Aviation, Marine & Drone Interfaces

Cockpits, helms, and ground control stations: trained operators, real weather, real consequences. Design for the worst hour, not the demo. (For cars and driver distraction, see Automotive UX.)

What changes vs. consumer UX

Operators are trained and current: you may assume type-specific training, recurrent checks, and manuals — but never assume calm. The interface must work for a startled, task-saturated operator, not just a proficient one.
Procedures are part of the interface: checklists, callouts, and standard operating procedures are the "software" on the human side — design displays to support the procedure, not to replace it.
Certification regimes constrain you: aviation displays must satisfy airworthiness regulations (14 CFR Parts 23/25 in the US, EASA CS equivalents); commercial marine bridge equipment is type-approved; drones face operational rules. UX decisions that would be A/B tests elsewhere are regulatory findings here — bring human factors evidence.
Environment is hostile: direct sunlight and total darkness in the same session, vibration, gloves, spray, G-loads, noise. Every design must survive glare, night adaptation, and fat-gloved fingers — test in motion, not at a desk.
Errors compound: a mis-set mode or missed alarm can be unrecoverable. Confirmation-vs-undo tradeoffs invert: some actions (fuel cutoff) need guarded or two-step activation, while time-critical reversions must be one action.

Aviation human factors (fixed-wing & helicopter)

The "basic T" is law, not convention: certification rules (14 CFR 25.1321 for transport aircraft; the Part 23 rules for smaller airplanes) require attitude top-center, airspeed to its left, altitude to its right, heading below. Glass-cockpit PFDs (primary flight displays) preserve this arrangement digitally; the MFD (multifunction display) alongside carries maps, systems, and engine data. Garmin G1000/G3000 and the Airbus/Boeing flight decks are the reference implementations.
Alert colors are codified: 14 CFR 25.1322 defines the hierarchy — warning (immediate awareness + immediate response) is red; caution (immediate awareness, subsequent response) is amber/yellow; advisory may be any color except red or green. Red and amber are reserved — decorative use elsewhere on the flight deck is restricted because it degrades alerting. Steal this discipline for any safety UI.
Dark cockpit / quiet-dark philosophy (established design philosophy, not a regulation): when everything is normal, panels are dark and silent; any lit annunciator means something needs attention. Absence of signal is the "all OK" state — the opposite of consumer dashboards full of green checkmarks.
Alert fatigue is managed structurally: crew alerting systems (EICAS/ECAM) prioritize alerts, aggregate related faults, and inhibit non-critical alerts during critical phases (takeoff/landing). Lesson: an alarm system needs a suppression/prioritization design, not just a triggering design.
Automation surprises are the classic failure mode: Sarter & Woods, "How in the world did we ever get into that mode?" (Human Factors,
1. documented mode error and weak mode awareness in glass cockpits; Wiener's "clumsy automation" (NASA CR-177528, 1989) showed automation that helps most when workload is low and least when it's high. Design responses: make the active mode and impending mode transitions conspicuously visible, avoid mode proliferation, and make manual override/reversion obvious and instant.
FAA HF-STD-001B (Human Factors Design Standard, 2016 revision current as of this writing): free, comprehensive reference on controls, displays, alarms, automation — written for FAA acquisitions but broadly useful.
EFB apps are the accessible entry point: electronic flight bags — charts, weather, performance, checklists on tablets — are where app designers actually enter aviation; ForeFlight is the exemplar of consumer polish meeting aviation conventions. FAA AC 120-76E (2024) governs commercial EFB authorization; EFBs must work in sunlight, in turbulence, one-handed.
Helicopters, briefly: higher continuous workload (hands on controls nearly always → glance/voice interfaces matter more), severe vibration, low-altitude obstacles. HTAWS (helicopter terrain awareness and warning) is mandated for US air-ambulance operations; degraded visual environment (dust/snow whiteout) drives synthetic-vision work.

Marine & boating

Helm displays and chartplotters (Garmin, Raymarine, Simrad/Navico, Furuno are the exemplars): chart + sonar + radar + instruments in user-configurable split screens. Sunlight readability is the first purchase criterion — high-nit bonded displays, polarized-sunglasses compatibility — and a true night mode with red/dark palettes is a long-standing marine convention to preserve dark adaptation (rod vision is least disrupted by dim red light).
Gloves and wet fingers defeat capacitive touch: the marine convention is hybrid control — touch for chart panning, physical buttons/rotary knobs for critical functions, and full button-only operation in "keypad mode." Never make touch the only path to an alarm-silence, autopilot, or MOB (man overboard) function.
NMEA 2000 is the standard data backbone: instruments, engines, and autopilots publish onto one network — a display is a view, not a silo.
Chart display is standardized: electronic navigational charts use IHO S-57 data rendered per S-52 presentation rules; the successor S-100 framework (S-101 charts) is in a "dual-fuel" transition — from Jan 2026 new ECDIS may meet either the old or new IMO performance standard; from Jan 2029 new installs must be S-100 compatible. Don't invent chart symbology; mariners read charts like pilots read the T.
Commercial context: ship ECDIS is type-approved (IEC 61174 testing against IMO performance standards) — recreational plotters are not ECDIS and must not claim to be.
Alarm management at sea: bridge alarm floods are a documented hazard; consolidate, prioritize, silence in one physical action, and keep the alarm visibly latched until resolved.
Autopilot engagement clarity: engaged/standby state, steering mode (heading/track/wind), and the takeover action must be unambiguous at a glance — the aviation mode-awareness lesson afloat.

Drones / UAS ground control stations

The GCS is the entire interface — the operator's senses are a camera feed, a map, and telemetry: situational awareness through a soda straw. Layout convention (set by DJI-class apps): live video dominant, map inset (swappable), persistent status strip — battery %, flight time left, GPS quality, link strength, altitude/distance — never hidden behind a tap.
Return-to-home is the safety anchor: RTH must be prominent, one-action, and its behavior (climb altitude, path, landing logic) understood before it's needed. Loss-of-link default behavior (usually auto-RTH) must be explained in plain language during setup — users routinely don't know what their aircraft will do on link loss.
Latency is a control-feel problem: FPV video delay degrades manual control; show link degradation honestly rather than freezing a stale frame that looks live.
Geofencing and warnings: altitude ceilings, no-fly zones, and battery-forced landings are interventions where the system takes over — announce early, explain why, show what the aircraft will do next (mode awareness again; the aviation literature applies wholesale).
Regulatory UX surface: FAA Remote ID (14 CFR Part 89, enforced since September 2023) means broadcast status is now cockpit state to display; LAANC apps grant near-real-time controlled-airspace authorization (an approval workflow UX problem); the EU has class markings C0–C6 (Regulation 2019/945) and U-space digital airspace services (Regulation 2021/664, applicable 2023).
Fleet and BVLOS dashboards (emerging, conventions unsettled): one operator supervising many aircraft shifts the UX to exception management — alert-driven attention, per-aircraft health rollups — closer to air traffic control than to piloting.

Cross-cutting transportation principles

Glance economy: the operator gets fractions of a second per look; one datum per glance, biggest-and-highest = most important.
Redundant coding: never color alone — pair color with shape, position, and text (25.1322 requires this for monochrome displays; it's also basic accessibility).
Alarm philosophy: EEMUA 191 (Engineering Equipment and Materials Users Association, 4th ed.) is the cross-industry alarm-management reference — every alarm relevant, unique, prioritized, and actionable, with alarm rates a human can handle. Audit alarms as a system.
Physical + digital redundancy: critical actions get a hardware control that works with gloves, in vibration, eyes-free.
Graceful degradation: sensors will fail; show data validity (flags, X-outs, stale-data indicators) rather than plausible garbage — a silently frozen display is worse than a blank one.
Test in the environment: sunlight, night adaptation, motion, gloves, noise, interruptions. A UI validated only at a desk is unvalidated.

Sources

14 CFR 25.1321 (basic T) & 25.1322 (alerting colors) — ecfr.gov; FAA AC 25.1322-1; FAA HF-STD-001B Human Factors Design Standard (2016).
Sarter, N. & Woods, D. (1995). "How in the world did we ever get into that mode? Mode error and awareness in supervisory control." Human Factors, 37(1).
Wiener, E. (1989). Human Factors of Advanced Technology ("Glass Cockpit") Transport Aircraft. NASA CR-177528.
FAA AC 120-76E (2024) — EFB authorization; ForeFlight product docs.
IHO S-52/S-57, S-100/S-101 & IMO MSC.530(106) ECDIS transition (2026/2029) — iho.int; admiralty.co.uk S-100 timelines; IEC 61174 (ECDIS type approval); NMEA 2000 (nmea.org).
14 CFR Part 89 (Remote ID); FAA LAANC program pages; EU Regulations 2019/945 (class markings) & 2021/664 (U-space) — EASA.
EEMUA Publication 191, Alarm Systems (4th ed.) — eemua.org.
Marine night-mode and hybrid-control practices: vendor conventions (Garmin, Raymarine, Simrad), labeled as such.