Nof S.Y. Springer Handbook of Automation

Подождите немного. Документ загружается.

Safety Warnings for Automation 39.4 Design Guidelines and Requirements 685

Fault tree analysis (FTA) is a closely related ap-

proach used to develop fault trees. The approach is

top-down in that the analysis begins with a malfunction

or accident and works downwards to basic events at the

bottom of the tree [39.93]. Computer tools which calcu-

late minimal cut-sets and failure probabilities and also

perform sensitivity analysis [39.96] make such analysis

more convenient. Certain programs help analysts draw

fault trees [39.97,98]. Human reliability analysis(HRA)

event trees are a classic example of this approach.

FTA and FMEA are complementary tools for docu-

menting sources of reliability and safety problems, and

also help organize efforts to control these problems.

The primary shortcoming of both approaches is that the

large number of components in many automated sys-

tems imposes a signiﬁcant practical limitation on the

analysis, that is, the number of event combinations that

might occur is an exponentialfunction of the large num-

ber of components. Applications for complex forms of

automation consequently are normally conﬁned to the

analysis of single-event failures [39.100].

FTA and FMEA both provide a way of estimating

the system reliability from the reliability of its com-

ponents. Dhillon [39.101] provides a comprehensive

overview of documents, data banks, and organizations

for obtaining failure data to use in robot reliability ana-

lysis. Component reliabilities used in such analysis can

be obtained from sources such as handbooks [39.102],

data provided by manufacturers (Table 39.2), or past ex-

Table 39.2 Estimates of ﬁre protection systems operational reliability (probability of success) [39.99]

Protection system

Warrington Delphi UK Fire eng guidelines Japanese studies

(Delphi Group) Australia (expert surveys) (incident data)

Smoldering Flaming Smoldering Flaming Tokyo FD Watanabe

Heat detector 089 0 90/95 94 89

Home smoke system 76 79 65 75/74 NA NA

System smoke detector 86 90 70 80/85 94 89

Beam smoke detectors 86 88 70 80/85 94 89

Aspirated smoke detectors 86 NA 90 95/95 NA NA

Sprinklers operate 95 50 95/99 97 NA

Sprinklers control but

64 NA

NA NA

do not extinguish

Sprinklers extinguish

48 NA

96 NA

Masonry construction 81

29% probability an 95% if no opening

opening will be ﬁxed open 90% if opening with auto closer NA NA

Gypsum partitions 69

29% probability an opening 95% if no opening

will be ﬁxed open 90% if opening with auto closer NA NA

perience. Limited data is also available that documents

error rates of personnel performing reliability-related

tasks, such as maintenance (Table 39.3). Methods

for estimating human error rates have been devel-

oped [39.103], such as technique for human error

rate prediction (THERP) [39.104] and success likeli-

hood index method-multiattribute utility decomposition

(SLIM-MAUD) [39.105]. THERP follows an approach

analogous to fault tree analysis, to estimate human error

probabilities (HEPs). In SLIM-MAUD expert ratings

are used to estimate HEPs as a function of performance

shaping factors (PSFs).

Given that system component failure rates or proba-

bilities are known, the next step in quantitative analysis

is todevelop a model of the system showing how system

reliability is functionally determined by each compo-

nent. The two most commonly used models are: (1) the

systems block diagram, and (2) the system fault tree.

Fault trees and system block diagrams are both useful

for describing the effect of component conﬁgurations

on system reliability. The most commonly considered

conﬁgurations in such analysis are: (1) serial systems,

(2) parallel systems, and (3) mixed serial and parallel

systems.

39.4.2 Legal Requirements

In most industrialized countries, governmental regu-

lations require that certain warnings be provided to

Part D 39.4

686 Part D Automation Design: Theory and Methods for Integration

Table 39.3 Summary of predicted human error probabilities in offshore platform musters (reprinted from [39.108], with permis-

sion from Elsevier). MO – man overboard, GR – gas release, F&R – ﬁre and explosion, TSR – temporary safe refuge, OIM –

offshore installation manager, PA – public announcement

No. Action HEP Phase Loss of d efences

MO GR F&E

1 Detect alarm 0.00499 0.0308 0.396 Awareness Do not hear alarm. Do not properly

2 Identify alarm 0.00398 0.0293 0.386 identify alarm. Do not maintain

3 Act accordingly 0.00547 0.0535 0.448 composure (panic)

4 Ascertain if danger is 0.00741 0.0765 0.465 Evaluation Misinterpret muster initiator

imminent seriousness and fail to muster in

5 Muster if in imminent 0.00589 0.0706 0.416 a timely fashion. Do not return process

danger to safe state. Leave workplace

6 Return process equipment 0.00866 0.0782 0.474 in a condition that escalates

to safe state initiator or impedes others’ egress

7 Make workplace as safe as 0.00903 0.0835 0.489

possible in limited time

8 Listen and follow PA 0.00507 0.0605 0.42 Egress Misinterpret or do not hear PA

announcements announcements. Misinterpret tenability

9 Evaluate potential egress 0.00718 0.0805 0.476 of egress path. Fail to follow a path

paths and choose route which leads to TSR; decide to follow

10 Move along egress route 0.00453 0.0726 0.405 a different egress path with lower

11 Assess quality of egress 0.00677 0.0788 0.439 tenability. Fail to assist others.

route while moving to TSR Provide incorrect assistance which

12 Choose alternate route if 0.00869 0.1 0.5 delays or prevents egress

egress path is not tenable

13 Assist others if needed or 0.0101 0.0649 0.358

as directed

14 Register at TSR 0.00126 0.01 0.2 Recovery Fail to register while in the TSR.

15 Provide pertinent feedback 0.00781 0.0413 0.289 Fail to provide pertinent feedback.

attained while en route Provide incorrect feedback. Do not

to TSR don personal survival suit in an

16 Don personal survival suit or 0.00517 0.026 0.199 adequate time for evacuation.

TSR survival suit if Misinterpret OIM’s instructions

instructed to abandon or do not follow OIM’s instructions

17 Follow OIM’s instructions 0.0057 0.0208 0.21

18 Follow OIM’s instructions 0.0057 0.0208 0.21

workers and others who might be exposed to haz-

ards. For example, in the USA, the Environmental

Protection Agency (EPA) has developed several label-

ing requirements for toxic chemicals. The Department

of Transportation (DOT) makes speciﬁc provisions re-

garding the labeling of transported hazardous materials.

The most well-known governmental standards in the

USA applicable to applications of automation are the

general industry standards speciﬁed by the Occupation

Safety and Health Administration (OSHA). The OSHA

has also promulgated a hazard communication standard

that applies to workplaces where toxic or hazardous

materials are in use. Training, container labeling and

other forms of warnings, and material data safety sheets

are all required elements of the OSHA hazard commu-

nication standard. Other relevant OSHA publications

addressing automation are the Guidelines for Robotics

Safety [39.106]andtheOccupational Safety and Health

Technical Manual [39.107].

In the USA, the failure to warn also can be grounds

for litigation holdingmanufacturers andothers liable for

injuries incurred by workers. In establishing liability,

the theory of negligence considers whether the failure

to adequately warn is unreasonable conduct based on

(1) the foreseeability of the danger to the manufacturer,

(2) the reasonableness of the assumption that a user

Part D 39.4

Safety Warnings for Automation 39.4 Design Guidelines and Requirements 687

would realize the danger and, (3) the degree of care that

the manufacturer took to inform the user of the danger.

The theory of strict liability only requires that the failure

to warn caused the injury or loss.

39.4.3 Voluntary Standards

A large set of existing standards provide voluntary

recommendations regarding the use and design of

safety information. These standards have been de-

veloped by both: (1) international groups, such as

the United Nations, the European Economic Com-

munity (EURONORM), the International Organiza-

tion for Standardization (ISO), and the International

Electrotechnical Commission (IEC), and (2) national

groups, such as the American National Standards In-

stitute (ANSI), the British Standards Institute, the

Canadian Standards Association, the German Institute

for Normalization (DIN), and the Japanese Industrial

Standards Committee.

Among consensus standards, those developed by

ANSI in the USA are of special signiﬁcance. Over

the last decade or so, ﬁve new ANSI standards focus-

ing on safety signs and labels have been developed

and one signiﬁcant standard has been revised. The new

standards are: (1) ANSI Z535.1 Safety Color Code,

(2) ANSI Z535.2 Environmental and Facility Safety

Signs,(3)ANSI Z535.3 Criteria for Safety Symbols,

(4) ANSI Z535.4 Product Safety Signs and Labels,

and (5) ANSI Z535.5 Accident Prevention Tags. The

recently revised standard is ANSI Z129.1-1988, Haz-

ardous Industrial Chemicals – Precautionary Labeling.

Furthermore, ANSI has published a Guide for Develop-

ing Product Information.

Warning requirements for automated equipment can

also be found in many other standards. The most well-

known standard in the USA that addresses automation

safety is ANSI/RIA R15.06. This standard was ﬁrst

published in 1986 by the Robotics Industries Asso-

ciation (RIA) and the American National Standards

Institute (ANSI)asANSI/RIA R15.06, the American

National Standard for Industrial Robots and Robot

Systems – Safety Requirements [39.109]. A revised ver-

sion of the standard was published in 1992 and the

standard is currently undergoing revisions once again.

Several other standards developed by the ANSI are

potentially important in automation applications. The

latter standards address a wide variety of topics such as

machine tool safety, machine guarding, lock-out/tagout

procedures, mechanical power transmission, chemical

labeling, material safety data sheets, personal pro-

tective equipment, safety markings, workplace signs,

and product labels. Other potentially relevant standards

developed by nongovernmental groups include the Na-

tional Electric Code, the Life Safety Code, and the

proposed UL1740 safety standard for industrial robots

and robotics equipment. Literally thousands of con-

sensus standards contain safety provisions. Also, many

companies that use or manufacture automated systems

will develop their own guidelines [39.110]. Companies

often will start with the ANSI/RIA R15.06 robot safety

standard, and then add detailed information that is rele-

vant to their particular situation.

39.4.4 Design Speciﬁcations

Design speciﬁcationscan be found in consensus and

governmental safety standards specifying how to design

(1) materialsafety data sheets (MSDS), (2) instructional

labels and manuals, (3) safety symbols, and (4) warning

signs, labels, and tags.

Material Safety Data Sheets

The OSHA hazard communication standard speciﬁes

that employers must have a MSDS in the workplace

for each hazardous chemical used. The standard re-

quires that each sheet be written in English, list its

date of preparation, and provide the chemical and

common name of hazardous chemicals contained. It

also requires the MSDS to describe (1) physical and

chemical characteristics of the hazardous chemical,

(2) physical hazards, including potential for ﬁre, ex-

plosion, and reactivity, (3) health hazards, including

signs and symptoms of exposure, and health condi-

tions potentially aggravated by the chemical, (4) the

primary route of entry, (5) the OSHA permissible expo-

sure limit, the American Conference of Governmental

Industrial Hygienists (ACGIH) threshold limit value, or

other recommended limits, (6) carcinogenic properties,

(7) generally applicable precautions, (8) generally ap-

plicable control measures, (9) emergency and ﬁrst-aid

procedures, and (10) the name, address, and telephone

number of a party able to provide, if necessary, ad-

ditional information on the hazardous chemical and

emergency procedures.

Instructional Labels and Manuals

Few consensus standards currently specify how to de-

sign instructional labels and manuals. This situation

is, however, quickly changing. The ANSI Guide for

Developing User Product Information, was recently

published in 1990, and several other consensus or-

Part D 39.4

688 Part D Automation Design: Theory and Methods for Integration

Table 39.4 Summary of recommendations in selected warning systems (after Lehto and Miller [39.39], and Lehto and

Clark [39.9])

System Signalwords Color coding Typography Symbols Arrangement

ANSI Z129.1 Danger Not speciﬁed Not speciﬁed Skull-and- Label arrangement

Precautionary Warning crossbones as not speciﬁed; examples

labeling of Caution supplement to given

hazardous Poison words. Acceptable

chemicals optional words symbols for three other

for delayed hazard types

hazards

ANSI Z535.2 Danger Red Sans serif, Symbols and Deﬁnes signal word,

Environmental Warning Orange Upper case, pictographs word message, symbol

and facility Caution Yellow Acceptable per ANSI Z535.3 panels in 1–3 panel designs.

safety signs Notice Blue typefaces, Four shapes for special use.

[General safety] Green Letter heights Can use ANSI Z535.4 for

[Arrows] as above; uniformity

B&W

otherwise per

ANSI Z535.1

ANSI Z535.4 Danger Red Sans serif, Symbols and Deﬁnes signal word,

Product safety Warning Orange Upper case, pictographs per message, pictorial panels

signs and labels Caution Yellow Suggested ANSI Z535.3; also in order of general to

per ANSI typefaces, Society of Automotive speciﬁc. Can use ANSI

Z535.1 Letter heights Engineers (SAE) Z535.2 for uniformity. Use

J284 Safety ANSI Z129.1 for chemical

Alert Symbol hazards

National Danger Red Not speciﬁed Electric Deﬁnes signal word, hazard,

Electrical Warning Red shock symbol consequences, instructions,

Manufacturers symbol. Does not specify

Association order

(NEMA)

guidelines:

NEMA 260

SAE J115 Danger Red Sans serif, Layout to Deﬁnes 3 areas: signal word

Safety signs Warning Yellow Typeface, accommodate panel, pictorial panel,

Caution Yellow Upper case symbols; speciﬁc message panel. Arrange in

symbols/pictographs order of general to speciﬁc

not prescribed

ISO standard: None. Three kinds Message Symbols and Pictograph or symbol is

ISO R557, of labels: panel is added pictographs placed inside appropriate

3864 Stop/prohibition Red below if shape with message panel

Mandatory Blue necessary below if necessary

action

Warning Yellow

ganizations are working on draft documents. Without

an overly scientiﬁc foundation, the ANSI Consumer

Interest Council, which is responsible for the above

guidelines, has provided a reasonable outline to man-

ufacturers regarding what to consider in producing

instruction/operator manuals. They have included sec-

Part D 39.4

Safety Warnings for Automation 39.4 Design Guidelines and Requirements 689

Table 39.4 (cont.)

System SignalWords Color Coding Typography Symbols Arrangement

OSHA Danger Red Readable at 5ft Biological hazard Signal word and major

1910.145 Warning (tags Yellow or as required symbol. Major message (tags only)

Speciﬁcation only) Yellow by task message can be

for accident Caution Fluorescent supplied by

prevention Biological Orange/ pictograph (tags

signs and tags Hazard, Orange-Red only). Slow-moving

BIOHAZARD, Green vehicle (SAE J943)

or symbol Fluorescent

[Safety Yellow-

instruction] Orange &

[Slow-moving Dark Red

vehicle] per ANSI

Z535.1

OSHA Per applicable In English Only as material safety

1910.1200 requirements data sheet

[Chemical] of Environmental

Hazard Protection Agency

communication (EPA), Food and

Drug Administra-

tion (FDA), and

Consumer Product

Safety Commission

(CPSC)

Westinghouse Danger Red Helvetica bold Symbols and Recommends 5 components:

handbook; Warning Orange and regular pictographs signal word, symbol/

FMC Caution Yellow weights, pictograph, hazard, result

guidelines Notice Blue Upper/lower of ignoring warning,

case avoiding hazard

tions covering organizational elements, illustrations,

instructions, warnings, standards, how to use language,

and an instructions development checklist. While the

guideline is brief, the document represents a useful ini-

tial effort in this area.

Safety Symbols

Numerous standards throughout the world contain

provisions regarding safety symbols. Among such stan-

dards, the ANSI Z535.3 standard, Criteria for Safety

Symbols, is particularly relevant for industrial prac-

titioners. The standard presents a signiﬁcant set of

selected symbols shown in previous studies to be well

understood by workers in the USA. Perhaps more

importantly, the standard also speciﬁes methods for

designing and evaluating safety symbols. Important

provisions include: (1) new symbols must be correctly

identiﬁed during testing by at least 85% of 50 or

more representative subjects, (2) symbols which do not

meet the understandability criteria should only be used

when equivalent word messages are also provided, and

(3) employers and product manufacturers should train

users regarding the intended meaning of the symbols.

The standard also makes new symbols developed under

these guidelines eligible to be considered for inclusion

in future revisions of the standard.

Warning Signs, Labels, and Tags

ANSI and other standards organizations provide very

speciﬁc recommendations about how to design warn-

ing signs, labels, and tags. These include, among other

factors, particular signal words and text, color coding

Part D 39.4

690 Part D Automation Design: Theory and Methods for Integration

schemes, typography, symbols, arrangement, and haz-

ard identiﬁcation (Table 39.4).

Among the most popular signal words recom-

mended are: danger, to indicate the highest level of

hazard; warning, to represent an intermediate hazard;

and caution,to indicate the lowestlevelof hazard. Color

coding methods, also referred to as a color system,

consistently associate colors with particular levels of

hazard; for example, red is used in all of the standards

to represent the highest level of danger. Explicit rec-

ommendations regarding typography are given in nearly

all the systems.The most general commonality between

the systems is the recommended use of sans-serif type-

faces. Varied recommendations are given regarding the

use of symbols and pictographs.

The FMC and the Westinghouse systems advocate

the use of symbols to deﬁne the hazard and to convey

the level of hazard. Other standards recommend sym-

bols only as a supplement to words. Another area of

substantial variation shown in Table 39.4 pertains to

the recommended label arrangements. The proposed ar-

rangements generally include elements from the above

discussion and specify the image’s graphic content and

color, the background’s shape and color, the enclo-

sure’s shape and color, and the surround’s shape and

color. Many of the systems also precisely describe the

arrangement of the written text and provide guidance

regarding methods of hazard identiﬁcation.

Certain standards also specify the content and word-

ing of warning signs or labels in some detail; for

example, ANSI Z129.1 speciﬁes that chemical warn-

ing labels include (1) identiﬁcation of the chemical

product or its hazardous component(s), (2) signal word,

(3) statement of hazard(s), (4) precautionary measures,

(5) instructions in case of contact or exposure, (6) an-

tidotes, (7) notes to physicians, (8) instructions in case

of ﬁre and spill or leak, and (9) instructions for con-

tainer handling and storage. This standard also speciﬁes

a general format for chemical labels that incorporate

these items and recommended wordings for particular

messages.

There are also standards which speciﬁcally address

the design of automated systems and alerts; for exam-

ple, the Department of Transportation, Federal Aviation

Administration’s (FAA) Human Factors Design Stan-

dard (HFDS) (2003) indicates that alarm systems

should alert the user to the existence of a problem, in-

form of the priority and nature of the problem, guide the

user’s initial response, and conﬁrm whether the user’s

response corrected the problem. Furthermore, it should

be possible to identify the ﬁrst event in a series of alarm

events (information valuable in determining the cause

of a problem). Consistent with our earlier discussion,

the standard suggests that information should be pro-

vided in multiple formats (e.g., visual and auditory) to

improve communication and reduce mental workload,

that auditory signals be used to draw attention to the lo-

cation of a visual display, and that false alarms should

not occur so frequently so as to undermine user trust in

the system. Additionally, users should be informed of

the inevitability of false alarms (especially in the case

of low base rates). A more in-depth discussion of the

FAA’s recommendations is beyond the scope of this

chapter – for additional information, see the Human

Factors Design Standard [39.111]. Recommendations

also exist for numerous other applications including au-

tomated cruise control/collision warning systems for

commercial trucks greater than 10000 pounds [39.112]

as well as for horns, backup alarms, and automatic

warning devices for mobile equipment [39.113].

39.5 Challenges and Emerging Trends

The preceding sections of this chapter reveal that warn-

ings can certainly play an important role in automated

systems. One of the more encouraging results is that

people often tend to behave consistently with the pre-

dictions of normative models of decision making. From

a general perspective, this is true both if people com-

ply with warnings because they believe the hazard is

more serious, and if people ignore warnings with little

diagnostic value or when the cost of compliance is be-

lieved to be high. This result supports the conclusion

that normative models can play an important role in

suggesting and evaluating design solutions that address

issues such as operator mistrust of warnings, compla-

cency, and overreliance on warnings. Perhaps the most

fundamental design challenge is that of increasing the

value of the information provided by automated warn-

ing systems. Doing so would directly address the issue

of operator mistrust.

The most fundamental method of addressing this is-

sue is to develop improved sensor systems that more

accurately measure important variables that are strongly

related to hazards or other warned against events. Suc-

cessful implementations of this approach could increase

the diagnostic value of the warnings provided by auto-

Part D 39.5

Safety Warnings for Automation References 691

mated warning systems by reducing either false alarms

or misses, and hopefully both. Given the signiﬁcant

improvements and reduced costs of sensor technology

that have been observed in recent years, this strategy

seems quite promising. Another promising strategy for

increasing the diagnostic value of the warnings is to de-

velop better algorithms for both integrating information

from multiple sensors and deciding upon when to pro-

vide a warning. Such algorithms might include methods

of adaptive automation that monitor the operator’s be-

havior, and respond accordingly; for example, if the

system detects evidence that the user is ignoring the

provided warnings, a secondary, more urgent warning

that requires a conﬁrmatory response might be given

to determine if the user is disabled (i. e., unable to re-

spond because they are distracted or even sleeping).

Other algorithms might track the performance of par-

ticular operators over a longer period and use this data

to estimate the skill of the operator or determine the

types of information the operator uses to make deci-

sions. Such tracking might reveal the degree to which

the operator relies on the warning system. It also might

reveal the extent to which the other sources of informa-

tion used by operator are redundant or independent of

the warning.

Another challenge that has been barely, if it all,

addressed in most current applications of warning sys-

tems is related to the tacit assumption that the perceived

costs and beneﬁts of correct detections, misses, false

alarms, and correct rejections are constant across op-

erators and situations. This assumption is clearly false,

because operators will differ in their attitudes toward

risk. Furthermore, the costs and beneﬁts are also likely

to change greatly between situations; for example, the

expected severity of an automobile accident changes,

depending on the speed of the vehicle. This issue might

be addressed by algorithms based on normative models

which treat the costs and beneﬁts of correct detections,

misses, false alarms, and correct rejections as random

variables which are a function of particular operators

and situations.

Many other challenges and areas of opportunity

exist for improving automated warnings; for exam-

ple, more focus might be placed on developing

warning systems that are easier for operators to un-

derstand. Such systems might include capabilities of

explaining why the warning is being provided and

how strong the evidence is. Other systems might

givetheusermorecontroloverhowthewarning

operates.

References

39.1 R. Parasuraman, V.A. Riley: Humans and automa-

tion: use, misuse, disuse, abuse, Hum. Factors 39,

230–253 (1997)

39.2 C.D. Wickens, J.G. Hollands: Engineering Psychol-

ogy and Human Performance, 3rd edn. (Prentice

Hall, Upper Saddle River 2000)

39.3 N.B. Sarter, D.D. Woods: How in the world did we

get into that mode? Mode error and awareness in

supervisory control, Hum. Factors 37(1), 5–19 (1995)

39.4 C. Perrow: Normal Accidents: Living with High-Risk

Technologies (Basic Books, New York 1984)

39.5 M.R. Endsley: Automation and situation aware-

ness. In: Automation and Human Performance,

ed. by R. Parasuraman, M. Mouloua (Lawrence

Erlbaum, Mahwah 1996) pp. 163–181

39.6 U. Metzger, R. Parasuraman: The role of the air

trafﬁc controller in future air trafﬁc management:

an empirical study of active control versus passive

monitoring, Hum. Factors 43(4), 519–528 (2001)

39.7 M.R. Endsley, E.O. Kiris: The out-of-the-loop

performance problem and level of control in au-

tomation, Hum. Factors 37(2), 381–394 (1995)

39.8 J. Reason: Human Error (Cambridge Univ. Press,

Cambridge 1990)

39.9 M.R. Lehto, D.R. Clark: Warning signs and labels

in the workplace. In: Workspace, Equipment and

Tool Design, ed. by W. Karwowski, A. Mital (Elsevier,

Amsterdam 1990) pp. 303–344

39.10 M.R. Lehto, G. Salvendy: Warnings: a supplement

not a substitute for other approaches to safety,

Ergonomics 38(11), 2155–2163 (1995)

39.11 R. Parasuraman, T.B. Sheridan, C.D. Wickens:

A model for types and levels of human interac-

tion with automation, IEEE Trans. Syst. Man Cyber.

Part A: Syst. Hum. 30(3), 286–297 (2000)

39.12 M.R. Endsley: Toward a theory of situation aware-

ness in dynamic systems, Hum. Factors 37(1), 32–64

(1995)

39.13 R. Parasuraman: Designing automation for human

use: empirical studies and quantitative models,

Ergonomics 43(7), 931–951 (2000)

39.14 W.J. Horrey, C.D. Wickens, R. Strauss, A. Kir-

lik, T.R. Stewart: Supporting situation assessment

through attention guidance and diagnostic aiding:

the beneﬁts and costs of display enhance-

ment on judgment skill. In: Adaptive Perspectives

on Human-Technology Interaction: Methods and

Models for Cognitive Engineering and Human-

Computer Interaction, ed. by A. Kirlik (Oxford Univ.

Press, New York 2006) pp. 55–70

39.15 P. Flanagan, K.I. McAnally, R.L. Martin, J.W. Mee-

han, S.R. Oldﬁeld: Aurally and visually guided

Part D 39

692 Part D Automation Design: Theory and Methods for Integration

visual search in a virtual environment, Hum. Fac-

tors 40(3), 461–468 (1998)

39.16 M. Yeh, C.D. Wickens, F.J. Seagull: Target cuing in

visual search: the effects of conformality and dis-

play location on the allocation of visual attention,

Hum. Factors 41(4), 524–542 (1999)

39.17 S.E. Graham, M.D. Matthews: Infantry Situation

Awareness: Papers from the 1998 Infantry Situation

Awareness Workshop (US Army Research Institute,

Alexandria 1999)

39.18 H. Davison, C.D. Wickens: Rotorcraft hazard cue-

ing: the effects on attention and trust, Proc. 11th

Int. Symp. Aviat. Psychol. Columbus (The Ohio State

Univ., Columbus 2001)

39.19 K.L. Mosier, L.J. Skitka, S. Heers, M. Burdick: Au-

tomation bias: decision making and performance

in high-tech cockpits, Int. J. Aviat. Psychol. 8(1),

47–63 (1998)

39.20 C.D. Wickens, K. Gempler, M.E. Morphew: Workload

and reliability of predictor displays in aircraft traf-

ﬁc avoidance, Transp. Hum. Factors 2(2), 99–126

(2000)

39.21 J.D. Lee, D.V. McGehee, T.L. Brown, M.L. Reyes:

Collision warning timing, driver distraction, and

driver response to imminent rear-end collisions

in a high-ﬁdelity driving simulator, Hum. Factors

44(2), 314–334 (2001)

39.22 A.F. Kramer, N. Cassavaugh, W.J. Horrey, E. Becic,

J.L. Mayhugh: Inﬂuence of age and proxim-

ity warning devices on collision avoidance in

simulated driving, Hum. Factors 49(5), 935–

949(2007)

39.23 M. Maltz, D. Shinar: Imperfect in-vehicle collision

avoidance warning systems can aid drivers, Hum.

Factors 46(2), 357–366 (2004)

39.24 T.A. Dingus, D.V. McGehee, N. Manakkal, S.K. Jahns,

C. Carney, J.M. Hankey: Human factors ﬁeld

evaluation of automotive headway mainte-

nance/collision warning devices, Hum. Factors

39(2), 216–229 (1997)

39.25 N.B. Sarter, B. Schroeder: Supporting decision

making and action selection under time pressure

and uncertainty: the case of in-ﬂight icing, Hum.

Factors 43(4), 573–583 (2001)

39.26 D.A. Wiegmann, A. Rich, H. Zhang: Automated di-

agnostic aids: the effects of aid reliability on users’

trust and reliance, Theor. Issues Ergon. Sci. 2(4),

352–367 (2001)

39.27 S.R. Dixon, C.D. Wickens: Automation reliability

in unmanned aerial vehicle control: a reliance-

compliance model of automation dependence

in high workload, Hum. Factors 48(3), 474–

486(2006)

39.28 F.J. Seagull, P.M. Sanderson: Anesthesia alarms

in context: an observational study, Hum. Factors

43(1), 66–78 (2001)

39.29 L. Bainbridge: Ironies of automation, Automatica

19, 775–779 (1983)

39.30 J. Meyer: Responses to dynamic warnings. In:

Handbook of Warnings, ed. by M.S. Wogalter

(Lawrence Erlbaum, Mahwah 2006) pp. 89–108

39.31 M.R. Lehto: Optimal warnings: an information and

decision theoretic perspective. In:

Handbook of

Warnings, ed. by M.S. Wogalter (Lawrence Erl-

baum, Mahwah 2006) pp. 89–108

39.32 R.R. Duffy, M.J. Kalsher, M.S. Wogalter: Increased

effectiveness of an interactive warning in a realistic

incidental product-use situation, Int. J. Ind. Ergon.

15, 159–166 (1995)

39.33 J.P. Frantz, J.M. Rhoades: A task-analytic approach

to the temporal and spatial placement of product

warnings, Hum. Factors 35, 719–730 (1993)

39.34 M.S. Wogalter, T. Barlow, S.A. Murphy: Compli-

ance to owner’s manual warnings: inﬂuence of

familiarity and the placement of a supplemental

directive, Ergonomics 38, 1081–1091 (1995)

39.35 R.C. Schank, R. Abelson: Scripts, plans, goals, and

understanding (Lawrence Erlbaum, Hillsdale 1977)

39.36 M.S. Wogalter, W.J. Vigilante: Attention switch and

maintenance. In: Handbook of Warnings,ed.by

M.S. Wogalter (Lawrence Erlbaum, Mahwah 2006)

pp. 89–108

39.37 S.L. Young, M.S. Wogalter: Effects of conspicuous

print and pictorial icons on comprehension and

memory of instruction manual warnings, Hum.

Factors 32, 637–649 (1990)

39.38 P. Sanderson: The multimodal world of medi-

cal monitoring displays, Appl. Ergon. 37,501–512

(2006)

39.39 M.R. Lehto, J.M. Miller: Warnings,Volume1:Fun-

damentals, Design and Evaluation Methodologies

(Fuller Technical, Ann Arbor 1986)

39.40 M.S. Sanders, E.J. McCormick: Human Factors in

Engineering and Design (McGraw-Hill, New York

1993), 7th edn.

39.41 M.S. Wogalter, M.J. Kalser, B.M. Racicot: Behav-

ioral compliance with warnings: effects of voice,

context, and location, Saf. Sci. 16, 637–654 (1993)

39.42 M.S. Wogalter, S.L. Young: Behavioural compliance

to voice and print warnings, Ergonomics 34,79–89

(1991)

39.43 S. Coren, L.M. Ward: Sensation and Perception,3rd

edn. (Harcourt Brace Jovanovich, San Diego 1989)

39.44 J. Edworthy, E. Hellier: Complex nonverbal audi-

tory signals and speech warnings. In: Handbook

of Warnings, ed. by M.S. Wogalter (Lawrence Erl-

baum, Mahwah 2006) pp. 89–108

39.45 R.M. Warren, R.P. Warren: Auditory illusions and

confusions, Sci. Am. 223,30–36(1970)

39.46 A.G. Samuel: Phonemic restoration: insights from

a new methodology, J. Exp. Psychol. Gen. 110,474–

494 (1981)

39.47 K.L. Momtahan: Mapping of psychoacoustic pa-

rameters to the perceived urgency of auditory

warning signals (Carleton Univ., Ottawa Ontario

1990), unpublished master’s thesis

Part D 39

Safety Warnings for Automation References 693

39.48 J. Edworthy, S.L. Loxley, I.D. Dennis: Improving

auditory warning design: relationship between

warning sound parameters and perceived urgency,

Hum. Factors 33, 205–231 (1991)

39.49 J.D. Lee, J.D. Hoffman, E. Hayes: Collision warning

design to mitigate driver distraction. In: Proceed-

ings of the SIGCHI Conference on Human Factors in

Computing Systems (ACM, New York 2004) pp. 65–72

39.50 J.Y.C.Ng,J.C.F.Man,S.Fels,G.Dumont,J.M.Anser-

mino: An evaluation of a vibro-tactile display

prototype for physiological monitoring, Anesth.

Analg. 101, 1719–1724 (2005)

39.51 J.J. Hickey: Shoulder Rumble Strip Effectiveness:

Drift-off-road Accident Reductions on the Penn-

sylvania Turnpike (Transportation Research Record

1573) (National Research Council, Washington 1997)

pp. 105–109

39.52 S.J. Selcon, R.M. Taylor, R.A. Shadrake: Multimodal

cockpit warnings: pictures, words or both?, Proc.

Hum. Factors Soc. 36th Annu. Meet. (Human Factor

Society, Santa Monica 1992) pp. 57–61

39.53 S.J. Selcon, R.M. Taylor: Evaluation of the sit-

uational awareness rating technique (SART) as

a tool for aircrew systems design, Proc. AGARD AMP

Symp. Situational Awareness in Aerospace Opera-

tions (Copenhagen 1989)

39.54 R.M. Taylor: Situational awareness rating tech-

nique (SART): the development of a tool for aircrew

systems design, Proc. AGARD AMP Symp. Situational

Awareness in Aerospace Operations (Copenhagen

1989)

39.55 A.E. Sklar, N.B. Sarter: Good vibrations: tactile

feedback in support of attention allocation and

human-automation coordination in event-driven

domains, Hum. Factors 41, 543–552 (1999)

39.56 V.C. Conzola, M.S. Wogalter: Using voice and print

directives and warnings to supplement product

manual instructions – conspicuous print and pic-

torial icons, Int. J. Ind. Ergon. 23, 549–556 (1999)

39.57 C.G. Penney: Modality effects in short-term verbal

memory, Psychol. Bull. 82, 68–84 (1975)

39.58 J.A. Henderson, A.D. Twerski: Doctrinal collapse

in products liability: the empty shell of failure

to warn, New York Univ. Law Rev. 65(2), 265–327

(1990)

39.59 J. Papastavrou, M.R. Lehto: Improving the ef-

fectiveness of warnings by increasing the ap-

propriateness of their information content: some

hypotheses about human compliance, Saf. Sci. 21,

175–189 (1996)

39.60 J. von Neumann, O. Morgenstern: Theory of Games

and Economic Behavior (Princeton Univ. Press,

Princeton 1947)

39.61 L.J. Savage: The Foundations of Statistics (Dover,

New York 1954)

39.62 M.R. Lehto, J. Papastavrou: Models of the warning

process: important implications towards effective-

ness, Saf. Sci. 16, 569–595 (1993)

39.63 M.S. Wogalter, D.M. Dejoy, K.R. Laughery: Organiz-

ing theoretical framework: a consolidated-human

information processing (C-HIP) model. In: Warn-

ings and Risk Communication,ed.byM.Wogalter,

D. DeJoy, K. Laughery (Taylor and Francis, London

1999)

39.64 J.M. Miller, M.R. Lehto: Warnings and Safety In-

structions: The Annotated Bibliography, 4th edn.

(Fuller Technical, Ann Arbor 2001)

39.65 J. Papastavrou, M.R. Lehto: A distributed signal de-

tection theory model: implications for the design

ofwarnings,Int.J.Occup.Saf.Ergon.1(3), 215–234

(1995)

39.66 S. Breznitz: Cry-Wolf: The Psychology of False

Alarms (Lawrence Erlbaum, Hillsdale 1984)

39.67 J.P. Bliss, C.K. Fallon: Active warnings: false alarms.

In: Handbook of Warnings, ed. by M.S. Wogalter

(Lawrence Erlbaum, Mahwah 2006) pp. 231–242

39.68 R.D. Sorkin, B.H. Kantowitz, S.C. Kantowitz: Like-

lihood alarm displays, Hum. Factors 30, 445–459

(1988)

39.69 N. Moray: Monitoring, complacency, scepticism

and eutactic behaviour, Int. J. Ind. Ergon. 31(3),

175–178 (2003)

39.70 J. Edworthy: Warnings and hazards: an integrative

approach to warnings research, Int. J. Cogn. Ergon.

2, 2–18 (1998)

39.71 M.R. Lehto, H. Nah: Decision making and decision

support. In: Handbook of Human Factors and Er-

gonomics, 3rd edn., ed. by G. Salvendy (Wiley, New

York 2006) pp. 191–242

39.72 M.S. Cohen: The naturalistic basis of decision bi-

ases. In: Decision Making in Action: Models and

Methods, ed. by G.A. Klein, J. Orasanu, R. Calder-

wood, E. Zsambok (Ablex, Norwood 1993) pp. 51–99

39.73 H.A. Simon: A behavioral model of rational choice,

Q. J. Econ. 69, 99–118 (1955)

39.74 H.A. Simon: Alternative visions of rationality. In:

Reason in Human Affairs, ed. by H.A. Simon (Stan-

ford Univ. Press, Stanford 1983)

39.75 G. Gigerenzer, P. Todd, ABC Research Group: Simple

Heuristics That Make Us Smart (Oxford University

Press, New York 1999)

39.76 K.R. Hammond: Human Judgment and Social

Policy: Irreducible Uncertain, Inevitable Error, Un-

avoidable Injustice (Oxford Univ. Press, New York

1996)

39.77 G.A. Klein, J. Orasanu, R. Calderwood, E. Zsambok:

Decision Making in Action: Models and Methods

(Ablex, Norwood 1993)

39.78 D.A. Owens, G. Helmers, M. Sivak: Intelligent ve-

hicle highway systems: a call for user-centred

design, Ergonomics 36(4), 363–369 (1993)

39.79 P.A. Hancock, R. Parasuraman: Human factors and

safety in the design of intelligent vehicle-highway

systems (IVHS), J. Saf. Res. 23, 181–198 (1992)

39.80 D.M. Green, J.A. Swets: Signal Detection Theory and

Psychophysics

(Wiley, New York 1966)

Part D 39

694 Part D Automation Design: Theory and Methods for Integration

39.81 C.D. Wickens: Engineering Psychology and Human

Performance, 2nd edn. (Harper Collins, New York

1992)

39.82 R.R. Tenney, N.R. Sandell Jr.: Detection with dis-

tributed sensors, IEEE Trans. Aerosp. Electron. Syst.

17(4), 501–510 (1981)

39.83 L.K. Ekchian, R.R. Tenney: Detection networks,

Proc.21stIEEEConf.Decis.Control(1982)pp.686–

691

39.84 J.D. Papastavrou, M. Athans: On optimal dis-

tributed decision architectures in a hypothesis

testing environment, IEEE Trans. Autom. Control

37(8), 1154–1169 (1992)

39.85 J.D. Papastavrou, M. Athans: The team ROC curve

in a binary hypothesis testing environment, IEEE

Trans. Aerosp. Electron. Syst. 31(1), 96–105 (1995)

39.86 J.N. Tsitsiklis: Decentralized detection, Adv. Stat.

Signal Proc. 2, 297–344 (1993)

39.87 M.R. Lehto, J.P. Papastavrou, W. Giffen: An em-

pirical study of adaptive warnings: human vs.

computer adjusted warning thresholds, Int. J.

Cogn. Ergon. 2(1/2), 19–33 (1998)

39.88 M.R. Lehto, J.P. Papastavrou, T.A. Ranney, L. Sim-

mons: An experimental comparison of conservative

versus optimal collision avoidance system thresh-

olds, Saf. Sci. 36(3), 185–209 (2000)

39.89 A.J. Maule, G.R.J. Hockey: State, stress, and time

pressure. In: Time Pressure and Stress in Hu-

man Judgment and Decision Making,ed.by

O. Svenson, A.J. Maule (Plenum, New York 1993)

pp. 83–102

39.90 E. Edland, O. Svenson: Judgment and decision

making under time pressure. In: Time Pressure and

Stress in Human Judgment and Decision Making,

ed.byO.Svenson,A.J.Maule(Plenum,NewYork

1993) pp. 27–40

39.91 J.P. Frantz, T.P. Rhoades, M.R. Lehto: Warnings

and risk communication. In: Warnings and Risk

Communication, ed. by M.S. Wogalter, D.M. De-

Joy, K. Laughery (Taylor and Francis, London 1999)

pp. 291–312

39.92 M.R. Lehto, G. Salvendy: Models of accident causa-

tion and their application: review and reappraisal,

J. Eng. Technol. Manag. 8, 173–205 (1991)

39.93 W. Hammer: Product Safety Management and En-

gineering, 2nd edn. (American Society of Safety

Engineers (ASSE), Des Plaines 1993)

39.94 J. Suoakas, V. Rouhiainen: Work Safety Analysis:

Method Description and User’s Guide, Research

Report 314 (Technical Research Center of Finland,

Tempere 1984)

39.95 J. Suoakas, P. Pyy: Evaluation of the Validity of

Four Hazard Identiﬁcation Methods with Event De-

scriptions, Research Report 516 (Technical Research

Center of Finland, Tempere 1988)

39.96 S. Contini: Fault tree and event tree analysis, Conf.

Adv. Inf. Tools Saf. Reliab. Anal. ISPA (1988) pp. 24–

39.97 S. Ruthberg: DORISK – a system for documentation

and analysis of fault trees, SRE Symp. (Trondheim

1985)

39.98 M. Knochenhauer: ABB Atom’s SUPER NET pro-

gramme package for reliability and risk analysis,

Conf. Adv. Inf. Tools Saf. Reliab. Anal. ISPA (1988)

39.99 R.W.Bukowski,E.K.Budnick,C.F.Schemel:Esti-

mates of the operational of ﬁre protection systems,

Proc.Soc.FireProt.Eng.Am.Inst.Archit.(2002)

pp. 111–124

39.100 M.L. Visinsky, J.R. Cavallaro, I.D. Walker: Robotic

fault detection and fault tolerance: a survey, Re-

liab. Eng. Syst. Saf. 46:2, 139–158 (1994)

39.101 B.S. Dhillon: Robot Reliability and Safety (Springer,

Berlin, Heidelberg 1991)

39.102 Department of Defense: MIL-HBDK-217F: Reliability

Prediction of Electronic Equipment (Rome Labora-

tory, Grifﬁss Air Force Base, NY 1990)

39.103 D.I. Gertman, H.S. Blackman: Human Reliability,

Safety Analysis Data Handbook (Wiley, New York

1994)

39.104 A.D. Swain, H. Guttman: Handbook for Human Re-

liability Analysis with Emphasis on Nuclear Power

Plant Applications (US Nuclear Regulatory Commis-

sion, Washington 1983), NUREG/CR-1278

39.105 D.E. Embrey: SLIM-MAUD: An Approach to Assessing

Human Error Probabilities Using Structured Ex-

pert Judgment (US Nuclear Regulatory Commission,

Washington 1984), NUREG/CR-3518, Vols. 1 and 2

39.106 OSHA: Guidelines for Robotics Safety (US Depart-

ment of Labor, Washington 1987)

39.107 OSHA: Industrial robots and robot system safety. In:

Occupational Safety and Health Technical Manual

(US Department of Labor, Washington 1996)

39.108 D.G. DiMattia, F.I. Khan, P.R. Amyotte: Determi-

nation of human error probabilities for offshore

platform musters, J. Loss Prev. Proc. Ind. 18, 488–

501 (2005)

39.109 American National Standard for Industrial Robots

and Robot Systems: Safety Requirements, ANSI/RIA

R15.06, (Robotic Industries Association, Ann Arbor,

MI, and the American National Standards Institute,

New York 1992)

39.110 K.M. Blache: Industrial practices for robotic safety.

In: Safety, Reliability, and Human Factors in

Robotic Systems, ed. by J.H. Graham (Van Nostrand

Reinhold, Dordrecht 1991), Chap. 3

39.111 Department of Transportation, Federal Aviation

Administration: Human Factors Design Standard

(DTFAA, Springﬁeld 2003), Report No. DOT/FAA/CT-

03/05 HF-STD-001

39.112 A.Houser,J.Pierowicz,R.McClellan:Concept

of operations and voluntary operational re-

quirements for automated cruise control/collision

warning systems (ACC/CWS) on-board com-

mercial motor vehicles (Federal Motor Carrier

Safety Administration, Washington 2005), re-

port No. FMCSA-MCRR-05–007, retrieved from

Part D 39