Safety Kernel & Command Envelopes

The safety kernel is the guarded path that delivers a command to equipment after clinician authorisation.

Command classification

Safety kernel command classification The compute core's result enters the safety kernel and receives a class. Three clinician-acknowledgement states are grouped in a dashed box: a green command needs no clinician involvement and goes straight to the device; a yellow command runs a timeout with accept or reject and, if accepted, is written to the device; a red command requires explicit clinical acknowledgement and is also written to the device. Any device write produces a full audit trail as a FHIR AuditEvent. COMMAND CLASSIFICATION Compute coreresult Safety Kernel Green (safe) Yellow (supervised) Red (high-risk) CLINICIAN ACKNOWLEDGEMENT Clinician involved(not required) Timeout→ accept/reject Explicit clinicalacknowledgement Device write Full audit trail(FHIR AuditEvent)
Compute core result → safety kernel → green/yellow/red class → clinician acknowledgement (green needs none, yellow times out, red needs explicit acknowledgement) → device write → full audit trail.
  • Green — the command is sent to the equipment without clinician authorisation.
  • Yellow — commands with a pre-validated clinical context. The action executes by default; it can be cancelled within a set window (timeout).
  • Red — high-risk commands or irreversible changes to equipment settings. They require explicit clinical acknowledgement from the clinician.

Seven checks before command execution

Before writing any command to the equipment, the safety kernel evaluates:

  1. Rule provenance — compiled bundle is approved and release-bound
  2. Device identity — target device matches the rule’s device specification
  3. Parameter envelope — proposed value is within validated clinical range
  4. State coherence — device state matches the assumed pre-condition
  5. Conflict check — no contradictory command in flight for the same device
  6. Audit slot — audit record can be written (fail-safe)
  7. Clinician authorisation — the clinician’s account is authorised for this command class (red and yellow commands)

Failure of any check cancels the command, the failure reason is logged, and the clinical team is notified.

Fail-safe defaults

  • If the clinician neither confirms nor cancels a yellow command within the timeout: the command executes under the clinical envelope’s rules; it can be cancelled within the set window.
  • If the audit log is unavailable: all write-path commands are suspended; advisory mode only.
  • If the compiled bundle fails integrity check at startup: the system halts and alerts the clinician.

Audit requirements

Every command event — proposed, accepted, rejected, timed out, cancelled — is recorded as durable audit material and can be projected as a FHIR AuditEvent resource through the clinical-data facade. Minimum retention follows the deploying institution’s clinical records policy.

Documents

HealthOS ICU: Full Concept → · Safety Kernel and Device-Control Commands →

Discuss a phased rollout at your institution or integrating your equipment. Contact the team →