What happened
The hospital's nurse call management server sends calls to a clinical messaging platform, which delivers them to staff handsets. The same path also carries plant alarms, including fire pump running alerts for engineering staff. One day the pages simply stopped arriving, nurse calls and fire pump alarms alike. Nothing raised an alarm. The nurse call system kept showing calls on the wards, the management server kept logging each page as sent, and the network connection between the two systems stayed up.
How it was found
- Check each link, not just the ends. The management server was running, and its log showed every page being generated. But that log is written before each page is sent, so it proved the page was attempted, not delivered.
- Check the connection itself. The connection to the messaging platform was open, with nothing waiting to be sent: every page was leaving the server and reaching the messaging platform's host.
- Reproduce it off-line. We ran the management server's own output code against a test receiver on an isolated bench network. It showed exactly what goes on the wire, and that a broken or silent receiver does not stop it reporting success.
- Watch the receiving end live. With the messaging team watching their input during a test call, the page arrived but went no further. The fault was inside the messaging platform.
The messaging platform was restarted and pages reached the phones again the same afternoon.
What it shows
No single part was badly built. The problem is that each link in the chain sends and assumes. The sender doesn't confirm the receiver accepted the page, so a receiver that quietly stops passing pages on looks exactly like a healthy one. Everyone's own system is green, and the only alarm is a nurse wondering why the phone never rang, or a fire pump running with nobody told.
What Paging Link changes
Every page confirmed, every failure noticed
- Every page must be acknowledged by the messaging platform. A refused or unanswered page is resent, and a page that still is not accepted raises a fault within seconds.
- A heartbeat page to its own pager ID proves the whole path end to end every minute, so a platform that stops passing pages shows as a fault even when no calls are happening.
- A fresh session for every page, so a restart at the other end can't leave it stuck on a dead connection.
Paging Link PL-01 → The engineering: TAP vs MQTT, and what confirmed delivery means →
A note on this case study
The hospital, the systems and the vendors involved are not named. The diagnosis described here was carried out on the hospital's existing paging; Paging Link was not installed at the time. Its first hospital trial is next.