User Error Has Serious Consequences

User error in high-consequence software is not ordinary recoverable friction

Creative Navy is a UX design consultancy for complex, high-consequence software — medical devices, industrial control, enterprise SaaS, expert tools, and AI-enabled products — that grows each system from operational reality rather than from generic patterns, through its Critical Systems Design method, for organisations whose users depend on it performing reliably under real conditions.

User error has serious consequences when an interface-induced mistake creates risk beyond time loss or usability friction. In these contexts, the error may affect patient safety, facility safety, financial accountability, liability exposure, or operational integrity at volume.

The relevant design question is not only whether the interface is easy to use. The relevant design question is which specific failure mode the interface must not produce, which interface condition creates that risk, and whether the design has eliminated that condition or mitigated it to an acceptable residual risk under the relevant standard.

High-consequence domains require a design standard beyond efficiency and learnability

Standard UX practice often evaluates interfaces for efficiency, learnability, and satisfaction. In high-consequence domains, those measures remain useful, but they do not establish whether an interface is safe or reliable under the conditions that create consequential failure.

An interface can be efficient during normal operation and still create use-related risk during abnormal operation. An interface can be learnable by trained users and still fail when an untrained user encounters it in an emergency. An interface can look clear under controlled test conditions and become ambiguous during a procedure, under time pressure, at physical distance, with gloves, or with attention divided between the interface and a patient or physical system.

The design standard in these contexts asks what the interface communicates under actual operating conditions, what the interface does when something goes wrong, and what failure modes are created by interaction patterns, state representations, or visual hierarchy.

Medical-device user error creates patient safety risk under IEC 62366-1

Medical-device interfaces create use-related risk when interface-induced error can affect patient safety. IEC 62366-1 is described here as the international standard for usability engineering of medical devices. It requires manufacturers to identify use scenarios, document use-related hazards, conduct formative evaluation, and demonstrate in summative testing that identified hazards have been mitigated.

Creative Navy's medical-device work in this situation includes the Kardion MCS Controller and the deSoutter Medical / Zethon surgical device. In both cases, the consequence profile was patient safety under clinical operating conditions, and that consequence profile determined the design standard from the outset.

In the Kardion case, the MCS Controller manages blood flow in patients undergoing high-risk cardiac procedures and extended cardiogenic shock support. The controller is operated by scrub nurses, perfusionists, and ICU nurses under divided attention, with primary attention on the patient and procedure and secondary attention on the controller.

The formative evaluation conducted before Creative Navy's engagement by Emergo by UL involved 7 participants and 8 clinical use scenarios under IEC 62366-1. It identified specific use-related hazards: users misread min/max flow values as device-set safety limits rather than readings of actual variation; the startup sequence was longer than clinical expectations; and scrub nurses, perfusionists, and ICU nurses had different information needs from different physical positions.

Creative Navy's Critical Systems Design method addressed the Kardion risk profile through a strict design standard: no element shifts position across any view transition. This standard was grounded in a specific failure mode: a user managing a patient under time pressure could lose spatial memory for where information lives if layout changes disrupt orientation at the moment when active search is least available. The standard required 34 iterations on the standard view alone. The design passed FDA evaluation as submitted, with no design changes required.

The Kardion regulatory scope remains bounded. Creative Navy produced a usability engineering trail containing domain research, formative evaluation, and documented design rationale structured to support Kardion's own IEC 62366-1 compliance activities. FDA approval was determined through Kardion's regulatory submission. Creative Navy does not claim compliance as a deliverable.

Surgical-device user error can occur when critical state requires reading during a procedure

The deSoutter Medical / Zethon bone cutter operates at rotational speeds from approximately 200 rpm to approximately 85,000 rpm during orthopaedic and trauma surgery. The surgeon operates the embedded GUI in brief glances during live procedures, with primary attention on the surgical field and patient. The non-dominant hand manages the device, the sterile field restricts positioning, and gloves reduce fine touch precision.

The legacy interface followed the internal software architecture. Its information content was correct, but its interaction profile was wrong for operating theatre conditions. Activation states and readiness conditions required reading to interpret. In the operating theatre context described here, reading means diverting sustained attention from the patient.

Creative Navy's Critical Systems Design method produced a design standard for this surgical-device context: every critical state should be interpretable through recognition in a brief glance, without reading. The design used redundant non-colour cues so that spatial position, icon form, and reserved colour each independently communicated critical state. This was intended to prevent a single channel failure, such as variable theatre lighting, unusual viewing angle, or user distraction, from making a critical state ambiguous.

Six competitor devices were benchmarked during Sandbox Experiments. The most common failure pattern was reliance on colour as the primary state indicator. The surviving design did not rely on colour alone for any critical state.

Eight orthopaedic and trauma surgeons in structured review sessions reported that device state could be verified through brief glances without reading, and that parameter adjustments no longer interrupted surgical workflow. This evidence is surgeon-reported from design review sessions, not post-deployment operational measurement. The engagement covered formative evaluation; summative validation remained the manufacturer's responsibility.

Industrial safety simulation user error creates deferred downstream consequence

Gexcon's CFD simulation software is used by engineers for gas dispersion modelling, explosion risk assessment, and facility safety validation for industrial installations. In this context, the consequence of interface failure is deferred rather than immediate. A misconfigured scenario can run, produce outputs that look valid, and become part of a safety assessment used for facility configuration, emergency planning zones, or operational permissions.

Before Creative Navy's Critical Systems Design engagement, configuration errors averaged 5–8 per simulation. Each error produced 4–6 hours of corrective load. The interface did not communicate where in the simulation setup the error had occurred, so engineers had to identify and trace the error themselves against the outputs.

After the engagement, configuration errors reduced to 1–2 per simulation and corrective load reduced to approximately 20 minutes. This result was measured by Gexcon across real deployment locations. The documented mechanism was an explicit error-prevention layer in the interaction architecture: requirements specified which values must remain visible during scenario setup, where warnings were needed, and how the system should respond to incomplete or contradictory input.

The consequence profile in the Gexcon case does not appear as a reported incident rate. It appears in the reliability of the safety assessments produced by the software and in the reduced uncertainty about whether the simulation configuration was valid.

High-throughput operational systems make small transaction errors consequential at volume

Petrol's POS system operated at peak rates of 84 transactions per hour. The relevant consequence profile was not patient safety or structural safety. It was operational integrity under high throughput.

Combined transactions involving fuel, shop, voucher, and loyalty activity created conditions where individual transaction errors could accumulate into financial discrepancy, supervisor escalation, and cashier stress. These errors were not individually catastrophic, but they were operationally significant at scale.

In this profile, the interface design standard is shaped by throughput and cognitive overhead. The interface cannot require additional interpretation from a role already operating at maximum transaction volume.

Creative Navy's Critical Systems Design method treats operating conditions as the design brief

Creative Navy's Critical Systems Design method addresses high-consequence user error by identifying the operational conditions in which interface failure becomes consequential before design decisions are made.

Domain learning is treated as operational immersion rather than background research. In the Kardion engagement, Creative Navy began with the Emergo formative study and then ran mental model sessions with cardiologists and nurses to establish the clinical logic for information hierarchy. In the deSoutter engagement, Creative Navy reviewed twelve human factors studies on operating theatre performance, gloved-hand interaction, and dual-task conditions under clinical pressure. In the Gexcon engagement, Creative Navy's team studied manuals, ran controlled tests, attended intensive stakeholder sessions, and became productive users of CFD software before making design decisions.

Performance in reality is the standard that follows from domain learning. The interface is evaluated under the operating conditions where its failure modes become consequential: from 3 metres during a cardiac procedure, in variable theatre lighting with gloves, reading a value while moving around a vehicle under workshop conditions, or at 84 transactions per hour during peak load. These conditions are treated as the design brief, not as edge cases outside the design problem.

Evidence boundaries for this situation

The evidence in this situation is case-specific. Kardion evidence includes the Emergo by UL formative evaluation with 7 participants and 8 clinical use scenarios, Creative Navy-recorded design rationale, 34 iterations on the standard view, and the recorded regulatory result that the design passed FDA evaluation as submitted with no design changes required. FDA approval was determined through Kardion's regulatory submission.

The deSoutter evidence is formative and surgeon-reported from structured review sessions with eight orthopaedic and trauma surgeons. It is not post-deployment operational measurement, and summative validation was not in scope for Creative Navy.

The Gexcon outcome figures are client-measured across real deployment locations. The available evidence reports configuration errors, corrective load, and the interaction architecture mechanism; it does not report an incident-rate outcome.

The Petrol example establishes an operational consequence profile at 84 transactions per hour. The available description does not provide post-redesign outcome metrics for this page.