, target value, mode, authority, preconditions, acceptance, and observed outcome.

ALARM LIFECYCLEREGISTERED DICTIONARY / ARRAY

ALARM LIFECYCLE
PATH	VALUE
[0]	NORMAL — no qualifying condition.
[1]	ONSET / UNACKNOWLEDGED — condition is active and its justified attention cue is present.
[2]	ACTIVE / ACKNOWLEDGED — attention cue is suppressed. Condition, priority, source, age, and response remain visible.
[3]	RETURNED / UNACKNOWLEDGED — process returned but the user has not acknowledged the occurrence when the task requires this distinction.
[4]	CLEARED — clearing rule is satisfied. History and recall remain available when required.
[5]	INHIBITED — a visible authorized phase or manual inhibit prevents presentation. Inhibit is not clearing.
[6]	SHELVED — a time-bounded operator action defers presentation with owner, reason, and expiry.
[7]	SUPPRESSED BY DESIGN — documented logic prevents a consequential duplicate or downstream alarm.
[8]	STALE / UNKNOWN / FAILED — evidence cannot support a normal or alarm claim.

MOTIONREGISTERED DICTIONARY / ARRAY

MOTION
PATH	VALUE
[0]	Use no decorative animation in an operational view.
[1]	Keep critical message text steady. If flashing is justified, flash a compact marker or master annunciator.
[2]	Use one 2 Hz initial flash rate unless the governing domain and validation establish another rate.
[3]	Synchronize concurrent master cues. Acknowledgment stops the cue but does not resolve the condition.
[4]	Reduced-motion mode substitutes a steady redundant cue. It never removes consequential information.
[5]	Expose sample time, stale state, hold or freeze, dropped data, and data quality.

VERIFICATIONREGISTERED DICTIONARY / ARRAY

VERIFICATION
PATH	VALUE
[0]	Measure rendered glyph height and visual angle on each supported display, scale, WebView, operating system, and maximum viewing distance.
[1]	Remove color in a test rendering. Every consequential state remains identifiable.
[2]	Test one warning, mixed priorities, flood, chatter, acknowledged-active, recurrence, inhibit, stale sensor, restart, duplicate event, partition, and reduced motion.
[3]	Measure detection time, correct source identification, diagnosis accuracy, correct-action rate, action latency, false action rate, missed alerts, mode errors, and recovery time.
[4]	Test command preconditions, idempotent retry, cancellation, partial failure, uncertain outcome, and independent confirmation of the observed result.

Operational evidence.

SOURCESREGISTERED DICTIONARY / ARRAY

SOURCES
PATH	VALUE
[0].boundary	NRC nuclear-plant review guidance. Not a Cabrillo Coast certification.
[0].content	Frequently read alphanumeric characters should subtend 16–24 arcminutes, with 20–22 preferred. Use legible distinguishable glyphs, restrained flashing, readable contrast, explicit dynamic state, and task-based review.
[0].section	§§1.3, 1.5, 2–5, 7
[0].source	NUREG-0700 Revision 3
[0].translation	Measure glyphs and distance. Add UI-01/UI-02/UI-03. Keep normal structure neutral. Expose quality, freeze, and state.
[0].url	https://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/sr0700/r3/index.html
[1].boundary	Transport-airplane display guidance. Domain-specific symbology does not transfer automatically.
[1].content	Readability depends on luminance, size, contrast, distance, and environment. Use consistent redundant color coding, six or fewer coding colors as good practice, stable labels, restrained blinking, and useful trends.
[1].section	§§5.2–5.11. App. A/F
[1].source	FAA AC 25-11B
[1].translation	Separate alarm, selection, live, action, and quality roles. Show value relative to limits and trend. Keep exact labels.
[1].url	https://www.faa.gov/documentLibrary/media/Advisory_Circular/AC_25-11B.pdf
[2].boundary	Transport-airplane alerting guidance. Exact categories require product-domain validation.
[2].content	Prioritize alerts by urgency of awareness and response. Warning is red, caution is amber or yellow, advisory excludes red and green. Minimize false and nuisance alerts. Acknowledgment may suppress an attention cue without erasing the condition.
[2].section	§§8–12. App. 1
[2].source	FAA AC 25.1322-1
[2].translation	Add dedicated operational priority roles and a full alarm lifecycle. Keep risk actions and alarms separate.
[2].url	https://www.faa.gov/documentLibrary/media/Advisory_Circular/AC_25.1322-1.pdf
[3].boundary	Chemical-industry regulator guidance. Historical rate examples are diagnostics, not current universal limits.
[3].content	A status indication is not an alarm. Every alarm needs a defined response. Priorities derive from consequences of failure to respond. Alarm burden, nuisance alarms, training, governance, and periodic review affect operator reliability.
[3].section	Steps 1–3
[3].source	HSE Better alarm handling
[3].translation	Require condition, consequence, response, deadline, owner, deadband, inhibit, history, and change control before approving an alarm.
[3].url	https://www.hse.gov.uk/pubns/chis6.pdf
[4].boundary	Detailed licensed content was not reviewed. No numeric EEMUA requirement is asserted here.
[4].content	Alarm systems support operators during abnormal situations. Effective alarm systems require design, management, procurement, operation, and continuing improvement. Edition 4 aligns terminology with IEC 62682:2023 and ISA-18.2.
[4].section	public edition description
[4].source	EEMUA Publication 191 Edition 4
[4].translation	Treat alarm behavior as a governed lifecycle, not a component skin.
[4].url	https://www.eemua.org/Products/Publications/Print/EEMUA-Publication-191.aspx
[5].boundary	Only public metadata was reviewed. Detailed licensed requirements are not attributed.
[5].content	ISA maintains a standards series for human-machine interfaces in process automation.
[5].section	public series page
[5].source	ISA-101 series
[5].translation	Maintain an HMI philosophy, reusable patterns, lifecycle ownership, and evidence before domain compliance claims.
[5].url	https://www.isa.org/standards-and-publications/isa-standards/isa-101-standards

MEASUREMENTSREGISTERED DICTIONARY / ARRAY

MEASUREMENTS
PATH	VALUE
[0].browserMeasurement	13 px H / 9.6 px advance
[0].disposition	Within 16–24 arcmin and 0.7–0.9 width-height target. Verify target hardware.
[0].modelAt600mm	19.7 arcmin / width-height 0.74
[0].role	UI-01
[1].browserMeasurement	11 px H / 8.4 px advance
[1].disposition	Meets the 16 arcmin lower bound and width-height target in this model. Verify target hardware.
[1].modelAt600mm	16.7 arcmin / width-height 0.76
[1].role	UI-02
[2].browserMeasurement	8 px H / 7.2 px advance
[2].disposition	Below the operational reading floor. Nonessential provenance only.
[2].modelAt600mm	12.1 arcmin / width-height 0.90
[2].role	UI-03

EVIDENCE INTEGRITYREGISTERED DICTIONARY / ARRAY

EVIDENCE INTEGRITY
PATH	VALUE
[0]	The file previously named nasa-hidh.pdf was NASA/SP-2014-3705, a program and project management handbook. It was removed. No requirement is attributed to NASA HIDH.
[1]	Detailed current ISA-101, ISA-18.2, IEC 62682, and EEMUA 191 texts were not reviewed. Public metadata and summaries do not establish compliance.
[2]	The HSE sheet cites historical EEMUA alarm-rate examples. This system does not adopt them as current universal limits.
[3]	No representative-user study has yet validated Cabrillo Coast operational type, alarm recognition, workload, or recovery. The profile remains proposed.
[4]	Authenticity and authority of a source do not make its domain-specific requirement universal. Each source row states an applicability boundary.

HMI requirements / 01–41

HMI REQUIREMENTS
ID	AREA	REQUIREMENT	VERIFICATION	EVIDENCE
HMI-01	scope	The product identifies users, tasks, hazards, response times, environment, governing standards, and regulator before it adopts the operational profile.	Approved product HMI philosophy and applicability record.	Cross-domain boundary. ISA-101 public series scope.
HMI-02	type	Frequently read operational alphanumeric glyphs target 16–24 arcminutes, with 20–22 arcminutes preferred.	Measure actual glyph height at maximum intended viewing distance.	NUREG-0700 Rev. 3 §1.3.
HMI-03	type	Legibility evaluation includes font, luminance, contrast, distance, scale, display, ambient light, vibration or motion, and user correction lenses where applicable.	Target-hardware environmental test matrix.	NUREG-0700 §1.3. FAA AC 25-11B §§5.2.2–5.4.
HMI-04	type	UI-01 carries frequently read values and controls. UI-02 carries secondary context. UI-03 never solely carries an alarm, unit, limit, mode, or quality state.	DOM role audit and scenario inspection.	Cabrillo Coast translation of NUREG/FAA readability guidance.
HMI-05	type	Sentence text uses conventional mixed case. Short identifiers and conventional annunciations can use uppercase.	Copy audit.	NUREG-0700 §1.3. FAA AC 25-11B §5.4.2.
HMI-06	type	The font distinguishes I/l/1/\|, O/0/Q, S/5, B/8, Z/2, punctuation, sign, decimal point, and unit symbols at the minimum size.	Confusable-glyph specimen with representative-user recognition test.	NUREG-0700 §1.3.
HMI-07	type	A fixed-width operational face targets a 0.7–0.9 character width-to-height ratio unless task evidence supports a narrower face.	Rendered glyph measurement and representative recognition comparison. Audited Iosevka Aile ratios are 0.74–0.90.	NUREG-0700 §1.3. Current Iosevka trial remains below target.
HMI-08	color	Normal operation uses neutral structure. Strong saturated color remains scarce and action-relevant.	Normal-state salience review and grayscale comparison.	Cross-source high-performance synthesis.
HMI-09	color	Warning red, caution amber or yellow, and advisory treatment remain separate from risk action, selection, live flow, validation, success, and normal state.	Token identity audit and rendered-state inventory.	FAA AC 25.1322-1 §11. FAA AC 25-11B §5.8.
HMI-10	color	Every consequential color code includes exact text and another cue such as shape, stable position, border, pattern, sound, or haptic output.	Remove color and identify every state.	FAA AC 25-11B §5.8.1. NUREG-0700 §1.5.
HMI-11	color	An operational view uses no more than six semantic coding colors unless the task analysis justifies more.	Per-view semantic color count.	FAA AC 25-11B §5.8.3.
HMI-12	color	Distinct meanings do not depend on shades of one color, pure blue for important thin information, or low-luminance color pairs.	Contrast, chromatic-separation, aging-eye, and color-vision review.	FAA AC 25-11B §§5.8.7–5.8.10.
HMI-13	color	Background and overlaid information remain distinguishable across the supported ambient-light and off-axis-view range.	Photometric and in-context hardware test.	NUREG-0700 §1.5.1. FAA AC 25-11B §5.8.8.
HMI-14	motion	Operational motion represents observed change, command progress, causal flow, navigation continuity, or justified attention capture. Decorative motion is absent.	Motion inventory with task rationale.	NUREG-0700 §§1.3, 1.5.3. FAA AC 25-11B §§5.9, 5.11.4.
HMI-15	motion	Critical message text stays steady. A justified flash uses a compact marker or master annunciator, one initial 2 Hz rate, and synchronized master cues.	Rendered timing and area measurement.	NUREG-0700 §1.5.3. FAA AC 25.1322-1 App. 1.
HMI-16	motion	A user can suppress a persistent attention cue by acknowledgment when continuous cueing is not required. The active condition remains visible.	Acknowledge-state interaction test.	FAA AC 25-11B §5.11.4. FAA AC 25.1322-1 §12.
HMI-17	motion	Exact digital values normally update no faster than 1 Hz. Trends or changing parameters use 2–5 Hz when rate perception matters. Direct-control rates derive from the control task.	Telemetry cadence audit and task-lag test.	NUREG-0700 §1.3. FAA AC 25-11B §5.9.
HMI-18	motion	Filtering, hysteresis, damping, and animation do not create misleading lag, conceal hazards, or introduce position error.	Step-response, jitter, and lag test.	FAA AC 25-11B §§5.9.1–5.9.3.
HMI-19	motion	Reduced-motion mode replaces every consequential moving cue with a steady equivalent and preserves state, priority, source, and action.	Reduced-motion scenario suite.	Cabrillo Coast accessibility translation.
HMI-20	alarm	Before approval, each alarm defines condition, source, detection logic, setpoint, deadband, delay, priority basis, consequence, response, deadline, clearing rule, owner, and change history.	Alarm rationalization record completeness.	HSE Better alarm handling. EEMUA 191 public scope.
HMI-21	alarm	Alarm priority derives from urgency of awareness and response and consequence of failure to respond. Status indications are not alarms.	Priority rationale review.	FAA AC 25.1322-1 §8. HSE Better alarm handling Step 1.
HMI-22	alarm	The state model distinguishes normal, onset-unacknowledged, active-acknowledged, returned-unacknowledged when applicable, cleared, inhibited, shelved, suppressed-by-design, stale or unknown, and failed indication.	State-machine and transition tests.	FAA AC 25.1322-1 §§8–12. Process-alarm lifecycle synthesis.
HMI-23	alarm	Acknowledgment suppresses an attention cue. It does not resolve, clear, inhibit, or hide an active condition.	Rendered acknowledge test and history check.	FAA AC 25.1322-1 §§9, 12.
HMI-24	alarm	Multiple alarms retain deterministic urgency and recency ordering without auto-scrolling the item being read out of view.	Mixed-priority and flood interaction test.	FAA AC 25.1322-1 §8.
HMI-25	alarm	The system minimizes false, nuisance, duplicate, and chattering alarms and identifies initiating conditions without hiding uncertainty.	Flood, chatter, cascade, deadband, and deduplication tests.	FAA AC 25.1322-1 §12. HSE Better alarm handling.
HMI-26	alarm	An alarm links to the correct procedure, affected system, diagnostic evidence, and retained recall or history when the task requires them.	Alert-to-procedure and recall test.	FAA AC 25.1322-1 §§9–10.
HMI-27	alarm	Manual inhibit and shelf state remain unmistakably visible with authority, reason, start, expiry, and affected alarm.	Inhibit and expiry scenario test.	FAA AC 25.1322-1 §8(d). Process-alarm synthesis.
HMI-28	alarm	Alarm behavior defines restart, duplicate event, clock skew, partition, late reconciliation, stale sensor, failed service, and uncertain outcome.	Fault injection and recovery tests.	Cabrillo Coast distributed-system requirement.
HMI-29	alarm	Alarm additions and changes require an owner, rationale, test evidence, training impact, change control, and post-deployment review.	Governance audit.	HSE Better alarm handling Step 3. EEMUA 191 public scope.
HMI-30	control	A consequential control shows label, commanded value, actual value, unit, target or safe range, limit, mode, authority, precondition, sample time, and data quality when these affect action.	Control contract and rendered specimen audit.	NUREG-0700 controls/dynamic displays. FAA AC 25-11B consistency and labels.
HMI-31	control	Selection, armed, engaged, current data, live flow, warning, caution, advisory, validation, destructive action, and disabled state remain distinct.	Complete interaction-state inventory.	FAA AC 25-11B §§5.3, 5.8. Cabrillo Coast state model.
HMI-32	control	Automation exposes current mode, target, authority source, state transition, constraints, reason for holding or degrading, and manual recovery path.	Mode-transition and automation-surprise scenarios.	FAA AC 25-11B §5.3 and App. F mode awareness. NUREG automation guidance.
HMI-33	control	A consequential command passes through a typed service that validates identity, authority, current state, limits, freshness, replay, and idempotency and returns acceptance and observed outcome separately.	Service contract, authorization, stale-precondition, retry, and partial-failure tests.	Cabrillo Coast trust boundary.
HMI-34	control	Confirmation is proportional to consequence and previews the exact target and effect. Generic confirmation does not replace a precise domain verb.	Command-language and consequence review.	Cabrillo Coast action vocabulary.
HMI-35	control	Known unavailable commands stay visible and explain the constraint when disclosure is safe. Protected capability stays undisclosed.	Disabled and authorization-denial tests.	Cabrillo Coast application profile.
HMI-36	hierarchy	The overview answers what is abnormal, where it is, how severe it is, whether it is worsening, and what requires action now.	Representative overview detection tasks.	Cross-source high-performance synthesis.
HMI-37	hierarchy	Overview, subsystem, control detail, and diagnostic evidence use stable spatial mapping and direct navigation. Search remains supplementary.	Navigation-path and context-retention tests.	NUREG display organization. Cabrillo Coast navigation profile.
HMI-38	hierarchy	A decision value is shown relative to target, safe range, limit, recent trend, unit, time, and quality rather than as an isolated large number.	Operating-envelope component audit.	FAA AC 25-11B Appendix A trend/limit guidance. High-performance synthesis.
HMI-39	verification	Operational verification covers one warning, mixed priorities, flood, chatter, acknowledged-active, recurrence, inhibit, stale or failed sensor, restart, duplicate event, partition, reduced motion, keyboard, and assistive technology.	Scenario evidence register.	Reviewed alert guidance and Cabrillo Coast failure model.
HMI-40	verification	Before testing, define populations, tasks, hardware, baselines, and thresholds for detection time, source identification, diagnosis accuracy, correct action, action latency, false action, missed alert, mode error, and recovery time.	Pre-registered human-performance protocol and results.	Testable operational acceptance.
HMI-41	verification	The product does not claim standards compliance, certification, or safety from visual resemblance or this cross-domain profile.	Claim and release review.	Applicability boundary of every reviewed source.