Why safety demands retesting new flows in usability engineering

The project

I was the Senior Product Designer and Usability Engineer on Philips bedside patient monitoring. A new parameter, Respiration From Pleth (RFP), was being added. It's derived from the SpO₂ pleth signal, for adult and paediatric patients only.

Even though RFP comes from SpO₂, it brings new interface behaviour and new failure modes: a delay before the first value appears, a restriction for neonatal patients, and alarm limits that apply to the respiration parameter as a whole rather than to each source.

Why I separated the new flows

The SpO₂ scenarios already covered sensor selection, sensor application, cable connection, and numeric confirmation. If I'd repeated those steps for RFP, the new risks would have been harder to see. So the RFP scenarios only covered the safety-related behaviour specific to RFP, and they started once the sensor chain was already connected.

Treating the new behaviour as expected, not as a failure

Clinicians work through interruptions, alarm fatigue, and time pressure. If a delayed value or an aged value looks like a device failure, they'll treat it like one. So the scenarios explicitly treated the delay as expected behaviour, and the interface had to show delayed and aged values as known states.

Making the questions answerable

While drafting the scenarios, I wrote down the interface questions we had to answer before anyone could trust the scenarios or the uFMEA. I took them to the UI architect and subject-matter experts, and we focused on the behaviour a clinician could actually observe, leaving implementation details out of it.

What came out of it

I documented more than 14 scenarios covering how clinicians connect, use, and disconnect add-on devices at the bedside monitor. The decisions from the reviews fed into uFMEA, formal usability planning, and implementation review, so they didn't stay as ambiguous product notes. The scenarios identified risks around data loss, patient safety, and device management, but they don't claim to eliminate those risks on their own. That's what the testing is for.