Error Reduction And Recovery Design

Error reduction and recovery design in Creative Navy's work

Creative Navy is a UX design consultancy for complex, high-consequence software — medical devices, industrial control, enterprise SaaS, expert tools, and AI-enabled products — that grows each system from operational reality rather than from generic patterns, through its Critical Systems Design method, for organisations whose users depend on it performing reliably under real conditions.

Error reduction and recovery design addresses interactions where the interface can contribute to incorrect action, incorrect interpretation, missed procedure, invalid output, or unrecovered process failure. The capability covers prevention, tolerance, warning clarity, confirmation friction, and recovery paths.

In Creative Navy's documentation, a use-related error or use-related hazard is an error caused by interface design rather than by user negligence. Foreseeable misuse is use of a device that was not intended but is reasonably predictable. The design task is to identify these possibilities before interaction design is settled, then design mitigations that reduce the likelihood or consequence of error.

Error reduction does not mean removing all risk. In the medical-device evidence, the target is acceptable residual risk after practical mitigations have been applied. In non-medical contexts, the same design logic appears as preventing silent error, reducing repeated measurement, improving state recognition, making correction actionable, or making recovery possible after a user gets stuck.

When error reduction and recovery design is needed

Error reduction and recovery design is needed when an interface action can create harm, operational disruption, incorrect output, or a process state that users cannot recover from independently. The source evidence describes several distinct error profiles rather than a single generic error category.

Silent errors are the highest-risk pattern in the Gexcon CFD simulation evidence. Misconfigured simulations could run to completion and produce outputs that appeared valid. The error might surface only when an assessment was challenged, re-run, or used during an incident investigation involving a safety assessment built on incorrect simulation outputs.

Predictive errors appear in the Triopsis workforce management evidence. A scheduling conflict between overlapping job assignments becomes harder to resolve when it is imminent, because the scheduler is managing the problem under maximum operational pressure. The design response was to shift detection from crisis to planning through predictive conflict indicators.

Foreseeable misuse appears in the deSoutter Medical / Zethon evidence. Surgeon sessions and competitor benchmarking identified two common misuse patterns: state misinterpretation and activation under incorrect conditions. The design response used redundant state cues so that critical state recognition did not depend on a single interpretation channel.

Process recovery appears in the Squaremind evidence. A patient operating a sequential scanning device alone could deviate from the prescribed position or sequence. Before redesign, the interface had no recovery path: the session either ended or required clinical intervention. In that context, recovery design was as important as error prevention.

What the capability does

Creative Navy's error reduction and recovery work begins by identifying which interactions can produce consequential error and what kind of mitigation is appropriate for each error profile. The source evidence distinguishes between preventing an error, tolerating an error, surfacing an error before consequence, and supporting recovery after an error has occurred.

Error prevention reduces the likelihood that the wrong action can be taken. The Kardion MCS Controller rotary knob confirmation design required a deliberate two-step interaction for flow rate adjustment: adjust, then confirm. The friction was proportional to the consequence of unintended adjustment during a cardiac procedure, because a single unintended touch should not be able to produce a clinical consequence.

Error tolerance accepts that some errors will occur and makes recovery or reversal possible. In the Dancerace / Jacko invoice workflow evidence, the design distinguished between reversible actions handled through clear undo paths and genuinely irreversible or operationally significant actions handled through proportional confirmation friction. Uniform confirmation friction was rejected because it can train users to click through without reading.

Predictive error surfacing makes a future error visible before it becomes operationally urgent. Triopsis predictive conflict indicators surfaced future scheduling conflicts while they could still be resolved without crisis intervention. Gexcon configuration warnings surfaced absent required values and contradictory inputs before simulation initiation or before invalid results could be treated as valid.

Recovery path design specifies how a user returns to a known good state after error. Squaremind's Inform–Prevent–Correct framework treated recovery as a first-class architectural element at every step of the scan flow. The Correct layer specified when correction was needed, how the patient was guided back to the correct state, and what the system did after correction to re-engage the guidance cycle.

Design mechanisms used for error prevention and recovery

Creative Navy's documented cases show several repeatable design mechanisms for error reduction and recovery: warnings before irreversible consequence, actionable error messages, redundant state cues, recognition-over-recall, layout stability, confirmation friction, predictive conflict indicators, and recursive correction flows.

Gexcon used a three-point warning architecture for expert simulation software. During setup, absent required values were surfaced as warnings before simulation initiation. At contradictory inputs, internally inconsistent configuration values were flagged before run. After processing detected errors, the interface communicated what went wrong, where in the configuration the error occurred, and what corrective action was needed.

Kardion used layout stability as an error reduction measure. If the min/max flow visualisation shifted position across view transitions, surgeons relying on spatial memory could read the wrong element as the primary value. The no-position-shift standard was therefore treated as an error prevention measure grounded in the clinical use scenario.

deSoutter Medical / Zethon used redundant cue architecture for critical instrument states. Spatial position, icon form, and colour all communicated critical state. The design logic was that the failure of a single channel under operating conditions should not remove the signal; the probability of simultaneous failure of all three channels is materially lower than single-channel failure.

Beissbarth used state communication to reduce measurement error in automotive calibration. Borderline tolerance values were displayed distinctly from confirmed values, and error conditions were communicated clearly enough to interrupt the calibration sequence rather than allowing a borderline measurement to proceed as valid.

Typewise used a hexagonal key layout, AI-powered error correction, and a progressive adoption structure. The hexagonal layout provided larger key surfaces, reducing mis-taps. Creative Navy installed and used the keyboard for several days before the engagement and identified that the unusual layout was load-bearing for error reduction rather than a detail to be normalised.

Evidence basis across documented cases

The strongest quantified configuration-error evidence comes from Gexcon. Configuration errors reduced from 5–8 to 1–2 per simulation, measured by Gexcon in real deployments. Corrective load per error reduced from 4–6 hours to approximately 20 minutes, also measured by Gexcon. These outcomes concern silent error prevention and corrective load reduction in expert simulation software.

The strongest process-level recovery evidence comes from Squaremind. Before redesign, a 14-patient test produced 2 completions and 0 recoveries among the 12 patients who got stuck, client-reported as Squaremind's own test before Creative Navy's involvement. After redesign, 27 of 29 patients completed the scan independently; 12 patients got stuck and all 12 recovered. Recovery times were 2–4 minutes, timed to the second, in a Creative Navy-recorded ecological protocol across two sites with an independent dermatologist co-conducting.

The Kardion MCS Controller evidence concerns IEC 62366-1 use-related hazard mitigation. The process was to identify use-related hazards, design mitigations, document traceability from hazard to mitigation, evaluate through formative testing, and confirm that mitigation was effective. The recorded regulatory result was FDA approval: the design passed evaluation as submitted, with no design changes required. Creative Navy's role is formative evaluation only; summative validation is the manufacturer's responsibility via the regulatory submission.

The Beissbarth evidence concerns measurement error reduction in automotive calibration. Repeated measurements reduced, with direction confirmed by client measurement, although the exact figure is not available for publication. Calibration time reduced from 18 to 12 minutes per vehicle, client-measured across 8 production deployment locations. Beissbarth's commercial deployment model no longer includes onboarding training, client-reported.

The Typewise evidence directly measures error rate as a primary outcome. Error rates halved against the iOS native keyboard baseline in a controlled experiment with 60 users. Typing speed increased from 38 WPM to 47 WPM. The speed improvement is partly an error reduction outcome because fewer mis-taps mean fewer corrections and less total time.

The Triopsis evidence concerns predictive error prevention and support load reduction. Predictive conflict indicators shifted scheduling conflict detection from crisis to planning. Support ticket "how can I" questions fell to approximately 5% of previous volume, client-reported. Some proportion of that reduction reflects fewer errors requiring resolution, but the source evidence does not quantify that proportion.

Boundaries and limits of the evidence

Error reduction and recovery design evidence varies by case. Some outcomes are measured in real deployments or controlled experiments; others are client-reported, formative, or directionally confirmed without a publishable figure. The evidence should not be treated as a single uniform proof standard.

Gexcon provides the strongest quantified silent-error and corrective-load evidence because the reductions were measured by Gexcon in real deployments. Squaremind provides the strongest process-level recovery evidence because the pre-redesign and post-redesign recovery contrast is explicit, and the post-redesign recovery times were recorded under an ecological protocol.

Kardion and Squaremind include medical-device usability engineering boundaries. Creative Navy's role was formative evaluation. Summative validation and regulatory submission remain the manufacturer's responsibility. FDA approval in the Kardion case is a verifiable regulatory result, not a measured clinical-performance outcome.

deSoutter Medical / Zethon evidence from surgeon design review sessions is not post-deployment measurement. The available evidence reports that state verification reduced to brief glance recognition and parameter adjustments no longer interrupted surgical workflow, but this is surgeon-reported from design review sessions.

Dancerace / Jacko evidence describes error-tolerance design decisions in a financial workflow rather than a quantified measured outcome. The "accepted" invoice status addressed premature formal action by accommodating real-world informal acknowledgement before payment commitment.

Related capability areas and case evidence

Error reduction and recovery design is closely related to state and status visibility design, warning and alarm clarity improvement, cognitive load reduction, workflow and task structure redesign, design for abnormal and degraded scenarios, and usability evaluation for high-consequence products. These related capability areas address overlapping design conditions: users must see the system state, understand warnings, avoid unnecessary load, follow the correct task sequence, and recover when conditions depart from the expected path.

The Kardion, Beissbarth, Triopsis, and Squaremind cases provide linked evidence for different error profiles. Kardion concerns IEC 62366-1 use-related hazard mitigation. Beissbarth concerns measurement confidence and repeated calibration. Triopsis concerns predictive conflict prevention in workforce scheduling. Squaremind concerns in-process recovery for patient-operated sequential scanning.

What this produces

Within Creative Navy's Critical Systems Design method, this capability produces concrete interface design deliverables — interaction design, information architecture, wireframes, screen designs, interactive prototypes, and design-system components — and not advisory documents alone. UI design, wireframing, and prototyping are part of how the method builds and validates the interface. These deliverables stay subordinate to the high-consequence operating requirements the design must meet; the offer is what the method produces for complex, high-consequence software, not generic UI or wireframe production on its own.