State And Transition Review

State And Transition Review in Creative Navy's Critical Systems Design method

Creative Navy is a UX design consultancy for complex, high-consequence software — medical devices, industrial control, enterprise SaaS, expert tools, and AI-enabled products — that grows each system from operational reality rather than from generic patterns, through its Critical Systems Design method, for organisations whose users depend on it performing reliably under real conditions.

Creative Navy applies state and transition review as one of the named practices within its Critical Systems Design method. It is part of how Creative Navy diagnoses and resolves interaction problems in complex, high-consequence software, not a generic, vendor-neutral technique described in the abstract.

Summary

State-and-transition review examines whether a complex system makes its operational states readable and whether transitions between those states preserve user understanding. The practice applies to nominal states, fault states, configuration modes, processing states, degraded modes, alarm states, and transitions between them.

The review distinguishes two failure categories. State visibility failures occur when users cannot accurately read the current state, such as when indicators require interpretation, status information is placed where users do not scan, or state changes are too subtle for users to notice. Transition failures occur when movement from one state to another disrupts clarity, such as when view changes move elements, mode changes are visually ambiguous, or loading and updating states make users uncertain whether the system is working or waiting for input.

State-and-transition review evaluates these issues under actual operating conditions rather than controlled viewing conditions. A state indicator that is readable on a desktop in good lighting may be unreadable on a helm display in rain, on a surgical instrument interface under variable theatre lighting, or on a calibration device read from two metres during movement.

What state-and-transition review does

State-and-transition review creates an inventory of system states and examines how each state is communicated to users. The state catalogue includes nominal operating states, degraded modes, fault states, configuration states, processing states, and alarm states. In complex systems, this catalogue is often larger than stakeholders expect because states may have been added incrementally without a unified state architecture.

State-and-transition review maps transitions between states. For each transition, the review identifies what triggers the transition, what visual change occurs, whether the user receives notification or must infer the change, and whether any element changes spatial position as part of the transition.

State-and-transition review also audits spatial consistency. Spatial memory enables glance readability, and any element that shifts position across a transition requires the user to relocate it rather than rely on learned position. In high-consequence contexts described in the engagement evidence, this is treated as a design failure with operational consequences rather than a minor inconvenience.

Mode changes are treated as high-risk transitions

State-and-transition review specifically identifies transitions that constitute mode changes. A mode change is a state change where the system's behaviour changes fundamentally, not only its display.

Mode changes are high-risk transitions because users who have not registered the change may interpret system behaviour incorrectly. In regulated medical device contexts, the practice is described as directly aligned with IEC 62366-1 requirements for mode change identification: mode changes must be clearly communicated, and foreseeable misuse arising from mode confusion must be addressed in the design.

Creative Navy's use of state-and-transition review evaluates significant states and transitions under the conditions of actual use. Those conditions include the visual environment, the user's attentional load, and physical constraints during operation.

When Creative Navy applies state-and-transition review

Creative Navy applies state-and-transition review during Sandbox Experiments when reviewing an existing system. In that setting, the review forms part of the evidence base for understanding what the system is doing before design decisions are made.

Creative Navy also applies state-and-transition review during Iterative System Building when reviewing proposed designs. In that setting, the review is applied to prototypes to identify state visibility failures and transition failures before the design is implemented.

The practice usually follows workflow analysis and task-criticality mapping, because those practices identify the tasks for which state visibility is most critical. State-and-transition review then informs alarm-and-warning evaluation, because alarms are a specific category of state transition, and edge-case-and-degraded-mode analysis, because fault states and degraded modes are identified through the review before being examined in detail.

Outputs of state-and-transition review

A state-and-transition review produces a state catalogue that records every significant system state. The catalogue covers nominal operating states, degraded modes, fault states, configuration states, processing states, and alarm states.

A state-and-transition review produces a transition map that records triggers, visual changes, notification behaviour, inference requirements, and spatial changes across state transitions. The transition map is used to identify where users may miss a change or misunderstand what the system is doing.

A state-and-transition review produces a spatial consistency audit. The audit checks whether any element changes position across view transitions and whether those shifts undermine learned spatial memory for critical state indicators.

A state-and-transition review produces mode change findings. These findings identify which transitions change system behaviour fundamentally and therefore require clear communication to prevent mode confusion.

A state-and-transition review produces operating condition findings. These findings record how state and transition communication performs in the actual visual, attentional, and physical conditions of use.

Evidence from Kardion MCS Controller

In the Kardion MCS Controller engagement, state-and-transition review produced the design standard that no element shifts position across any view transition. The source describes this as Creative Navy's own standard, above the IEC 62366-1 consistency requirement.

The clinical rationale identified in the review was that surgeons build spatial memory for critical state indicators during procedures and depend on that memory when rapid response is required. The standard view, alarm overlay, and parameter adjustment overlay were reviewed through every transition between these views. Creative Navy identified which element positions each user type relied upon, and any element that moved across a transition was redesigned or removed.

The documented regulatory outcome was FDA approval, with the submitted design passing evaluation as submitted and no design changes required. The source states that this outcome reflects in part a state architecture established from the start; it should not be read as a measured clinical outcome or as a standalone causal claim.

Evidence from deSoutter Medical / Zethon

In the deSoutter Medical / Zethon engagement, state-and-transition review examined mode change communication in an operating theatre context under divided attention. The review identified a primary failure across competitor devices: colour was used as the sole differentiator between states.

The engagement evidence records that 6 of 8 benchmarked competitor devices relied primarily on colour for critical state indicators. Variable theatre lighting made colour-only state communication unreliable. The resulting requirement was redundant cues using spatial position, icon form, and colour.

The review also identified activation state recognition as the highest-risk transition. This was the moment when the instrument moved from ready state to active use. The specified recognition standard was that the active state should be confirmable in a fraction of a second under divided attention, with gloved hands, and under variable lighting.

Evidence from Torqeedo maritime HMI

In the Torqeedo maritime HMI engagement, state-and-transition review identified a central design problem: propulsion motors, battery banks, and generators updated telemetry at different rates. Presenting those values without a synchronisation architecture made the display read as unstable during active vessel operation.

The review mapped sensor update cadences and identified transitions that created visual instability, including values changing at different moments and status appearing to flicker. The resulting requirement was a grid structure that synchronised competing cadences into a unified display rhythm, addressing transition instability rather than only managing its visible symptoms.

Evidence from Elsner Elektronik / Cala Touch KNX

In the Elsner Elektronik / Cala Touch KNX engagement, state-and-transition review examined three categories of state communication failure: sensor fault states, calibration drift states, and the relationship between animation timing and firmware update cycles.

The transition-level finding concerned firmware update cycles. Thermal values updated at a specific cycle, and animation timing had to align with those cycles so that visual state changes did not drift out of sync with actual system state. Without this alignment, the display could show a state that the system had already left, which the source describes as a transition failure visible under edge conditions rather than normal conditions.

Evidence from Cox Marine cluster displays

In the Cox Marine cluster displays engagement, state-and-transition review examined how fault state transitions communicated across multi-engine configurations. The finding was that making fault presence visible at the tile level was not sufficient when the design did not direct attention to the priority engine in a multi-engine fault condition.

The review treated a fault condition as a state and the move into that fault condition as a transition. The transition requirement was not only to change a colour, but to redirect the user's attention to the correct location. The dedicated fault-summary area and per-tile alarm state highlighting emerged from this review.

Evidence from Tetra/Prism property compliance

In the Tetra/Prism property compliance case, state-and-transition review identified a transition failure as the primary adoption barrier. When the mobile app launched, it entered a downloading state that downloaded the entire property portfolio and could last up to 10 minutes.

The downloading state looked visually similar to normal app loading, which meant users could not distinguish between loading and broken behaviour. The design response was property selection at launch, limiting download scope. The finding treated the issue as a transition communication failure rather than only a technical loading problem.

Boundaries and limits

State-and-transition review identifies and evaluates states, transitions, spatial consistency, mode changes, and operating-condition risks. It does not, by itself, replace alarm-and-warning evaluation; alarms are a specific category of state transition that require alarm-specific examination after the baseline state-and-transition review.

State-and-transition review identifies fault states and degraded modes, but those states are then examined in more detail through edge-case-and-degraded-mode analysis. The practice establishes the baseline state architecture and transition evidence rather than completing every downstream analysis.

The engagement evidence is case-specific. It documents how the practice produced requirements and design standards in named engagements, but it does not establish a universal failure rate across all complex systems.