Nof S.Y. Springer Handbook of Automation

Подождите немного. Документ загружается.

Safety Warnings for Automation 39.1 Warning Roles 675

Stage 1

Automation

Information

acquisition

Perception of

elements

Psychological

process

Situation

awareness

Sensation,

perception,

attention

Stage 2

Information

analysis

Comprehension

of situation

Projection of

future status

Cognition,

working memory

Stage 3

Decision

selection

Cognition,

decision making

Stage 4

Action

implementation

Response

execution

Fig. 39.5 Stages of automation [39.13] and the corresponding psychological processes and level of situation aware-

ness [39.12](afterHorrey et al. [39.14])

tomation in this stage acts to support human sensory

and attentional processes (e.g., detection of input data).

A high level of automation at this stage may ﬁlter out

all information deemed to be irrelevant or less critical

to the current task, presenting only the most critical in-

formation to the operator. Thus, only relevant cues and

reports (at least those deemed relevant by the system)

would pass through the ﬁlters, allowing operators the

capacity to make more effective decisions, especially

when under time duress. Systems using a lower level

of automation, on the other hand, may present all of the

available input data but guide attention to what the au-

tomation infers to be the most relevant features (e.g.,

target cueing; information highlighting).

There has been extensive research into the effects

of stage 1 automation (attention guidance) in target

detection tasks. Basic research has reliably demon-

strated the capacity for visual cues to reduce search

times in target search tasks [39.15]. Applied research

has also demonstrated these beneﬁts in military situa-

tions [39.16, 17], helicopter hazard detection [39.18],

aviation and air-trafﬁc control [39.6, 19], and a num-

ber of other domains. These generally positive results

support the potential value of stage 1 automation in

applications where operators can receive an excessive

number of warnings. Example applications might ﬁlter

the warnings in terms of urgency or limit the warnings

to relevant subsystems.

Stage 2: Information Analysis

Information analysis involves higher cognitive func-

tions such as working memory, information integration,

and cognitive inference. Automation at stage 2 may

help operators by integrating the raw data, drawing in-

ferences, and/or generating predictions. In this stage,

lower levels of automation may extrapolate current

information and predict future status (e.g., cockpit pre-

dictor displays [39.20]). Higher levels of automation at

this stage may reduce information from a number of

sources into a single hypothesis regarding the state of

the world; for example, collisionwarning systems in au-

tomobiles will use information regarding the speed of

the vehicle ahead, the intervehicle separation, and the

driver’s own velocity (among other potential informa-

tion) to indicate to the driver when a forward collision

is likely [39.21–24]. In general, operators are quicker to

respond to the relevant event when provided with these

alerts. Studies of automated alerts have been performed

in many different domains, including aviation [39.25],

process control [39.26], unmanned aerial vehicle opera-

tion [39.27], medicine [39.28], air-trafﬁc control [39.6],

and battleﬁeld operations [39.14].

Stage 3: Decision Selection

The third stage involves the selection, from among

many alternatives, of the appropriate decision or action.

This will typically follow from some form of informa-

Part D 39.1

676 Part D Automation Design: Theory and Methods for Integration

tion integration performed at stage 2. Lower levels of

stage 3 automation may provide users with a complete

set (or subset) of alternatives from which the operator

will select which one to execute (whethercorrect or no).

Higher levels may only present the optimal decision

or action or may automatically select the appropriate

course of action. At this stage the automation will uti-

lize implicit or explicit assumptions about the costs and

beneﬁts of different decision outcomes;for example, the

ground proximitywarning systemin aviation – a system

designed to help avoid aircraft–ground collisions – will

recommend a single maneuver to pilots when a given

threshold is exceeded (pull up).

Stage 4: Action Implementation

Finally, automation in the fourth stage aids the user

in the execution of the selected action. A low level

of automation may simply provide assistance in the

execution of the action (e.g., power steering). High

levels of automation at this stage may take con-

trol from the operator; for example, adaptive cruise

control (ACC) systems in automobiles will automat-

ically adjust the vehicle’s headway by speeding up

or slowing down in order to maintain the desired

separation.

In general, one of the ironies of automation is

that those systems that incorporate higher stages of

automation tend to yield the greatest performance

in normal situations; however, these also tend to

come with the greatest costs in off-normal situa-

tions, where the automated response to the situa-

tion is inappropriate or erroneous [39.29]. We will

discuss the issue of automation failure in a later

section.

39.2 Types of Warnings

Warning systems serve many functions. Typically, they

provide the user/operator with information on the sta-

tus of the system. This information source aids the

user in maintaining situational awareness, and does

not necessarily require that speciﬁc action be taken

(stage 2 automation). Alternatively, other warning sys-

tems signal the user that a speciﬁc response needs to

be made at a speciﬁc time in order to reduce associ-

ated risks (stage 3 automation). Below, we will review

the different methods and modes of presenting warn-

ing information that can be used to accomplish these

goals.

39.2.1 Static Versus Dynamic Warnings

Perhaps the most familiar types of warnings are the

visually based signs and labels that we encounter ev-

eryday whether on the road (e.g., slippery when wet),

in the workplace (industrial warnings such as entan-

glement hazard – keep clear of moving gears), or on

consumer products (e.g., do not take this medication if

you might be pregnant). These signs and labels indicate

the presence of a hazard and may also indicate required

or prohibited actions to reduce the associated risk, as

well as the potential consequences of failing to comply

with the warning. This type of warning is static in the

sense that its status does not change over time [39.30].

However, as noted by Lehto [39.31], even these static

displays have a dynamic component in that they are no-

ticed at particular points in time. In order to increase the

likelihood that a static warning, such as a sign or label,

is received (i. e., noticed, perceived, and understood) by

the user at the appropriate moment, it should be phys-

ically as well as temporally placed such that using the

product requires interaction with the label prior to the

introduction of the hazard to the situation; for example,

Duffy et al.[39.32] examined the effectiveness of a label

on an extension cord which stated: “Warning. Electric

shock and ﬁre.Do not plugmore thantwo itemsinto this

cord.” Interactive labels in which the label was afﬁxed

to the outlet cover on the female receptacle were found

to produce greater compliance than a no-label control

condition, and a tag condition in which the warning la-

bel was attached to the extension cord 5 cm above the

female receptacle. Other studies [39.33,34] have found

that a warning that interrupts a user’s script for inter-

acting with a product increases compliance. A script

consists of a series of temporally ordered actions or

events which are typical of a user’s interactions with

a class of objects [39.35].

Additionally, varying the warning’s physical charac-

teristics can also increase its conspicuity or noticeabil-

ity [39.36]; for example, larger objects are more likely

to capture attention than smaller objects. Brightness and

contrast are also important in determining whether an

object is discernible from a background. As a speciﬁc

form of contrast, highlighting can be used to emphasize

differentportions of a warninglabel or sign [39.37]. Ad-

Part D 39.2

Safety Warnings for Automation 39.2 Types of Warnings 677

Table 39.1 Contrast between the fundamental properties of visual, auditory, and haptic modalities of information pro-

cessing (after Sanderson [39.38])

VisualAuditory Haptic

Persistent – signal typically Transitory – signal happens Transitory – signal happens in time

persistent in time so that in time and recedes into past: and recedes into past: creating

information about past has same creating persistent information persistent information or information

sensory status as information or information about past about past are design challenges

about present are design challenges

Localized – can be sensed only Ubiquitous – can be sensed Personal – can be sensed only

from speciﬁc locations such as from any location unless by the person whom the display

monitors or other projections technology is used to create is directed (unless network

(eyeballs needed) localized qualities or shared)

Optional – there are proximal Obligatory – there are no Obligatory – there are no proximal

physical means for completely proximal physical means for physical means for completely

eliminating signal (eyeballs, completely eliminating signal eliminating signal (unless remove

eyelids, turn) (unless earplugs block signal) device)

Moderately socially inclusive – Socially inclusive – others Not socially inclusive – others

others aware of signal but need always receive signal unless probably unaware of signal

not look at screen signal is sent only to

an earpiece

Sampling-based monitoring – Peripheral monitoring – Interrupt-based monitoring –

temporal sampling process temporal properties of process monitoring based on interrupts

needed for coverage of all locked into temporal properties

needed variables of display

High information density – Moderate information Low information density –few

many variables and relationships density – several variables variables and relationships can be

can be simultaneously presented and relationships can be simultaneously presented

simultaneously presented

ditionally, lighting conditions inﬂuence detectability of

signs and labels (i.e., reduced contrast).

In contrast to static warnings, dynamic warning

systems produce different messages or alerts based

on input received from a sensing system – therefore,

they indicate the presence of a hazard that is not nor-

mally present [39.30,39]. Environmental variables are

monitored by a sensor, and an alert is produced if

the monitored variables exceed some threshold. The

threshold can be changed based on the criticality of

potential consequences – the more trivial the conse-

quences, the higher the threshold and, for more serious

consequences, the threshold would be set lower so as

reduce the likelihood of missing the critical event. How-

ever, the greater the system’s sensitivity, the greater the

likelihood that an alert will be generated when there is

no hazard present. Ideally, an alert should always be

produced when there is a hazard present, but never be

produced in the absence of a hazard. Implications of

system departures from this ideal will be discussed later

in this chapter.

The remainder of this chapter will focus on the

implementation and functioning of dynamic warning

systems. These warnings serve to alert users to the

presence of a hazard and its associated risks. Ac-

cordingly, they must readily capture attention and be

easily/quickly understood. The ability of the warn-

ing to capture attention is especially important in the

case of complex systems, in which an abundance of

available information may overload the operator’s lim-

Part D 39.2

678 Part D Automation Design: Theory and Methods for Integration

ited attentional resources. When designing a warning

system, it is critical to take into account the con-

text in which the warning will appear; for example,

in a noisy construction environment, in which work-

ers may be wearing hearing protection, an auditory

warning is not likely to be effective. Whatever the

context, the warning should be designed to stand out

against any background information (i.e., visual clut-

ter, ambient noise). Sanderson [39.38] has provided

a taxonomy/terminology for thinking about sensory

modality in terms of whether information is persistent

in time; whether information delivery is localized, ubiq-

uitous, or personal; whether sensing the information

is optional or obligatory; whether the information is

socially inclusive; whether monitoring occurs through

sampling, peripheral awareness, or is interrupt based;

and information density (Table 39.1). Next, advantages

and disadvantages of different modes of warning pre-

sentation will be discussed in related terms.

39.2.2 Warning Sensory Modality

Visual Warnings

The primary challenge in using visual warnings is that

the user/operator needs to be looking at a speciﬁc lo-

cation in order to be alerted, or the warning needs to

be sufﬁciently salient to cause the operator to reorient

their focus towards the warning. As discussed earlier in

the section on static warnings, the conspicuity of visu-

ally based signals can be maximized by increasing size,

brightness, and contrast [39.36]. Additionally, ﬂashing

lights attract attention better than continuous indicator-

type lights (e.g., trafﬁc signals incorporating a ﬂashing

light intothe red phase) [39.36]. Sinceﬂash rates should

not be greater than the critical ﬂicker fusion frequency

(≈ 24Hz; resulting in the perception of a continuous

light), or so slow that the on time might be missed,

Sanders and McCormick [39.40] recommend ﬂash rates

of around 10Hz.

Auditory Warnings

Auditory stimuli have a naturally alerting quality and,

unlike visual warnings, the user/operator does not

have to be oriented towards an auditory warning in

order to be alerted, that is, auditory warnings are

omnidirectional (or ubiquitous in Sanderson’s terminol-

ogy) [39.41, 42]. Additionally, localization is possible

based on cues provided by the difference in time and

intensity of the sound waves arriving at the two ears.

To maximize the likelihood that the auditory warning

is effective, the signal should be within the range of

about 800–5000Hz (the human auditory systemis most

sensitive to frequencies within this range – frequencies

contained in speech; e.g., Coren and Ward [39.43]) –

and should have a tonal quality that is distinct from that

of expected environmental sounds – to help reduce the

possibility that it will be masked by those sounds (see

Edworthy and Hellier [39.44] for an in-depth discussion

of auditory warning signals).

Verbal Versus Nonverbal

Any auditory stimulus, from a simple tone to speech,

can serve as an alert as long as it easilyattracts attention.

However, the human auditory system is most sensitive

to sound frequencies contained within human speech.

Speech warnings have the further advantage of being

composed of signals (i.e., words) which have already

been well learned by the user/operator. There is a re-

dundancy in the speech signal such that, if part of the

signal is lost, it can be ﬁlled in based on the context pro-

vided by the remaining sounds [39.45, 46]. However,

since speech is a temporally based code that unfolds

over time, it is only physically available for a very lim-

ited duration. Therefore, earlier portions of a warning

message must be held in working memory while the re-

mainder of the message continues to be processed. As

a result, working memory may become overloaded and

portions of the warning message may be lost. With vi-

sually based verbal warnings, on the other hand, there is

the option of returning to,and rereading,earlier portions

of the warning; that is, they persist over time. However,

since the eyes must be directed towards the warning

source, the placement of visually based warnings is

critical so as to minimize the loss of other potentially

critical information (i. e., such that other signals can be

processed in peripheral vision).

While verbal signals have the obvious advan-

tage that their meaning is already established, speech

warnings require the use of recorded, digitized, or

synthesized speech which will be produced within

a noisy background – therefore, intelligibility is a ma-

jor issue [39.44]. Additionally, as indicated earlier, the

speech signal unfolds over time and may take longer

to produce/receive than a simpler nonverbal warning

signal. However, nonverbal signals must somehow en-

code the urgency of the situation – that is, how quickly

a response is required by the user/operator. Extensive

research in the auditory domain indicates that higher-

frequency sounds have a higher perceived urgency than

lower-frequency sounds, that increasing the modula-

tion of the amplitude or frequency of a pulse decreases

urgency, that increases in number of harmonics in-

Part D 39.2

Safety Warnings for Automation 39.2 Types of Warnings 679

creases perceived urgency, and that spectral shape also

impacts perceived urgency [39.44, 47, 48]. Edworthy

et al. [39.48] found that faster, more repetitive bursts

are judged to be more urgent; regular rhythms are per-

ceived as more urgent than syncopated rhythms; bursts

that are speeded up are perceived as more urgent than

those that stay the same or slow down; and the larger

the difference between the highest and lowest pitched

pulse in a burst, the higher the perceived urgency.

Haptic/Tactile Warnings

While the visual and auditory channels are most of-

ten used to present warnings, haptic or tactile warnings

are also sometimes employed; for example, the im-

proper maneuvering of a jet will cause tactile vibrations

to be delivered through the pilot’s control stick – this

alert serves to signal the need to reorient the con-

trol. In the domain of vehicle collision warnings, Lee

et al. [39.49] examined driver preferences for auditory

or haptic warning systems as supplements to a visual

warning system. Visual warnings were presented on

a head-down display in conjunction with either an au-

ditory warning or a haptic warning, in the form of

a vibrating seat. Preference data indicated that drivers

found auditory warnings to be more annoying and that

they would be more likely to purchase a haptic warning

system.

In the domainof patient monitoring,Ng et al.[39.50]

reported that a vibrotactile wristband results in a higher

identiﬁcation rate for heart rate alarms than does an

auditory display. In Sanderson’s [39.38] terminology,

a haptic alert is discrete, transitory, has low preci-

sion, has obligatory properties, and allows the visual

and auditory modalities to continue to monitor other

information sources. Therefore, patient monitoring rep-

resents a good use of haptic alarms.

Another example of a tactile or haptic warning,

though not technologically based, is the use of rum-

ble strips on the side of the highway. When a vehicle

crosses these strips,vibration and noiseis createdwithin

the vehicle. Some studies have reported that the instal-

lation of these strips reduced drift-off road accidents by

about 70% [39.51]. A similar application is the tactile

ground surface indicators that have become more com-

mon as a result of the Americans with Disabilities Act

(ADA). These surfacesare composedof truncated cones

which provide a distinctivepattern which can be felt un-

derfoot or through use of a cane. It is intended to alert

individuals with visual impairments of hazards associ-

ated with blending pedestrian and vehicular trafﬁc (i.e.,

on curb ramps on the approach to the street surface).

Multimodal Warnings

For the most part, we have focused our discussion on

the use of individual sensory channels for the presenta-

tion of automated warnings. However, research suggests

that multimodal presentation results in signiﬁcantly

improved warning processing. Selcon et al. [39.52]ex-

amined multimodal cockpit warnings. These warnings

must convey the nature of the problem to the pilot as

quickly as possible so that immediate action can be

taken. The warnings studied were visual (presented us-

ing pictorials), auditory (presented by voice), or both

(incorporating visual and auditory components) and

described real aircraft warning (high priority/threat)

and caution (low priority/threat) situations. Participants

were asked to classify each situation as either warn-

ing or caution and then to rate the threat associated

with it. Response times were measured. Depth of un-

derstanding was assessed using a measure of situational

awareness [39.53, 54]. Performance was faster in the

condition incorporating both visual and auditory com-

ponents (1.55s) than in the visual (1.74s) and auditory

(3.77s) conditions and there was some indication that

this condition was less demanding and resulted in im-

proved depth of understanding as well.

Sklar and Sarter [39.55] examined the effective-

ness of visual, tactile, and redundant visual and tactile

cues for indicating unexpected changes in the status

of an automated cockpit system. The tactile conditions

produced higher detection rates and faster response

times. Furthermore, provision of tactile feedback and

performance of concurrent visual tasks did not result

in any interference suggesting that tactile feedback

may better support human–machine communication in

information-rich domains (see also Ng et al.’s [39.50]

ﬁndings reviewed earlier).

Research also indicates that multimodal presenta-

tion provides comprehension and memory beneﬁts for

verbal warnings. Using a laboratory task in which par-

ticipants measured and mixed chemicals, Wogalter and

Young [39.42] (see also Wogalter et al. [39.41]) ob-

served higher compliance rates in conditions in which

warnings to wear a mask and gloves were presented

using both text and voice (74% of participants com-

plied) than in conditions in which the warnings were

presented via voice (59%) or text alone (41%). A simi-

lar pattern was observed in a ﬁeld experiment in which

text and voice warnings warned of a wet ﬂoor in a shop-

ping center. Voice warnings are more likely to capture

attention. However, most of the participants in the text

warning condition also reported awareness of the warn-

ing. Therefore, awareness alone cannot account for the

Part D 39.2

680 Part D Automation Design: Theory and Methods for Integration

higher compliance rates. Additionally, the combined

text and voice condition resulted in higher compliance

than the voice-alone condition. The combination of

voice and print appears more persuasive than print or

voice alone.

In another study, Conzola and Wogalter [39.56]

used voice and print warnings to supplement product

manual instructions during the unpacking of a com-

puter disk drive. The supplemental voice warnings were

presented via digitized voice while the text was pre-

sented via printed placard. Compliance was higher in

conditions with the supplemental messages than in the

manual-only condition, but there was no signiﬁcant

difference in compliance between the voice and print

conditions. As regards to memory, the voice message

resulted in greater recall than the print or manual-

only conditions. This ﬁnding is consistent with what

is known as the modality effect in working memory

research – since verbal information is stored in mem-

ory in an auditory/acoustic format, memory for verbal

information is better when the information is pre-

sented auditorily (i. e., by voice) than when that same

information is presented visually (i. e., as text) (see Pen-

ney [39.57] for a review). Performance suffers when

verbal information is presented visually as translation

into an auditory code is required for storage in memory.

Translation is unnecessary with voice presentation.

To summarize, by providing redundant delivery

channels, a multimodal approach helps to ensure that

the warning attracts attention, is received (i.e., under-

stood) by the user/operator, and is remembered. Future

research should focus on further developing relatively

underused channels for warning delivery (i.e., haptic)

and using multiple modalities in parallel in order to in-

crease the attentional and performance capacity of the

user/operator [39.38].

39.3 Models of Warning Effectiveness

Over the past 20years, much research has been con-

ducted on warnings and their effectiveness. The fol-

lowing discussion will ﬁrst introduce some commonly

used measures of effectiveness. Attention will then shift

to modeling perspectives and related research ﬁndings

which provide guidance as to when, where, and why

warnings will be effective.

39.3.1 Warning Effectiveness Measures

The performance of a warning can be measured in many

different ways [39.39]. The ultimate measure of effec-

tiveness is whether a warning reduces the frequency

and severity of human errors and accidents in the real

world. However, such data is generally unavailable,

forcing effectiveness to be evaluated using other mea-

sures, sometimes obtained in controlled settings that

simulate the conditions under which people receive the

warning; for example, the effectiveness of a collision

avoidance warning might be assessed by comparing

how quickly subjects using a driving simulator notice

and respond to obstacles with and without the warn-

ing system. For the most part, such measures can be

derived from models of human information processing

that describe what must happen after exposure to the

warning, for the warning to be effective [39.31, 39].

That is, the human operator must notice the warning,

correctly comprehend its meaning, decide on the ap-

propriate action, and perform it correctly. Analysis of

these intervening events can provide substantial guid-

ance into factors inﬂuencing the overall effectiveness of

a particular warning.

A complicating issue is that the design of warn-

ings is a polycentric problem [39.58], that is, the

designer will have to balance several conﬂicting objec-

tives when designing a warning. The most noticeable

warning will not necessarily be the easiest to under-

stand, and so on. As argued by Lehto [39.31], this

dilemma can be partially resolved by focusing on

decision quality as the primary criterion for evaluat-

ing applications of warnings; that is, warnings should

be evaluated in terms of their effect on the overall

quality of the judgments and decisions made by the tar-

geted population in their naturalistic environment. This

perspective assumes that decision quality can be meas-

ured by comparing people’s choices and judgments to

those prescribed by some objective gold standard.In

some cases, the gold standard might be prescribed by

a normative mathematical model, as expanded upon

below.

39.3.2 The Warning Compliance Hypothesis

The warning compliance hypothesis [39.59] states that

people’s choices should approximate those obtained by

applying the following optimality criterion:

Part D 39.3

Safety Warnings for Automation 39.3 Models of Warning Effectiveness 681

If the expected cost of complying with the warning

is greater than the expected cost of not complying,

then it is optimal to ignore the warning; otherwise,

the warning should be followed.

The warning compliance hypothesis is based on sta-

tistical decision theory which holds that a rational

decision-maker should make choices that maximize ex-

pected value or utility [39.60, 61]. The expected value

of choosing an action A

is calculated by weighting its

consequences C

over all events k, by the probabil-

ity P

that the event will occur. More generally, the

decision-maker’s preference for a given consequence

might be deﬁned by a value or utility function

V(C

), which transforms consequences into preference

values. The preference values are then weighted us-

ing the same equation. The expected value of a given

action A

becomes

EV[A



V(C

) . (39.1)

From this perspective, people who decide to ignore the

warning feel that avoiding the typically small cost of

compliance outweighs the large, but relatively unlikely

cost of an accident or other potential consequence of

not complying with the warning. The warning compli-

ance hypothesis clearly implies that the effectiveness of

warnings might be improved by

1. Reducing the expected cost of compliance, or

2. Increasing the expected cost of ignoring the

warning.

Many strategies might be followed to attain these

objectives; for example, the expected cost of com-

pliance might be reduced by modifying the task or

equipment so the required precautionary behavior is

easier to perform. The beneﬁt of following this strat-

egy is supported by numerous studies showing that even

a small cost of compliance (i.e., a short delay or in-

convenience) can encourage people to ignore warnings

(for reviews see Lehto and Papastavrou [39.62], Wogal-

ter et al. [39.63], and Miller and Lehto [39.64]). Some

strategies for reducing the cost of compliance include

providing the warning at the time it is most relevant or

more convenient to respond to.

Increasing theexpected cost of ignoringthe warning

is another strategy for increasing warning effectiveness

suggested by the warning compliance hypothesis. The

potential value of this approach is supported by stud-

ies indicating that people will be more likely to take

precautions when they believe the danger is present

and perceive a signiﬁcant beneﬁt to taking the pre-

caution. This might be done through supervision and

enforcement or other methods of increasing the cost

of ignoring the warning. Also, assuming the warn-

ing is sometimes given when it does not need to be

followed (i.e., a false alarm), the expected cost of

ignoring the warning will increase if the warning is

modiﬁed in a way that reduces the number of false

alarms. This point leads us to the topic of information

quality.

39.3.3 Information Quality

In a perfect world, people would be given warnings if,

and only if, a hazard is present that they are not al-

ready aware of. When warning systems are perfect, the

receiver can optimize performance by simply follow-

ing the warning when it is provided [39.65]. Imperfect

warning systems, on the otherhand, forcethe receiverto

decide whether to consult and comply with the provided

warning.

The problem with imperfect warning systems is that

they sometimes provide false alarms or fail to detect

the hazard. From a short-term perspective, false alarms

are often merely a nuisance to the operator. However,

there are also some important long-run costs, because

repeated false alarms shape people’s attitudes and inﬂu-

ence their actions. One problem is the cry-wolf effect

which encourages people to ignore (or mistrust) warn-

ings [39.66, 67]. Even worse, people may decide to

completely eliminate the nuisance by disconnecting the

warning system [39.68]. Misses are also an important

issue, because people may be exposed to hazards if they

are relying on the warning system to detect the hazard.

Another concern is that misses might reduce operator

trust in the system [39.18].

Due to the potentially severe consequences of

a miss, misses are often viewed as automation fail-

ures. The designers of warning systems consequently

tend to focus heavily on designing systems that re-

liably provide a warning when a hazard is present.

One concern, based on studies of operator overre-

liance upon imperfect automation [39.1,19, 69], is that

this tendency may encourage overreliance on warning

systems. Another issue is that this focus on avoid-

ing misses causes warning systems to provide many

false alarms for each correct identiﬁcation of the

hazard. This tendency has been found for warning sys-

tems across a wide range of application areas [39.65,

67].

Part D 39.3

682 Part D Automation Design: Theory and Methods for Integration

39.3.4 Information Integration

As discussed by Edworthy [39.70] and many others, in

real-life situations people are occasionally faced with

choices where they must combine what they already

know about a hazard with information they obtain from

hazard cues and a warning of some kind. In some cases,

this might be a warning sign or label. In others, it might

be a warning signal or alarm that indicates a hazard

is present that normally is not there. A starting point

for analyzing how people might integrate the informa-

tion from the warning with what they already know or

have determined from other sources of information is

given by Bayes’ rule, which describes how to infer the

probability of a given event from one or more pieces of

evidence [39.61]. Bayes’ rule states that the posterior

probability of hypothesis H

given that evidence E

present, or P(H

), is given by

P(H

) =

P(E

)

P(E

)

P(H

) , (39.2)

where P(H

) is the probability of the hypothesis being

true prior to obtaining the evidence E

,andP(E

)

is the probability of obtaining the evidence E

given

that the hypothesis H

is true. When a receiver is given

an imperfect warning, we can replace P(E

)inthe

above equation with P(W|H) to calculate the probabil-

ity that the hazard is present after receiving a warning.

That is,

P(H|W) =

P(W|H)

P(W)

P(H) ,

(39.3)

where P(H) is the priorprobability of the hazard, P(W)

is the probability of sending a warning, P(W|H)isthe

probability of sending a warning given the hazard is

present, and P(H|W) is the probability that the hazard

is present after receiving the warning.

A number of other models have been devel-

oped in psychology that describe mathematically how

people combine sources of information. Some exam-

ples include social judgment theory, policy capturing,

multiple cue probability learning models, informa-

tion integration theory, and conjoint measurement

approaches [39.31]. From the perspective of warnings

design, these approaches can be used to check which

cues are actually used bypeople whentheymake safety-

related decisions and how this information is integrated.

A potential problem is that research on judgment and

decision making clearly shows that people integrate

information inconsistently with the prescriptions of

Bayes’ rule in some settings [39.71]; for example, sev-

eral studies show that people are more likely to attend

to highly salient stimuli. This effect can explain the

tendency for people to overestimate the likelihood of

highly salient events.

One overall conclusion is that signiﬁcant deviations

from Bayes’ rule become more likely when people must

combine evidence in artiﬁcial settings where they are

not able to fully exploit their knowledge and cues found

in their naturalistic environment [39.72–74]. This does

not mean that people are unable to make accurate in-

ferences, as emphasized by both Simon and researchers

embracing the ecological [39.75, 76] and naturalis-

tic [39.77] models of decision making. In fact, theuse of

simple heuristics in rich environments can lead to infer-

ences that are in many cases more accurate than those

made using naive Bayes, or linear, regression [39.75].

Unfortunately, many applications of automation place

the operator in a situation which removes them from the

rich set of naturalistic cues available in less automated

settings, and forces the operator to make inferences

from information provided on displays. In such situ-

ations, it may become difﬁcult for operators to make

accurate inferences since they no longer can rely on

simple heuristics or decision rules that are adapted to

particular environments.

39.3.5 The Value of Warning Information

As mentioned earlier, the designers of warning systems

tend to focus heavily on designing systems that reli-

ably provide a warning when a hazard is present, which

results in manyfalse alarms. Froma theoreticalperspec-

tive it might be better to design the warning system so

that it is less conservative. That is, a system that oc-

casionally fails to detect the hazard but provides fewer

false alarms might improveoperator performance.From

the perspective of warning design, the critical question

is to determine how selective the warning should be to

minimize the expected cost to the user as a function of

the number of false alarms and correct identiﬁcations

made by the warning [39.68,78,79].

Given that costs can be assigned to false alarms

and misses, an optimal warning threshold can be calcu-

lated that maximizes the expected value of the provided

information. If it is assumed that people will simply

follow the recommendation of a warning system (i. e.,

the warning system is the sole decision-maker) the

optimal warning threshold can be calculated using clas-

sical signal detection theory (SDT) [39.80,81]. That is,

a warning should be given when the likelihood ratio

P(E|S)/P(E|N) exceeds the optimal warning thresh-

Part D 39.3

Safety Warnings for Automation 39.3 Models of Warning Effectiveness 683

old β, calculated as shown below.

β =

1−P

−c

, (39.4)

where

the a priori probability of a signal (hazard)

being present,

P(E|S) the conditional probability of the evidence

given a signal (hazard) is present,

P(E|N) the conditional probability of the evidence

given a signal (hazard) is not present,

cost of a correct rejection,

cost of a false alarm,

cost of a correct identiﬁcation,

cost of a missed signal.

In reality, the problem is more complicated because, as

mentioned earlier, people might consider other sources

in addition to a warning when making decisions. The

latter situation corresponds to a team decision made

by a person and warning system working together, as

expanded upon later.

39.3.6 Team Decision Making

The distributed signal detection theoretic (DSDT)

model focuses onhow to determinethe optimaldecision

thresholds of both the warning system and the human

operator when they work together to make the best pos-

sible decision [39.65]. The proposed approach is based

on the distributed signal detection model [39.82–86].

The key insight is that a warning system and human op-

erator are both decision-makers who jointly trytomake

an optimal team decision.

The DSDT model has many interesting implica-

tions and applications. One is that the warning system

and human decision-maker should adjust their decision

thresholds in a way that depends upon what the other is

doing. If the warning system uses a low threshold and

provides a warning even when there is not much evi-

dence of the hazard, the DSDT model shows that the

human decision-maker should adjust their own thresh-

old in the opposite direction. That is, the rational human

decision-maker will require more evidence from the en-

vironment or other source before complying with the

warning. At some point, as the threshold for providing

the warning gets lower, the rational decision-maker will

ignore the warning completely.

The DSDT model also implies that the warning sys-

tem should use different thresholds depending upon

how the receiver is performing. If the receiver is dis-

abled or unable to take their observation from the

environment, the warning should take the role of pri-

mary decision-maker, and set its threshold accordingly

to that prescribed in traditional signal detection theory.

Along the same lines, if the decision-maker is not re-

sponding in an optimal manner when the warning is or

not given, the DSDT model prescribes ways of mod-

ifying the warning systems threshold; for example, if

the decision-maker is too willing to take the precau-

tion when the warning is provided, the warning system

should use a stricter warning threshold. That is, the

warning system should require more evidence before

sending a warning.

Research has been performed that addresses predic-

tions of the DSDT model [39.65, 87, 88]. One study

showed that the performance of subjects on a simple

inference task changed dramatically, depending on the

warning threshold value [39.65]. The optimal warning

threshold varied between subjects,and subjectschanged

their own decision thresholds, consistently with the

DSDT model’s predictions, when the warning thresh-

old was modiﬁed. A second study, using a similar

inference task, also showed that the optimal threshold

varied between subjects [39.87]. Performance was sig-

niﬁcantly improved by adjusting the warning threshold

to the optimal DSDT value calculated for each particu-

lar subject based on their earlier performance. A third

study, in a more realistic environment, compared the

driving performance of licensed drivers on a driving

simulator [39.88]. Overall, use of the DSDT threshold

improved passing decisions signiﬁcantly over the SDT

warning threshold. Drivers also changed their own deci-

sion thresholds, in the way the DSDT model predicted

they should, when the warning threshold changed. An-

other interesting result was that use of the DSDT

threshold resulted in either risk-neutral or risk-averse

behavior, while, on the other hand, use of the SDT

threshold resulted in some risk-seeking behavior; that

is, people were more likely to ignore the warning and

visual cues indicating that a car might be coming. Over-

all, theseresults suggest that, for familiar decisions such

as choosing when to pass, people can behave nearly

optimally.

One of the more interesting aspects of the DSDT

model is that it suggests ways of adjusting the warning

threshold in response to how the operator is performing.

39.3.7 Time Pressure and Stress

Time pressure and stress is another important issue in

many applications of warnings. Reviews of the litera-

Part D 39.3

684 Part D Automation Design: Theory and Methods for Integration

ture suggest that time pressure often results in poorer

task performance and that it can cause shifts between

the cognitive strategies used in judgment and decision-

making situations [39.89,90]. One change is that people

show a tendency to shift to noncompensatory decision

rules. This ﬁnding is consistent with contingency theo-

ries of strategy selection. In other words, this shift may

be justiﬁed when little time is available, because a non-

compensatory rule can be applied more quickly. Maule

and Hockey [39.89] also note that people tend to ﬁlter

out low-priority types of information, omit processing

information, and accelerate mental activity when they

are under time pressure.

The general ﬁndings above indicate that warnings

may be useful when people are under time pressure and

stress. People in such situations are especially likely to

make mistakes. Consequently, warnings that alert peo-

ple after they make mistakes may be useful. A second

issue is that people under time pressure will not have

a lot of extra time available, so it will become especially

important to avoid false alarms. A limited amount of

research addresses the impact of time stress on warn-

ings compliance. In particular, a study by Wogalter

et al. [39.63] showed that time pressure reduced com-

pliance with warnings.Interestingly, subjects performed

better in both low- and high-stress conditions when

the warnings were placed in the task instructions than

on a sign posted nearby. The latter result supports the

conclusion that warnings which efﬁciently and quickly

transmit their information may be better when people

are under time stress or pressure. In some situations,

this may force the designer to carefully consider the

tradeoff between the amount of information provided

and the need for brevity. Providing more detailed infor-

mation might improve understanding of the messagebut

actually reduce effectiveness if processing the message

requires too much time and attentional effort on the part

of the receiver.

39.4 Design Guidelines and Requirements

Safety warnings can vary greatly in behavioral ob-

jectives, intended audiences, content, level of detail,

format, and mode of presentation. Accordingly, the

design of adequate warnings will often require exten-

sive investigations and development activities involving

signiﬁcant resources and time [39.91], well beyond

the scope of this chapter. The following discussion

will brieﬂy address methods of identifying hazards for

applications of automation, along with some legal re-

quirements and design speciﬁcations found in warning

standards.

39.4.1 Hazard Identiﬁcation

The ﬁrst step in the development of warnings is to

identify the hazards to be warned against. This pro-

cess is guidedby pastexperience, codes andregulations,

checklists, and other sources, and is often organized by

separately considering systems and subsystems, and po-

tential malfunctions at each stage in their life cycles.

Numerous complementary hazard analysis methods,

which also guide the process of hazard identiﬁcation,

are available [39.92, 93]. Commonly used methods in-

clude work safetyanalysis, human error analysis, failure

modes and effects analysis, and fault tree analysis.

Work safety analysis (WSA) [39.94] and human er-

ror analysis (HEA) [39.95] are related approaches that

organize the analysis around tasks rather than system

components. This process involves the initial division

of tasks intosubtasks. For eachsubtask, potential effects

of product malfunctions and human errors are then doc-

umented, along with the implemented and the potential

countermeasures. In automation applications, the tasks

that wouldbe analyzed fall into the categories of normal

operation, programming, and maintenance.

Failure modes and effects analysis (FMEA) is a sys-

tematic procedure for documenting theeffectsof system

malfunctions on reliability and safety [39.93]. Variants

of this approach include preliminary hazard analysis

(PHA), and failure modes effects and criticality ana-

lysis (FMECA). In all of these approaches, worksheets

are prepared which list the components of a system,

their potential failure modes, the likelihood and ef-

fects of each failure, and both the implemented and the

potential countermeasures that might be taken to pre-

vent the failure or its effects. Each failure may have

multiple effects. More than one countermeasure may

also be relevant for each failure. Identiﬁcation of fail-

ure modes and potential countermeasures is guided

by past experience, standards, checklists, and other

sources. This process can be further organized by

separately considering each step in the operation of

a system; for example, the effects of a power sup-

ply failure for a welding robot might be separately

considered for each step performed in the welding

process.

Part D 39.4