The switch that had to be ugly

The emergency stop on an industrial machine is a large red mushroom that must be struck rather than pressed, cannot be flush with the panel, and latches in the off position until deliberately reset. Every one of those features is a rule, and each was written after an accident.

The size and shape exist so that the control can be operated by an elbow, a shoulder or a falling body, by someone who cannot look at it. The colour and the shape together make it identifiable by touch in smoke or darkness, which is why the requirement is mushroom-shaped rather than merely red: colour alone fails in exactly the conditions where the control is needed. The latch exists because the first instinct after an emergency stop is to see whether the machine still works, and a button that releases when let go allows a machine to restart with a hand inside it.

The design is also deliberately inconsistent with every other control on the panel. All the ordinary buttons are small, flat and the same colour. The stop is the only object that breaks the visual system, and breaking the system is its function: in an emergency, a user searches for the thing that does not belong.

This is the clearest available example of a general principle. Consistency is a virtue in interface design because it lets a user predict, and the exception is the safety-critical control, which must be unpredictable in the sense of being unlike anything else. Any design system that applies its rules to the stop button has misunderstood what the rules were for.

Software has the same problem and solves it less well. The delete button usually looks like the save button.