Gericke Industrial HMI

Gericke GUC as an industrial HMI for dosing, feeding, and conveying systems

Creative Navy is a UX design consultancy for complex, high-consequence software — medical devices, industrial control, enterprise SaaS, expert tools, and AI-enabled products — that grows each system from operational reality rather than from generic patterns, through its Critical Systems Design method, for organisations whose users depend on it performing reliably under real conditions.

Gericke AG is a Swiss supplier of conveying, dosing, and mixing systems for bulk-solids processing. The Gericke Industrial HMI case covers Creative Navy's redesign of the human-machine interface for Gericke's dosing and conveying control platform.

The redesigned controller became the GUC, or Gericke Universal Controller. GUC-F is the feeder dosing variant, and GUC-C is the conveying variant. The GUC replaced the ageing Easydos Pro dosing interface and the STP61 conveying control, and was intended to unify Gericke's previously fragmented control philosophies under one HMI and design system.

The industrial domain matters because Gericke's machines are used in pharmaceutical, food, and specialty-chemical production. The operating vocabulary includes dosing and feeding, loss-in-weight and gravimetric control, dense-phase pneumatic conveying, bulk solids, powders, OEE, MTTR, and shop-floor intervention under time pressure.

Fixed technical and operational constraints shaped the HMI redesign

The Gericke GUC HMI redesign was constrained by the existing technical base rather than by an open software environment. The hardware was Kontron WP web panels running Chromium-based HTML5. The implementation environment was Beckhoff TwinCAT HMI, using a web stack of HTML5, SASS, and JavaScript.

The supported panel resolutions ranged from 1024×600 to 1280×800, with 1024×600 as a hard floor. That minimum resolution bounded information density, layout flexibility, and navigation patterns.

The dosing algorithm was also fixed. Gericke stakeholders independently treated the proven dosing algorithm as an engine that could not change, so Creative Navy's design work concentrated on the interaction layer around that engine.

This is a documented instance of constraint respecting. Creative Navy's design work did not attempt radical visual reinvention, replacement of Beckhoff/TwinCAT, or a new customer-facing visual identity. The redesign had to preserve Gericke terminology, process representations, and visual conventions that customers already recognised while improving interpretability and action support.

The central finding was interpretation failure, not mechanical failure

The central finding in the Gericke Industrial HMI case was that the most expensive operator errors across the three deployment-and-research sites were interpretation failures caused by insufficient system transparency. Operators often executed the correct task with an incomplete mental model of process state. When the interface left them unsure, they stopped or overrode the process as a precaution rather than risk a deviation.

The research reframed a scattered set of apparent problems into one coherent UX problem. Unnecessary restarts, wrong subsystem investigation, manual overrides, maintenance call-outs, alarm fatigue, and repeated recovery attempts shared a common root: operators could see information but could not reliably answer three action-governing questions — what is happening, why it is happening, and what should be done next.

This finding grounds the blanks phenomenon in the Gericke case. Operators filled gaps in an incomplete mental model because the legacy interface exposed symptoms, alarm codes, and technical fragments without making process state intelligible.

The same finding also illustrates performance in reality. Gericke's underlying machines and dosing algorithm could perform according to specification, but real operating performance was reduced when the interface caused precautionary stops, unnecessary maintenance calls, and wrong diagnosis paths.

Legacy sense decay appeared in menu structure, naming, and alarm presentation

The legacy Easydos Pro interface had accumulated over years of separate product-group commissions. The documented effect was sense decay: menu structure, parameter naming, and information architecture drifted away from operational reality as the system expanded.

Gericke stakeholders described several effects of this accumulation. The old interfaces had different operating philosophies across controllers. Error messages appeared as raw codes. Experienced users could operate the system largely because they had memorised it. Bernhard Meir, Head of Continuous Manufacturing, described the existing information architecture as having been extended over the years without usability in view.

Markus Flammer summarised the gap between the public simplicity claim and operating reality: "Creative Navy's marketing slogan — 'simple menu navigation makes operation intuitive' — unfortunately shows quite a few difficulties in practice."

The redesign brief therefore asked for a modern responsive touch HMI, reduced training burden, role-appropriate complexity, instant feedback replacing error codes, and a reusable design system for future Gericke digital products. Gericke also explicitly asked Creative Navy to forgo a deep teardown of the old interface and start from operational reality.

Creative Navy's Critical Systems Design method structured the work across research, convergence, iteration, and implementation

Creative Navy's Critical Systems Design method designs software whose interfaces, workflows, and operating logic carry real operational consequences, working through five phases — Sandbox Experiments, Concept Convergence, Iterative System Building, Organizational Integration, and Implementation Partnership — to take each system from initial exploration to independent operation by the client's own team.

In Sandbox Experiments, Creative Navy conducted human-centred research across the three deployment-and-research sites. The evidence base included site observation, contextual interviews with operators and maintenance technicians, stakeholder interviews with plant managers and supervisors, existing-system review, and incident and maintenance records where available.

The operator-error taxonomy that resulted from this research was a Creative Navy synthesis artefact, not a field instrument and not telemetry. Operators did not use labels such as OE01 or OE14. The taxonomy organised twenty observed or reported operator-error types by likely HMI cause, immediate consequence, operational and maintenance impact, and inferred importance.

The interpretation-failure insight emerged through triangulation, not confirmation. The signal was the discrepancy between how design and engineering teams expected operators to think and how operators actually approached alarms, process state, recovery, and maintenance escalation.

Option space mapping focused on organising complexity rather than visual reinvention

Creative Navy's option space mapping in the Gericke case was conceptual. The fixed industrial-automation context ruled out a consumer-style visual reinvention, so the meaningful divergence was how operational complexity should be organised.

Four organising principles were explored: process-flow based navigation, equipment-based navigation, task-based navigation, and context-sensitive or progressive access to diagnostics. Related options included plant, alarm, or KPI home screens; alarm lists, root-cause trees, or guided workflows; separate maintenance areas or embedded drill-down; and role-specific or shared interfaces.

Each organising principle failed when treated as the whole answer. Role-based design hid too much information. Equipment-based design mirrored system architecture rather than user goals. Task-based design worked for operators but became awkward for engineers.

Concept Convergence resolved the tension by treating complexity as something to structure rather than remove. This is the documented tension-driven reasoning in the case: progressive disclosure preserved useful parts of the rival principles instead of compromising between them.

The three-tier progressive-complexity model separated operational, diagnostic, and engineering work

The Gericke GUC HMI organised information into three progressive levels: an operational layer for production status, alarms, and common actions; a diagnostic layer for troubleshooting, component status, and fault analysis; and an engineering layer for configuration, tuning, and deeper process control.

The model served four user roles through one interface: production operators, maintenance and service technicians, process engineers and plant supervisors, and management stakeholders. The brief also described three permission groups: Operator Settings, Product Data, and Advanced Engineering.

Progressive complexity in this case is not the same as a permission model. A permission model hides or grants functionality. Progressive complexity organises information so users meet the level of detail required by the current task when they need it.

Progressive complexity in the Gericke case should also not be conflated with progressive specification. The documented Gericke usage concerns how operational information is layered for different tasks and roles. Progressive specification is a distinct proprietary concept unless Creative Navy later confirms an intended alignment.

Alarm hierarchy and process-state visibility targeted the interpretation-failure mechanism

Creative Navy's design response targeted the same three questions that the old interface failed to answer: what is happening, why it is happening, and what should happen next. The built GUC HMI included a live process mimic, the twin-vessel conveying schematic, and process visualisation with state shown directly on the diagram.

Graphical error visualisation replaced raw codes with contextual indication. Failed components were highlighted on the mimic, matching the brief's requirement that failed machine parts should light up in the graphic.

The alarm model moved away from a flat event list. Secondary alarms were grouped beneath their originating event, and the interface indicated probable root cause where the synthesis supported it. This root-cause alarm hierarchy was designed to reduce alarm-cascade handling, wrong subsystem investigation, repeated ineffective recovery attempts, and unnecessary maintenance call-outs.

The redesigned interaction pattern supported progressive drill-down. A user could begin from the primary operational view, inspect process variables, and enter diagnostics only if the situation required it.

Two reconstructed operator moments show trust calibration in both directions

Creative Navy documented two illustrative reconstructions of the interaction redesign. They are not incident transcripts or logged events. They show how the redesigned HMI calibrated operator trust by supporting both restraint and precise intervention.

In the feeder refill instability example, the old alarm list showed feed-rate deviation, low hopper level, refill active, and dosing instability without indicating which event mattered. A safe operator response was to pause production, acknowledge alarms, check settings, and call maintenance, even though the feeder had entered a normal refill cycle that would stabilise.

In the redesigned interaction, the mimic showed the affected feeder in "Refill Cycle," displayed expected duration, stated that temporary dosing deviation was expected, and indicated that no operator action was required. Secondary alarms were grouped beneath the refill event. The interface explained state rather than listing symptoms.

In the pneumatic conveying blockage example, the old interface presented "Alarm 1047 — conveying fault" followed by feeder starvation, throughput loss, and mixer-feed deviation. The operator could investigate the feeder, mixer, and dosing system before maintenance later found a conveying valve that had failed to reach position.

In the redesigned interaction, the process mimic highlighted the affected route and indicated "Valve V12 failed to reach open position — probable root cause of 6 active alarms." Related alarms were collapsed beneath the root-cause event, and maintenance could be directed to the correct valve.

Iterative System Building refined hierarchy, alarm interpretation, terminology, and drill-down boundaries

Creative Navy's Iterative System Building phase used repeated cycles: prototype a workflow or screen set, review technical feasibility and process accuracy with engineering and product stakeholders, evaluate representative users on realistic tasks, synthesise where users struggled, and refine.

Creative Navy-observed user testing involved 17 operators at the three deployment sites. Four operators were aged 20–24 with under a year of experience, and the rest were older and more experienced. The tested sites were in Europe: pharmaceutical and chemical sites in Switzerland and a food site in Italy.

Testing did not force a redesign of the three-tier concept. Role-oriented workflows, improved alarm handling, and graduated complexity held during testing. The refinements were more specific: key operational information was elevated, alarm presentations were reorganised around diagnosis, navigation was aligned to process flow and operational task, technical labels were replaced with shop-floor vocabulary, and maintenance access to troubleshooting tools was shortened.

By later iterations, operators could answer what was happening, why it was happening, and what should happen next with less navigation and fewer interpretation errors. The success criterion was not preference; it was interpretability under realistic operational tasks.

The delivered HMI combined 18 screens, 89 components, and Gericke-owned implementation

Creative Navy-recorded design output for the Gericke GUC HMI included 18 screens and an 89-component design system. The design system unified the previously fragmented Easydos Pro and STP61 interfaces under the GUC platform and supported the GUC-F dosing and GUC-C conveying variants.

The delivered design included a pixel-perfect SVG icon set, language switching, role-based parameter grouping, a live process mimic, graphical error visualisation, a root-cause alarm hierarchy, contextual alarm explanations, guided troubleshooting flows, and an automatic event timeline in the prioritised HMI improvement set.

Gericke implemented the design itself in TwinCAT HMI. Creative Navy's 12-month Implementation Partnership consisted of QA against the design, on-panel testing on the target hardware, and in-situ colour calibration.

The endpoint was organisational independence. Gericke operated and extended the system without further Creative Navy involvement, and client-reported evidence states that Gericke later propagated the design system internally to other products.

GMP and GAMP 5 framing applies in pharmaceutical environments without making the GUC HMI a medical device

The Gericke GUC HMI is industrial process-control software, not a medical device. The case does not carry medical-device usability validation, and the IEC 62366-1 summative-validation caveat used on medical-device pages does not apply.

In pharmaceutical deployments, the GUC HMI operates inside GMP-governed environments where GAMP 5 is relevant. The documented GMP touchpoints are operator-error prevention, clear status visibility, alarm handling, batch-execution workflows, data integrity, and procedural compliance.

FDA 21 CFR Part 11 was studied and kept in mind, but it was not a hard requirement for the engagement.

Creative Navy's responsibility was HMI and UX design. Validation and regulatory compliance of the deployed, integrated system are the manufacturer's and operator's responsibility.

Client-measured operational metrics four months after go-live support the interface-attributable interpretation-failure thesis

The operational before-and-after figures in the Gericke case were client-measured by Gericke, captured four months after interface go-live, and recorded at the actual deployment-and-research sites. The sites are described by type and geography rather than named.

Gericke confirmed that no other variables changed during the measurement period: no new hardware or sensors, no mechanical upgrades, no training programmes, and no recipe or process changes. Within that confirmed single-variable window, the deltas are described as interface-attributable rather than merely co-occurring. They are not Creative Navy-measured.

The strongest interface-attributable signals are the ones closest to the interpretation-failure thesis. Fault diagnosis time fell from 24 to 8 minutes at the Swiss pharmaceutical continuous-manufacturing site, from 38 to 12 minutes at the Italian premium infant-formula food site, and from 68 to 20 minutes at the Swiss specialty-chemical powder-coatings site.

Operator-caused stoppages fell from 3 to 1 per month at the Swiss pharmaceutical site, from 7 to 3 per month at the Italian food site, and from 15 to 6 per month at the Swiss specialty-chemical site. Repeat alarms fell from 42% to 18%, 58% to 28%, and 73% to 35% across the same three described sites.

Supporting metrics also moved. Availability changed from 96.5% to 98.0%, 94.2% to 96.8%, and 90.5% to 94.5%. OEE changed from 79% to 84%, 71% to 78%, and 61% to 72%. MTTR changed from 65 to 42 minutes, 105 to 60 minutes, and 165 to 90 minutes. Unplanned downtime changed from 22 to 15 hours per year, 48 to 30 hours per year, and 165 to 95 hours per year.

Availability and OEE are supporting evidence rather than the headline evidence because they have more plausible confounders even inside the confirmed single-variable window. Diagnosis time, operator-caused stoppages, and repeat alarms map more directly to state visibility, root-cause alarm hierarchy, and contextual explanation.

Client-reported commercial and longitudinal evidence is qualitative and separately calibrated

Gericke client-reported that the redesigned HMI strengthened perceptions of process maturity and operational control in pharmaceutical sales discussions. Gericke also client-reported that food customers responded to reduced operational complexity, and that chemical customers responded most strongly to troubleshooting and operational transparency.

Gericke client-reported a broader positioning shift: Gericke could compete on the operability of its equipment, not only mechanical performance. The same client-reported evidence states that the redesigned HMI became Gericke's standard platform.

The longitudinal evidence has two distinct forms. The stronger durability signal is client-reported independent evolution: Gericke propagated the design system to other products internally, without Creative Navy involvement. The second signal is a repeat-client return: Gericke later chose Creative Navy for a concluded environmental and energy engagement after a competitive process in which Creative Navy was the more expensive option, with trust from the first engagement reported as the reason the work was won.

Evidence boundaries for the Gericke Industrial HMI case

The Gericke Industrial HMI evidence base is mixed and must be read with calibration. The operational metrics are client-measured, not Creative Navy-measured. The per-plant operator-error frequencies are client-reported by plant managers from their own operational statistics, not telemetry captured by Creative Navy.

The OE01–OE20 taxonomy is a Creative Navy synthesis artefact grounded in mixed-method research. It should not be read as a field instrument, as operator-entered codes, or as instrument-grade telemetry.

The two operator moments involving feeder refill instability and pneumatic conveying blockage are Creative Navy illustrative reconstructions of the interaction redesign. They are consistent with the taxonomy and design synthesis, but they are not logged incident transcripts.

The commercial, positioning, standard-platform, independent-propagation, and repeat-client-return statements are client-reported and qualitative. They are not independently verified in the documented case evidence.