Commissioning & service mode
The screens nobody designs. They are used a handful of times per device by someone who is not a clinician, they are where every deployment-wide setting is decided, and a mistake made here is inherited silently by every patient the device sees afterwards.
A device in service mode is not available for clinical use, and says so where a clinician would look — on the device, not in the service application. Anything else produces a machine that appears to be watching a patient and is not.
And: commissioning decisions are recorded as decisions — who, when, what value, and what it was before. A configuration with no history cannot be investigated after an incident, which is exactly when someone will try.
Why these screens are dangerous
Safety configuration covers changing an alarm rule for a ward: the blast radius argument, the two-person rule, the effective-from date. This page is the surrounding activity — installing the device, calibrating it, taking it out of service, giving it back.
Four properties make it its own problem:
- The user is not the intended user. A biomedical engineer or a field technician, whose training is in the device rather than in the clinical work. Every assumption this system makes elsewhere — that the reader can judge whether an output is plausible for this patient — is void here.
- It happens rarely, so nothing is remembered. A screen used four times in a device's life is a screen used by someone who has never seen it before, every time.
- Errors are silent and delayed. A wrong calibration constant does not announce itself; it produces plausible numbers that are wrong, for months, for everybody.
- It usually happens with the device in situ. On a ward, beside patients, under time pressure from staff who want the machine back.
Out of service has to be visible from the bedside
The single most consequential failure here: a device that is being worked on but still looks like a device that is working. A monitor showing a frozen trace, a screen that has not updated in twenty minutes, an application in a service view that resembles its clinical one.
- The clinical surface states the state, in words, unambiguously — "Not monitoring. This device is in service." Not a small badge, not a colour, not an icon.
- No stale clinical data remains on screen. A last-known value is worse than a blank, because it is indistinguishable from a current one. The Key–value pair rule applies at the scale of a whole device.
- Alarms are off and that is stated, with what is covering the patient instead. "Alarms are not active on this device" is the sentence that has to be on the screen, because the ward's mental model is that the machine is watching.
- Entering service mode requires confirming the patient is covered. Not a checkbox in a service tool — a step that names what the technician is about to switch off.
- Leaving service mode is explicit and verified. A device does not drift back into clinical use because a session timed out.
Calibration
A calibration is a measurement of the device, and it inherits everything this system says about measurements — including that its provenance and its age are part of its meaning.
| Element | Rule |
|---|---|
| The reference | Named, with its own identifier and its own calibration date. A calibration against an uncalibrated reference is a number with no meaning, and the interface should not accept one silently. |
| Before and after | Both recorded. "As found" and "as left" are different facts, and the drift between them is the only evidence of how far the device had wandered — which is what decides whether earlier results are in doubt. |
| Who | A named person with a recorded competence, not an account shared by a department. |
| Expiry | Stated as a date, visible on the clinical surface, not only in a service log. A device past calibration says so where a clinician can see it. |
| Failure | A calibration that fails leaves the device out of service. It never leaves it in the previous state, because the previous state is now known to be untrustworthy. |
| Retrospective effect | If the as-found value is out of tolerance, the interface says which period of results is affected. Somebody has to decide whether to recall them, and they cannot decide without the dates. |
That last row is the one most often missing and the one with patients attached to it. A device found to be reading 8 % high has been reading 8 % high for some interval, and the only question that matters is which one.
Commissioning is where identity is set
Most of what Regulatory labelling & UDI and Device identification display is decided here, and a mistake becomes a permanent property of every record the device writes.
- Location, bed, ward and time zone are set explicitly and never inferred from a network. A device that moved between wards and inferred its location wrote the wrong one into a record that outlives the move.
- The clock is set from a stated source and its drift is monitored. Everything in Clinical timeline and Date & time picker rests on this, and a device with a wrong clock corrupts sequence rather than values — which is far harder to notice.
- Patient population and care setting are chosen, not defaulted. Adult and neonatal alarm limits are different by orders of magnitude, and a default that happens to be adult is a hazard on a neonatal unit. The choice is confirmed on the clinical surface afterwards, per Safety configuration.
- The commissioning record is exportable and survives the service tool. It is evidence for the deployment as a whole and will be asked for by people who have no access to your application.
Who may do this
- Service access is a distinct authority, not an elevated clinical one. A senior clinician does not acquire the ability to change a calibration constant by being senior, and a technician does not acquire access to patient data by being able to service the device.
- The service session is bounded and announced, exactly as break-glass is in Sign in & sign out — visible on screen, time-boxed, and logged with a reason.
- No default credentials, ever, and no shared department account. A commissioning record naming "Service" as the person is a record with no accountability in it.
- Remote service is service. Every rule here applies when the technician is not in the building, plus one more: the ward is told it is happening, because a device behaving oddly under remote maintenance otherwise looks like a device that is faulty.
States
| State | Rendering |
|---|---|
| Uncommissioned | Refuses clinical use and says what is missing — population not set, clock not set, not calibrated. A partly commissioned device is not a usable one. |
| In service / out of clinical use | Stated on the clinical surface in words, no stale data, alarms off and declared. |
| Calibration due | Stated on the clinical surface with the date, well before it expires. Advisory, not an alarm — the condition is about the device, not the patient. |
| Calibration expired | Out of clinical use. Results are not produced with a warning attached; they are not produced. |
| Calibration failed | Out of service, with the as-found value and the affected period stated so somebody can decide about earlier results. |
| Remote session active | Visible on the device and to the ward, with who and why, for the whole session. |
| Returned to clinical use | An explicit act by a named person, with the configuration in force shown for confirmation — never a silent transition on timeout. |
Who holds each rule
Commissioning and service mode are the states a device is in when it is not being a device. Almost nothing about them is a component; two things about what the screen says are.
| Rule | Held by | Where |
|---|---|---|
| The clinical surface states the state | Masthead | A non-production environment renders as words on every screen. Service mode is one you pass, and it cannot be styled into invisibility. Asserted: Masthead: a non-production environment announces itself in words |
| Alarms are off and that is stated | Alert banner | A technical condition is marked as technical, so “alarms suspended for service” cannot be mistaken for a patient state. Asserted: AlertBanner: a technical condition says so in words |
| Entering service mode requires confirming the patient is covered | Dialog | A confirmation with a way out. The question it asks is yours. Asserted: Dialog: cancel precedes confirm in reading order |
| The user is not the intended user; it happens rarely, so nothing is remembered | The implementer | Facts about the context of use, from which the rest follow. |
| Errors are silent and delayed | The implementer | A property of commissioning errors, and the reason the checks below exist. |
| No stale clinical data remains on screen | The implementer | Clearing state on mode entry is your application’s. The pending-value rule about patient switch is the same rule in a smaller frame. |
| Leaving service mode is explicit and verified | The implementer | State machine. |
| Location, bed, ward and time zone are set explicitly; the clock is set from a stated source | The implementer | Configuration entry. The Date & time picker requires a zone when it renders one; it cannot make you set the device’s. |
A pattern page has no component underneath it, so a rule stated here is held by whoever builds against it unless a component already holds it. Of these 8 rules, 3 are held by a component this package ships, and 5 are the implementer’s. Three held, five not. The two that are held are both about the screen admitting what mode it is in, which is the part a person arriving at the bedside needs.
Do's and don'ts
Not monitoring. This device is in service. Alarms are not active.
On the clinical surface, in words, where a nurse walking past reads it without touching anything.
The last trace, frozen, with a small "service" chip in the corner.
Looks exactly like a working monitor showing a stable patient. The chip is read by nobody, because nobody is looking for it.
As found +8.1 % · as left
+0.2 %
Out of tolerance. Results between 14 Mar and
today may be affected.
The drift, and the interval it applies to. Somebody can now decide about earlier results — which is the only reason the as-found value is worth recording.
Calibration complete.
The device is right now and was wrong for an unknown period. The record of how wrong, and since when, has just been discarded.
Patient population: Neonatal — confirmed by J. Park, 14 Mar. Alarm limits shown below.
Chosen, attributed, and confirmed on the clinical surface where the unit using it can see what it was set to.
Patient population: Adult (default)
A default is a decision nobody made. On a neonatal unit the alarm limits are wrong by orders of magnitude and nothing on the ward will say so.
Remote service session · M. Idris · started 09:14 · ward notified
Visible on the device and to the people standing next to it, for the whole session.
Nothing. The session is in the service portal's log.
To the ward the device is simply behaving strangely, which they will report as a fault and troubleshoot against a machine somebody is inside.
Accessibility
- The out-of-service statement is a live region announced on entry, so a screen-reader user does not have to hunt for why nothing is updating.
- Service state is never carried by colour or a chip alone — SC 1.4.1. It is a sentence in the main content, in the same place the clinical summary would be.
- No time limits on a service task — SC 2.2.1. A calibration interrupted by a session timeout is a calibration half-done on a live device.
- Values are typed as well as stepped, with units always visible, per Numeric input. Calibration constants are long and precise and nobody should be nudging them with arrows.
- Works in gloves on a cart, per Touch & gestures. Service happens at the bedside far more often than in a workshop.
- Every confirmation is readable without the device's own display where the service tool is separate — the technician may be looking at a laptop while the device faces the wall.
Outcomes of use
What this contributes to, in the terms of Usability & context of use. These are attributes believed to contribute to an outcome; the outcome itself is settled by observing real use in a specified context, not by this page.
- Effectiveness — the device is configured as intended, and everyone around it knows whether it is watching a patient. Both failures here are quiet and both scale to every patient the device sees.
- Efficiency — a screen used four times in a device's lifetime is used by a beginner every time, so it is designed for a first encounter rather than for a practised one. That is slower for the rare expert and correct for everyone else.
- Satisfaction — mostly the ward's. A device that announces its own state stops generating fault reports about maintenance somebody is currently performing.
Clinical safety notes
Trace these in your risk file (ISO 14971) and usability engineering file (IEC 62366-1). Note that the service technician is a user under IEC 62366-1 and belongs in the use specification alongside the clinician — a frequent omission. Each bullet says what checks it: a component that holds the rule, a test in your verification file, deployment configuration, post-market surveillance, or a design review where no test can see it. A control checked by nothing is a sentence.
- Out-of-service state is stated on the clinical surface, in words. (held by Masthead) Mitigates: a device that appears to be monitoring and is not.
- No stale clinical data during service. (a test in your verification file) Mitigates: a last-known value read as current.
- Alarms-off is declared, with what covers the patient instead. (held by Alert banner) Mitigates: a gap in monitoring nobody knew existed.
- As-found and as-left are both recorded, with the affected period. (a test in your verification file) Mitigates: results produced by a drifted device that nobody knows to review.
- A failed or expired calibration takes the device out of clinical use. (a test in your verification file) Mitigates: plausible numbers from an untrustworthy instrument.
- Population and care setting are chosen, never defaulted. (a test in your verification file) Mitigates: adult alarm limits on a neonatal unit.
- Location and clock are set explicitly, never inferred. (a test in your verification file) Mitigates: corrupted sequence in the record, which is harder to detect than a corrupted value.
- Service authority is distinct from clinical authority, with no shared or default credentials. (deployment configuration) Mitigates: unattributable configuration changes.
- Return to clinical use is an explicit, attributed act. (a test in your verification file) Mitigates: a device drifting back into service on a timeout, in an unverified configuration.
Related
- Safety configuration — changing a rule for a ward, and the blast radius that makes it a design problem.
- Regulatory labelling & UDI — the identity commissioning sets.
- Key–value pair — not-measured versus measured, applied here to a whole device.
- Sign in & sign out — the bounded, announced, audited session this borrows its shape from.
- Auditory alarms — the environmental volume floor, which is a commissioning decision.
- Clinical timeline — what a wrong device clock does to a record downstream.