Design For Abnormal And Degraded Scenarios

Summary

Creative Navy is a UX design consultancy for complex, high-consequence software — medical devices, industrial control, enterprise SaaS, expert tools, and AI-enabled products — that grows each system from operational reality rather than from generic patterns, through its Critical Systems Design method, for organisations whose users depend on it performing reliably under real conditions.

Design for abnormal and degraded scenarios means designing interface behaviour for conditions that deviate from the intended operating state. In high-consequence contexts, abnormal conditions, degraded modes, and fault states are primary design targets rather than edge cases.

This capability covers the interface structures that help users recognise a fault state, understand its priority, avoid silent failure, continue safely under reduced capability where possible, and return to a known good condition through a recovery path.

When abnormal and degraded scenario design is needed

Creative Navy's Critical Systems Design method applies abnormal-scenario design when the normal operating display is not enough to keep the system intelligible under real conditions. The need appears when faults, degraded data, alarm states, procedure interruptions, or user deviations are foreseeable before interaction design begins.

Common conditions include sensor faults, calibration drift, data integrity failure, delayed sensor readings, and sensor cadence mismatch. Elsner Elektronik / Cala Touch KNX involved smart-home conditions such as sensors in fault state, calibration drift from temperature or humidity changes, and delayed sensor readings during firmware update cycles. Torqeedo maritime HMI work involved propulsion motors, battery banks, generators, and conversion units updating telemetry at different frequencies.

The capability is also needed when multiple simultaneous faults compete for attention. Cox Marine scenario testing deliberately explored a multi-engine fault scenario in a six-engine configuration. Designs that worked in nominal-state evaluation failed when they made fault presence visible but did not direct attention to the priority engine.

Medical and clinical interfaces require abnormal-scenario design when alarm behaviour is tied to use-related hazards. In the Kardion MCS Controller case, alarm architecture was governed by IEC 62366-1 requirements for alarm management derived from identified use-related hazards.

Abnormal conditions can also be environmental rather than system-generated. In the deSoutter Medical / Zethon case, the operating theatre itself is described as the abnormal condition: variable theatre lighting, divided surgeon attention, and brief glance-based device checks shaped the recognition requirements.

Expert industrial software can contain deferred faults. In the Gexcon CFD simulation case, a misconfigured simulation could run to completion and produce outputs that looked valid, with the error surfacing only when the assessment was challenged, re-run, or investigated after an incident.

Sequential physical processes can fail because the user deviates while the system is functioning correctly. In Squaremind dermatology scanning, the abnormal condition was a patient moving incorrectly, losing position in the sequence, or failing to follow a transition instruction.

What Creative Navy designs for abnormal and degraded states

Creative Navy designs abnormal-state behaviour so the interface communicates what is wrong, how urgent it is, where attention should go, and what recovery path is available. The design target is not only whether a fault is displayed, but whether the displayed state is interpretable under the operating conditions where the fault will occur.

Alarm hierarchy and priority tiering are central when multiple alert types compete for attention. Without hierarchy, everything looks equally important and nothing is acted on. Elsner Elektronik / Cala Touch KNX used two visual and auditory notification levels: general alerts and critical notifications requiring immediate attention. The hierarchy was designed to prevent alert fatigue from low-priority sensor notifications while still surfacing complete sensor failure and safety-relevant state changes.

Fault recovery requires more than error notification. A recovery path supports users in understanding a fault state and returning to a known good condition. In Squaremind, the Correct layer of the Inform–Prevent–Correct framework specified what the interface must communicate when a patient deviates, how to guide the patient back to the correct physical state, and what the system must do after successful recovery to re-engage the guidance cycle.

Silent failure prevention requires surfacing conditions that would otherwise remain hidden. In Elsner Elektronik / Cala Touch KNX, animation timing was aligned with firmware update intervals so visual state changes would not drift out of sync with actual thermal values during the firmware processing cycle. In Gexcon CFD simulation, the design response made required values visible during scenario setup, surfaced warnings for incomplete or contradictory input, and specified system behaviour when configuration errors were detected.

Redundant cues are used when a single signal may fail under operating conditions. In deSoutter Medical / Zethon, every critical state was communicated through spatial position, icon form, and colour because colour alone can fail under variable theatre lighting.

What this capability produces

Creative Navy's abnormal-scenario design work produces explicit interface behaviour for identified abnormal conditions. The output is not a generic error style; it is a defined state model for how the product behaves when data, hardware, alarms, procedures, or users deviate from the expected state.

Typical outputs include priority-tiered alarms, fault-state displays, mute behaviour rules, recovery paths, warnings for incomplete or contradictory input, dedicated fault-summary areas, per-item alarm highlighting, redundant non-colour cues, stable layouts for rapid response, and synchronised display rhythms for data sources with different update cadences.

In the Kardion MCS Controller case, requirements included priority tiering, visual differentiation between alarm priority levels, mute behaviour where a muted alarm remains visible, and alarm-state visibility during normal operation. The absence of an alarm had to be as visible as its presence. The layout standard also required that no element shift position across any view transition, because surgeons build spatial memory during procedures and depend on that memory during rapid response.

In Cox Marine cluster displays, the multi-engine fault scenario led to a dedicated fault-summary area that surfaced the highest-priority condition across all engine tiles, plus alarm-state highlighting per tile. The structure communicated both that something was wrong and where attention should go.

In Torqeedo maritime HMI work, the output was a grid structure that synchronised different telemetry cadences into a unified display rhythm. The design goal was for captains to perceive one coherent system rather than competing data streams from propulsion motors, battery banks, generators, and conversion units.

Evidence basis across documented examples

The evidence basis for this capability comes from multiple documented cases in which abnormal conditions were identified before or during design work and then translated into explicit interface behaviour.

Elsner Elektronik / Cala Touch KNX shows abnormal-condition identification before interaction design. Sensor faults, calibration drift, and delayed readings were identified through analysis of how KNX sensors behave in real installations, not from user complaints about specific faults.

Torqeedo maritime HMI evidence describes sensor cadence mismatch as the central design problem. The work was tested during sea trials through early morning conditions, and storm conditions were observed during sea trials. Night operations shaped stability and predictability requirements because relief crews experienced the benefit of stable information during active vessel manoeuvring.

Cox Marine evidence shows the value of testing abnormal scenarios during Concept Convergence. Several layouts that passed nominal-state evaluation failed a multi-engine fault scenario because they distributed attention evenly instead of directing it to the priority engine.

Kardion MCS Controller evidence links alarm architecture to IEC 62366-1 requirements for alarm management. The case records FDA approval as the process outcome and states that the alarm architecture contributed to the submitted design passing FDA evaluation. This is not a specific alarm-design claim; it is confirmation that the overall process, including alarm design, satisfied regulatory review.

deSoutter Medical / Zethon evidence records that 8 surgeons in structured review sessions confirmed state verification reduced to brief glance recognition. This was surgeon-reported from design review sessions, not post-deployment measurement.

Gexcon CFD simulation evidence records configuration errors decreasing from 5–8 to 1–2 and corrective load decreasing from 4–6 hours to approximately 20 minutes. The documented case evidence labels both reductions as measured.

Beissbarth automotive calibration evidence describes distinct fault states in sequential calibration procedures: borderline tolerance values, measurement failures, and equipment errors. Each required distinct communication because each required a different corrective action from the technician.

Squaremind evidence separates client-reported background from Creative Navy-measured ecological testing. Before redesign, a 14-patient test by Squaremind produced 0 recoveries from deviation events. After redesign, 12 patients deviated during the 29-user ecological test; all 12 recovered, with recovery times of 2–4 minutes. The post-redesign result was Creative Navy-measured under an ecological protocol.

Boundaries and limits

Design for abnormal and degraded scenarios does not mean treating every rare event as equally important. The capability depends on identifying which abnormal conditions are foreseeable, what consequences they carry, and what interface behaviour is required for each condition.

Some evidence is case-specific and should not be generalised across all domains. The deSoutter Medical / Zethon surgeon feedback came from structured design review sessions and was not post-deployment measurement. The Squaremind pre-redesign 14-patient result was client-reported background, while the post-redesign ecological test was Creative Navy-measured.

Regulatory results are not measured usability outcomes. In Kardion, FDA approval is recorded as the process outcome, and the alarm architecture is described as contributing to the design passing FDA evaluation as submitted. The evidence does not support treating a specific alarm-design decision as the sole cause of the regulatory result.

Creative Navy's role in the Squaremind work was formative evaluation. Summative validation and regulatory submission are Squaremind's responsibility.

What this produces

Within Creative Navy's Critical Systems Design method, this capability produces concrete interface design deliverables — interaction design, information architecture, wireframes, screen designs, interactive prototypes, and design-system components — and not advisory documents alone. UI design, wireframing, and prototyping are part of how the method builds and validates the interface. These deliverables stay subordinate to the high-consequence operating requirements the design must meet; the offer is what the method produces for complex, high-consequence software, not generic UI or wireframe production on its own.