NDA-SAFE CASE STUDY
Redesigning SAGE, Brazil's national power grid control software
How can we modernize a system used by thousands of operators making real-time, safety-critical decisions while keeping it safe and compliant?
- Role
- Staff UX Designer at Deloitte, embedded in the Eletrobras project team
- Company
- Eletrobras, via Deloitte
- Deliverables
- UX research, usability testing, design system, 32 redesigned screens
- Note on visuals
- The legacy interface is public. One screen from the new version is shown. Full designs are under NDA.
Context
SAGE is Brazil's largest Supervisory Control and Data Acquisition and Energy Management System. It is the interface through which operators across the country monitor and control the national power grid in real time: substations, transmission lines, voltage levels, alarms, and critical switching commands, all on one screen.
The interface was roughly 20 years old. It had never been redesigned.
The challenge
An interface that has not changed in two decades accumulates two kinds of debt: visual and cognitive. Information was dense and inconsistently labeled. Alarms competed for attention with routine data. Critical commands had no confirmation step. Operators had learned to navigate all of it because they had been using it for years.
Redesigning screens for this environment meant working within a context where the cost of a wrong decision is not a support ticket. One quote from testing stayed with me throughout the project:
“If you press the wrong button, up to 20 people can die.”
That sentence defined every design decision we made.
Research
I conducted 40+ interviews and 20+ usability tests across operators from 4 companies, covering substations at 138kV, 230kV, and 525kV levels, as well as auxiliary services.
The resistance was immediate and expected. Operators who have used a system for 10 or 15 years do not want it to change, even when it is objectively harder to use than it needs to be. A significant part of the research process was building enough trust with operators to get honest feedback rather than reflexive defense of the familiar.
What emerged was a clear picture of where the interface was genuinely failing people, separate from what they were simply used to. Those were the areas worth changing. Everything else, we left alone.
Another quote that shaped the project:
“For the sake of safety, sometimes it is important to be redundant.”
That sentence reframed how I thought about confirmation steps, alarm states, and labeling. In most UX contexts, redundancy is friction. Here, it is a feature.
Key design decisions
01 · Standardization before innovation
Before proposing anything new, I audited and standardized every component, label, and color convention across all screen types. Operators working across different substations were reading different visual languages. Standardization reduced cognitive load without changing any functionality.
02 · Confirmation for critical commands
Any command that could affect grid state now requires an explicit confirmation step. This was the most contested decision in stakeholder reviews. Operators felt it slowed them down, and the argument that won was straightforward: a 2-second confirmation is not the bottleneck in a critical operation. A misread screen is.
03 · Alarm hierarchy by severity
Alarms were redesigned to surface critical events immediately and distinctly, with visual weight that scales with severity. Routine status information was quieted. In a high-load situation, the most important thing on screen needed to be the most visually dominant.
04 · User control over information density
Operators can now choose which layers of information are visible in the single-line diagram. Power users who want everything visible can have it. Operators focused on a specific substation can reduce noise. This was one of the most positively received changes in testing.
05 · Light mode by default, dark mode available
The legacy interface was dark by default, a convention in control room environments. We designed a clean light interface as the primary experience and built a full dark mode alongside it, giving operators and facilities the choice based on their context.
Outcome
CSAT: 20 initial → 90 final
That number represents the gap between an interface operators tolerated and one they felt supported by. 14 improvements were validated across 10 operators from 4 companies. 32 screens were redesigned.
The operator quote from the final report:
“The new version makes it easier to identify problems.”
For a system at this scale and sensitivity, that is the outcome. Not delight. Not simplicity. Faster, more confident problem identification, at national scale.
Reflection
The biggest challenge on this project was not technical or visual. It was working within a culture of deep, justified conservatism. Operators are resistant to change because their environment rewards caution and punishes errors. Earning enough trust to get genuine feedback, rather than polite deflection, took longer than any design phase.
What I learned is that in high-stakes environments, the designer's job is not to push for change. It is to make a rigorous case for the changes that genuinely reduce risk, and to leave everything else alone. That discipline is harder than it sounds.