Reduced Error Risk

Summary

Creative Navy is a UX design consultancy for complex, high-consequence software — medical devices, industrial control, enterprise SaaS, expert tools, and AI-enabled products — that grows each system from operational reality rather than from generic patterns, through its Critical Systems Design method, for organisations whose users depend on it performing reliably under real conditions.

Reduced error risk is the outcome of redesigning the interface conditions that produce use-related error. In this evidence page, errors are treated as structural: they occur at specific interactions, in specific conditions, for specific reasons.

The documented outcome is not fewer errors because users receive more training. The documented outcome is fewer errors, or lower recovery cost, because required information, system state, warnings, confirmation steps, workflow constraints, and recovery paths are made more legible at the moment they matter.

Reduced error risk as a structural interface outcome

Reduced error risk means that an error-likely interaction has been identified analytically and redesigned so that the interface no longer creates the same conditions for error. Examples include a required value being surfaced during setup, a mode change being made visible, a warning being grounded in screen architecture, or a recovery path being provided when a physical process deviates.

The relevant distinction is between an error mechanism and an error consequence. The error mechanism is the structural interface condition that produces the error. The error consequence is what happens when the error occurs, including its reversibility and magnitude.

In regulated contexts, the target is acceptable residual risk rather than zero risk. IEC 62366-1 language describes this as use-related error and formative evaluation. Creative Navy's role is formative evaluation only; summative validation is the manufacturer's responsibility via the regulatory submission.

Error categories that require different design responses

Selection errors occur when the user chooses the wrong option. Selection errors are produced by insufficient visual differentiation between options, misleading labelling, or interface logic that groups unlike things.

Mode errors occur when the user acts in the wrong system state while believing the system is in a different mode. Mode errors are produced by mode changes that are not clearly communicated, or by layouts that look identical across modes with different consequences.

Omission errors occur when the user misses a required step. Omission errors are produced by required steps that are not visible in context, incomplete inputs that are not flagged before they matter, or workflows that allow progression without required completion.

Misinterpretation errors occur when the user acts on incorrectly understood information. Misinterpretation errors are produced by ambiguous state communication, insufficient visual hierarchy, single-channel cues that fail under operating conditions, or warnings that appear without contextual grounding.

Precautionary over-intervention is a misinterpretation sub-pattern documented in the Gericke industrial HMI case. The operator reads the surface signal correctly but holds an incomplete model of system state, and under ambiguity takes an unnecessary protective action such as stopping or overriding healthy equipment. The cost appears as lost availability and unnecessary maintenance rather than as a single incident.

Process deviation errors are a Squaremind-introduced category for sequential physical processes without an external guide. The user deviates from a required physical sequence, and the interface must detect the deviation, communicate what happened, and provide recovery. This category is distinct from incorrect action in a digital workflow because the deviation occurs in the real-world sequence.

Gexcon evidence for configuration error reduction and recovery-cost reduction

In the Gexcon CFD simulation engagement, the documented error class was misinterpretation and omission in scenario configuration. The downstream consequence was high because a misconfigured simulation could produce a safety assessment that appeared valid while being incorrect.

Gexcon client-measured configuration errors per simulation falling from 5–8 to 1–2 across real deployment locations. Gexcon also client-measured corrective load per error falling from 4–6 hours to approximately 20 minutes across real deployments.

The documented mechanism was state visibility redesign combined with an explicit error-prevention layer in the interaction architecture. Required values were surfaced during setup. Incomplete and contradictory inputs were warned before run. Error messages specified what went wrong and what to do.

The Gexcon case is one of the strongest quantified examples on this page because it documents both error reduction and error recovery cost reduction in the same engagement, using real deployment evidence rather than usability testing conditions.

deSoutter Medical / Zethon evidence for mode error prevention under divided attention

In the deSoutter Medical / Zethon operating-theatre engagement, the documented error classes were mode errors and misinterpretation errors under divided attention. The operating theatre context involved divided attention, variable lighting, gloved hands, and brief glances.

Eight surgeons reported in structured design review sessions that device state verification was reduced to brief glance recognition. The previous interface required reading to interpret activation state, which was not an acceptable interaction profile when the surgeon's primary attention was on the patient.

The same structured design review sessions reported that speed and parameter adjustments no longer interrupted surgical workflow. The previous interface required attention that competed with the surgical task.

The documented mechanism was redundant non-colour cueing for critical states. Spatial position, icon form, and colour were used together, removing single-channel dependency on colour under variable theatre lighting. Critical indicator positions were spatially stable and did not change between screens.

The evidence is surgeon-reported from structured design review sessions during the engagement, not post-deployment operational measurement. IEC 62366-1 formative evaluation governed the engagement. Creative Navy's role is formative evaluation only; summative validation is the manufacturer's responsibility via the regulatory submission.

Kardion evidence for use-related hazard mitigation and FDA evaluation

In the Kardion MCS Controller engagement, specific error-likely interactions were identified through IEC 62366-1 use-related hazard analysis and addressed in design. The documented error classes were mode errors in a clinical device context, misinterpretation errors, and omission errors involving missed alarm states.

Flow rate adjustment had insufficient confirmation friction for a high-consequence action. The design response was a two-step rotary knob confirmation.

Min/max flow value interpretation had visual ambiguity in a prior Emergo by UL formative study with 7 participants. The design response was an unambiguous flow visualisation hierarchy.

Alarm state during mute carried the risk that alarm disappearance on mute would allow active alarms to be forgotten. The design response kept muted alarms visible at reduced prominence.

The design passed FDA evaluation as submitted, with no design changes required. This regulatory result is recorded as FDA approval in the case evidence and confirms that the submitted use-related hazard mitigation structure was accepted in that evaluation. Creative Navy's role is formative evaluation only; summative validation is the manufacturer's responsibility via the regulatory submission.

Beissbarth evidence for calibration measurement accuracy errors

In the Beissbarth automotive calibration engagement, the documented error class was measurement accuracy errors. These are readings taken under conditions below the confidence threshold, producing a certified vehicle that is not within the safety specification.

Beissbarth client-measured repeated measurements reducing across 8 production deployment locations. The direction of reduction is confirmed, but the exact frequency is not available for publication.

Beissbarth also client-measured calibration time falling from 18 to 12 minutes per vehicle across 8 production deployment locations. Part of that reduction reflects fewer repeated measurements required.

The documented mechanism was a three-level measurement result communication model: confirmed, borderline, and out of range. This replaced binary pass/fail communication. The design also made sequence state explicit, reducing omission errors in multi-step calibration procedures.

Triopsis evidence for operational omission and mode error reduction

In the Triopsis workforce management engagement, the documented error classes were omission errors and mode errors. Omission errors appeared as missed safety compliance steps. Mode errors appeared as scheduling conflicts that were not detected before they became live operational crises.

Triopsis client-reported operational data showed support ticket volume for "how can I" questions falling to approximately 5% of previous volume. Some portion of this reduction reflects fewer interface-induced errors requiring resolution.

The documented mechanism included predictive conflict indicators that surfaced future scheduling conflicts before they became crisis-mode errors requiring reactive correction. The field technician compliance component surfaced required safety steps in context, addressing omission errors that training alone cannot prevent.

Typewise evidence for selection error reduction in a controlled experiment

In the Typewise AI keyboard engagement, the documented error class was selection errors caused by mis-taps. The mechanism was key size and layout: a hexagonal key layout provided a larger key surface and reduced mis-tap probability.

The Typewise case provides the most methodologically clean error-rate measurement on this page. Error rates halved versus the iOS native keyboard baseline in a directly measured controlled experiment with 60 users.

This evidence has a defined baseline, a defined population, and a directly measured outcome. It is narrower than the industrial and medical examples because it concerns selection errors in keyboard input rather than multi-step operational risk.

Stromer evidence for warning architecture failure and longitudinal confirmation

In the Stromer e-bike embedded display engagement, the documented error class was misinterpretation errors produced by warning architecture failure. The previous screen layout and interaction logic had been established before warnings were added as overlays, so warnings had no native structural relationship to the screen states they occupied.

Before redesign, warnings covered content they should not cover, appeared without contextual grounding, and interfered with active interactions. This created misinterpretation errors and interference errors during riding.

In a structured 3-day riding test with 10 participants, before redesign, warnings accounted for approximately 30% of all issues rated as "issue needing user intervention". The test was Creative Navy-designed and run with real bikes, real routes, and a consistent severity-logging protocol.

After redesign, the same test method with 10 participants, including 6 returning participants and 4 replacements, recorded no warnings on the issues list at any severity level. A two-year longitudinal follow-up run by Creative Navy recorded warnings remaining absent from the issues list.

The documented mechanism was not a component-level warning redesign alone. Creative Navy established rules and principles governing how warnings, overlays, and interruptive elements relate to screen structure across all states, as architectural decisions before component design.

The pre-redesign safety consequence extended beyond warning interpretation. Average glance duration at the embedded display was 4.32 seconds, more than twice the 2-second threshold at which road safety research by Klauer et al. (2006), NHTSA Report No. DOT HS 810 594, identifies a doubling of near-crash/crash risk. The redesign reduced average glance duration to 1.89 seconds. The eye-tracking evidence basis was Creative Navy-recorded in real riding conditions with 5 participants.

Squaremind evidence for process deviation recovery in patient-operated scanning

In the Squaremind dermatology scanning device engagement, the documented error class was process deviation errors. Patient-operated scanning required users to follow a physical sequence without external guidance. Patients could not be prevented from moving incorrectly, so the interface had to detect deviations and provide a correction path.

Before redesign, the interface had no correction architecture. When a patient deviated from the expected sequence, the interface had nothing to offer. The session ended or required clinical intervention.

The pre-redesign baseline was a 14-patient Squaremind test that produced 2 completions and 0 recoveries among the 12 patients who deviated. This is client-reported background from Squaremind's own test before Creative Navy's involvement.

The design response introduced explicit error management at every step of the scan flow through the Inform–Prevent–Correct framework. The prevention layer delivered positioning guidance before the robot arm reached the relevant body zone. The correction layer specified what happened, how to return to the correct state, and how to re-engage the guidance cycle after recovery.

Post-redesign, 27 of 29 patients completed the scan independently. Twelve patients deviated during the flow, and all 12 recovered without external intervention. Recovery times were 2–4 minutes, timed to the second. The evidence basis was Creative Navy-recorded under an ecological protocol at two sites, age-stratified, and co-conducted by an independent dermatologist.

Creative Navy's role was formative evaluation only; summative validation and regulatory submission are Squaremind's responsibility.

UNICEF evidence for workflow-level omission and categorisation error reduction

In the UNICEF planning, approval, and reporting tool engagement, the documented error classes were omission errors and selection or categorisation errors. Defective submissions included missing information, incomplete approval chains, incorrect categorisation, missing supporting documentation, and inconsistencies between data fields.

The error mechanism was organisational rather than a single interaction. Seven roles across two organisational tiers held incompatible interpretations of what a correct submission required. A submission could be complete and correct from the producing role's frame and deficient from the receiving role's frame.

The prevention mechanism was structural and upstream. The design first established an agreed reporting standard across both tiers through the Sandbox Experiments prototyping process. That standard was then embedded into workflows, validation rules, information architecture, and interaction design.

The submission workflow also used an orientation step, priming questions, and an explicit revision-and-quality-check step before final submission. The revision step acted as a correction layer that caught omissions before the submission crossed the role boundary.

UNICEF client-measured compliance issues reducing 45% against a pre-established baseline, nine months post-rollout. Compliance issues are defective submissions requiring headquarters follow-up before acceptance. UNICEF also client-measured a parallel 42% reduction in headquarters report-preparation time as the downstream consequence of fewer defective submissions requiring correction.

The evidence calibration is important. UNICEF produced the measurements. Creative Navy helped identify which owned operational metrics were relevant. The causal account is analytically derived, with the client-measured compliance reduction as corroboration.

Gericke evidence for interpretation-failure errors in industrial HMI operation

In the Gericke industrial HMI engagement, Creative Navy built an operator-error taxonomy, OE01–OE20, as the analytical instrument. The taxonomy was a Creative Navy analytical synthesis derived from site observation, contextual interviews, stakeholder interviews, existing-system review, and incident and maintenance records. It was not a field instrument, and operators did not report errors using OE labels.

The documented error class was misinterpretation, with precautionary over-intervention as the dominant and most expensive variant. Operators read surface signals such as alarm lists and deviations correctly but held an incomplete model of process state. Under ambiguity, they stopped or overrode healthy equipment.

The structural mechanism was insufficient system transparency. The interface exposed symptoms but did not explain state. The documented design response included a live process mimic showing state on the diagram, graphical error visualisation highlighting failed components, and a root-cause alarm hierarchy that collapsed secondary alarms beneath the originating event and indicated probable cause.

Gericke client-measured operator-caused stoppages roughly halving across three deployment-and-research sites in a confirmed single-variable window: 3 to 1 per month, 7 to 3 per month, and 15 to 6 per month. The sites were described by type and geography as Swiss pharma, Italian food, and Swiss chemicals.

Gericke client-measured repeat alarms reducing from 42% to 18%, 58% to 28%, and 73% to 35%. Gericke also client-measured fault-diagnosis time falling from 24 to 8 minutes, 38 to 12 minutes, and 68 to 20 minutes.

The confirmed window was four months post-go-live with no hardware, sensor, mechanical, training, recipe, or process changes. The per-plant error frequencies were client-reported by plant managers from operational statistics, not telemetry. Gericke is not a regulated device; it operates in GMP environments where GAMP 5 is relevant, and the validation boundary is the manufacturer's.

eToro evidence for removing a misinterpretation mechanism without a direct error-rate measure

In the eToro multi-asset social trading engagement, the documented error class was misinterpretation at the point of financial commitment. The pre-redesign buy flow displayed profit alongside deposits, allowing users to misattribute gains and losses across the whole account rather than the specific position being opened.

The documented mechanism was exposure illegibility. Surface numbers were present and correct, but the interface allowed users to form the wrong understanding of what a trade meant for their portfolio, particularly around downside and relative position sizing.

The eToro A/B evidence did not measure an error rate directly. The client-measured randomised controlled A/B with a persistent holdout recorded conversion moving from 5.1% to 7.4% and time-to-trade moving from 11.8 to 8.6 minutes, with no increase in early-session drop-off and no reduction in exploration depth.

The error-reduction reading is analytically derived. The redesign removed a specific identified misinterpretation mechanism, and the behavioural result is consistent with reduced misinterpretation rather than simply increased trading. No error-rate figure is available for eToro.

The eToro case is not a regulated-device example. The relevant constraints are financial, including MiFID II financial promotion and SEC/FINRA fair balance. The engagement involved no AI.

Evidence boundaries across the reduced error risk cases

The evidence strength varies by case. Typewise has a directly measured controlled experiment with a defined baseline and 60 users. Gexcon has client-measured deployment evidence for both error count and corrective load. Stromer has Creative Navy-recorded structured riding tests and a two-year longitudinal follow-up. Gericke has client-measured operational metrics within a confirmed single-variable window.

Some evidence is formative or reported rather than operationally measured. deSoutter Medical / Zethon relies on surgeon-reported structured design review sessions, not post-deployment operational measurement. Kardion records use-related hazard mitigation and a submitted design passing FDA evaluation, but the work is formative and summative validation is the manufacturer's responsibility. Squaremind includes a client-reported pre-redesign baseline and Creative Navy-recorded post-redesign recovery evidence.

Some evidence is analytically derived. UNICEF's compliance reduction is client-measured, while the causal account of cross-role standard agreement and structural embedding is analytical. eToro's behaviour A/B evidence is client-measured, but error reduction is not directly measured as an error rate.

Evidence basis and calibration

This outcome is a claim about the kind of result Creative Navy's Critical Systems Design method produces, not a guaranteed effect. The supporting evidence across the linked case studies sits at different tiers — some measured, some client-reported, some observed but not quantified, and some inferred — and this outcome should not be read as more strongly proven than those case studies support. Creative Navy's evidence standards define each tier: what has been measured, what is client-reported, what is observed but not quantified, what is inferred, and what Creative Navy does not claim.