What If an Alarm Goes Off
and No One Hears It? BY AVI HAREL
he first time I used sound for alerting was in May 1948, just a few seconds after I was born.
Presumably, the sound I generated was intended to notify my mother about the existence of a
new creature to care for, day and night, for years. Later, I used sound occasionally to warn
my parents about particular troubles that I experienced: pains, hunger, thirst, fatigue,
boredom, and so on.
Who were the sound users, and for what designers from Rafael. The documents that we target of the alert; and the designers who
purpose did they use it? We were three users wrote described the processes that the system define when and how the operators will control
altogether: I was the system, designed by should support. We knew that the operator the sound and what the audience will hear.
God, but also a user of the sound—I generated should control the sound. However, the specifi- Which type of user was I? Apparently, I
the sound to report about the troubles I expe- cations did not mention when or how to use was each of them. In the first example, I was
rienced; my mother used the sound to learn sound in the system operation. the operator. In the second, I was the audi-
about my troubles; and God, the system There are three types of users involved in ence. In the third, I was the designer.
designer, used sound to let my mother know the previous examples the operator who con- Apparently, most of the experience that sound
when I was in trouble. trols the sound generation; the audience, the designers have—that is relevant to sound
I cannot remember the exact date of the
first time I used a sound alarm generated by
a human-made system. It was probably as a
pedestrian trying to cross the street.
Presumably, a car driver was using the horn
to warn me about being in danger. Here
again we were three users of the system
sound: the car driver who operated the horn;
I (the audience), who used the sound to avoid
a mishap, and the car designer, who
designed the car with a horn so that the oper-
ator could alert me about the threat.
In 1981, I was in charge of the requirement
specifications of a control system that Rafael,
the Armament Development Authority (ADA) of
Israel, proposed for the national security services.
Here again there were three types of users: the
operator (the system administrator) who sets the
sound parameters; the commanders who use
the sound as “customers,” and we, the
10 User Experience Volume 5, Issue 3, 2006 www.usabilityprofessionals.org
design—is from being the second type of systems is that users interact with the system in conditions. Consider the example of the
user, namely, the audience of other systems bursts; in normal situations they can feel supertanker operating in the wrong mode, in
that they observe and use. relaxed and idle, but in exceptional situations which the rudder was not connected to the
Sound designers must learn when and the interaction becomes effortful and intensive. steering wheel. The initial indication for the
how to use sound to alert about risky situa- Examples of control systems include: wrong mode was not very obvious—it was
tions; how to ensure that the audience will Certain mission-critical industrial systems the missing clicking typical of course
attend the alarm and recognize the risk; what such as production line control systems change. Clearly, the mode indication was
sound to provide in various situations; when Safety-critical industrial systems including not by design. It was not in the operational
to start and stop the sound; and how to chemical process control and power plant specification. Apparently, none of the opera-
adapt the sound attributes (pitch, level, control systems tion designers thought about how the ship’s
rhythms, etc.) to the hazard; and more. Transportation control systems including captain would notice that the systems were
air traffic control, urban traffic control, in the wrong mode. Had they considered
Risky Systems and railway control systems this at design time, they would probably
Sound is used extensively in user interface Medical monitors used in hospital emer- have specified a clear indication of the
design for entertainment and IT applications. gency rooms exceptional situation, including both sound
For entertainment applications, such as games Command and control systems used in the and visual cues.
and videos, the sound quality is a key factor of military, police, emergency services, and
the user experience. However, its role is often rescue forces Alert Design
secondary: users can enjoy many games or Security systems such as fence control or The first step of alert design is risk analy-
videos even when the sound is turned off. surveillance systems sis. This activity is application specific and
For IT applications (such as office applica- performed by subject matter experts. The
tions), sound design is pragmatic; it is Alerting output of this activity is a list of potential
commonly used to provide additional feed- A main function of control systems is to hazards about which the audience needs to
back and to alert users about exceptional alert the users about deviations from normal be warned.
situations. The effect of using sound on the
user experience is not dramatic; many users
of such applications keep the speakers off.
Sometimes, however, the effect of sound
design on the user experience is very dramatic.
One of the incidents that Steven Casey
describes in his extraordinary book Set Phasers
on Stun is such an example. The true tale “A
Memento of Your Service” is about a super-
tanker operating in the wrong mode in which
the rudder was disconnected from the steering
wheel, resulting in an ecological disaster.
Casey mentions that an initial indication for the
exceptional situation was the lack of clicking
from the gyro compass, which was typical
during course changes. Unfortunately, the ship’s
captain became aware of the lack of clicking
only after it was too late.
The subsystem of the supertanker that con-
trols the navigation is an example of a control
system. A common characteristic of control
www.usabilityprofessionals.org Volume 5, Issue 3, 2006 User Experience 11
The second step of alert design is channel which the audience might fail to perceive the Basic Sound Design
allocation, which means deciding which percep- alarm? Typically, control systems have four Users might miss the alert even when it is
tual channel of the audience will be in charge of potential sources for alarm failure: technical, audible because they are busy doing some-
the mental activities involved in alarm process- operational, environmental, and mental. thing else that requires their full attention. The
ing. This step consists of the following parts: design challenge is to shift the user focus from
Capturing the alarm—Ensuring that the Technical what they are doing to the alert, even when
audience will notice the exceptional In case of a technical problem, such as the users are operating under stress, such as
situation when the speakers are disconnected, and in an emergency.
Risk recognition—Providing hints about there is no sound at all. To attract the user’s attention to the alarm,
the risk level associated with the alarm. the alarm sound should be well distinguished
Hazard identification—Providing details Operational from the audio signals that the users receive
required to identify the sources of the When the sound is disabled, because regularly during normal operation.
risky situation somebody turned it off, for example, to Sound is defined by composition of tones,
Typical designs rely on both the visual and enable noise-free team discussion. each consisting of sound attributes: pitch,
audio channels of the audience. Sound is nor-
mally used to attract the attention of the
audience to the exceptional situation and to
indicate the kind of hazard. The video channel
is used to get details about the situation.
The final step of alert design encompass-
es the detailed design—including sound
design—intended to ensure hazard detec-
tion and recognition, and visual design,
intended to enable hazard identification.
To make sure that the users are aware of
the exceptional situation, we need to ensure
that the system generates alarms that are audi-
ble and well distinguished from background
noise and from other operational sounds, and
that the sound breaks any mental barriers.
Unlike IT applications, in which the users may
work with the sound turned off, sound is essen-
tial for reliable alerting of control systems. The
reason is that users of control systems are not
dedicated to the interaction, and therefore they Environmental level, rhythm, duration, etc. Sometimes the
might not observe any visual alerts that the sys- When the sound is too low, below hear- composition of tones forms a tune. For exam-
tem provides. The users may be idle, as during ing threshold, because somebody reduced ple, cellular phone companies enable users to
night shifts (a design challenge commonly it when it was disturbing. set tunes as a convenient means to identify
known as “the vigilance problem”), or very In case of temporarily noisy conditions, the callers. How can we decide which values
busy doing something else (actually their main such as when operating a vacuum cleaner to set for these attributes? How do we select
duties) during other hours. In any case, it can- or when there is construction nearby. tunes for alarms?
not be assumed that they always attend the The traditional methodology for software
control system. Therefore, the key to reliable Mental development is incremental. You learn what
alerting is good sound design. When the sound is too weak to wake up existing systems can do and you build a new
It is a measure of trust. Can the audience the users during a night shift. system that has more features and works bet-
be sure that they will be notified about the When the users disregard the sound, ter. This approach is inadequate for sound
exceptional situations and that they will actually because of mental blackout due to emer- design. One problem is that there are only a
notice the alarm? If they cannot trust the system gency stress (a phenomenon called few good designs and many poor designs.
alarm they are in a continuous alert situation, “tunneling effect”), or when they are too Most existing systems do not handle even the
which ensures that they will get tired and be busy doing something else. most frequent failure modes.
liable to misperceiving alert situations. Here is the main challenge for sound But, a more severe limitation is that it is
Therefore, alert reliability is essential to gaining designers: find ways to work around these difficult to decide which of the existing
attention during exceptional situations. problems to ensure that the audience will be designs is good and which is bad.
aware of existing technical problems and of Fortunately, we have a better, reliable
Barriers to Alarm Reliability audibility limitations, and help them notice the source of knowledge about alarms: the safest
What can go wrong with the system alarm even when they are very tired or very way to handle alarms is by imitating nature.
alarm? What are the typical situations in busy doing other tasks. This approach is commonly used in “artificial
12 User Experience Volume 5, Issue 3, 2006 www.usabilityprofessionals.org
intelligence,” where we apply our knowledge In a typical failure of a chemical process, To enable the team to focus on problem
about natural processes to designing artificial more than one parameter might deviate from solving, we need to stop the annoying sound.
systems, making them look “intelligent.” normal conditions. For example, in case of a However, to remind the team about the con-
Learn from nature how to set the sound leakage from a valve, the temperature in a tinuous hazard, we need to provide annoying
attributes. Note how babies call their parents tank may drop below normal and the pres- sounds every now and then.
when they are in trouble; examine how par- sure may rise above normal. In addition, the
ents cry “watch out” to warn their children, temperature and pressure of subsequent tanks Repeating Hazards
and how a bird warns his spouse when a cat may deviate from the normal. If the system The first true tale in Casey’s Set Phasers on
is getting too close. Typically, the level, pitch, alerts about each of the parameters individu- Stun is about the well-documented accidents
and rhythms of the alarming sounds are higher ally, regardless of the other parameters, then of the radiotherapy equipment Therac-25. The
than in normal communication. But more the audience might become overwhelmed machine provided an error message
important than the physical attributes is the with alarms which might hamper the problem “Malfunction 54,” but the operator disregarded
impact of sound on its audience. When solving. Careful failure analysis is required to this message because too many similar mes-
designing sound for entertainment we think of automatically identify the source of the excep- sages were involved in normal operation of
tunes, melodies, and their entertaining effects. tional situation and to alarm about the source the machine. The result was serious radiation
Alerting sound, on the contrary, should be rather about the exceptional sensory data. burns, since that message meant that the radi-
annoying for the audience. It should make
them stop what they are doing and pay atten-
tion to the warning signs.
When designing sound for entertainment we
Basic sound design is about a singular
think of tunes, melodies, and their entertaining
hazard. It targets the first activity in alarm
processing, namely, to capture the audi- effects. Alerting sound, on the contrary, should
ence’s attention. In almost all practical
systems this is insufficient because the audi-
ence needs to distinguish between various be annoying for the audience.
situations. For example, the alarm tunes
about possible penetration to a secured Continuous Alarms ation was not turned off when it should have
base can distinguish between detection of Continuous alarms are alarms associated been.
suspicious objects and instances of hard- with exceptional situations that prevail for a False alarms are a main barrier to oper-
ware failure. Also, if a camera detects an long time. Consider an example of a surveil- ational vigilance. Casey sites another
object moving close to a surrounding fence, lance system, in which the system alerts about example of this effect in the true tale “Never
the alarm can be set to play a tune that exceptional situations, such as people staying Cry Wolf,” about a prisoner who escaped
sounds nice when the object’s direction is in a forbidden zone. In a case in which peo- from jail just by crossing its fences, knowing
parallel to the fence; or dissonant when the ple would stay there for a while—for that the guards would disregard the alert
direction is towards the fence. example, doing maintenance—after the initial because they were used to false alarms gen-
The alarm sound can also provide hints alarm, the system operator might turn it off erated by the wind and by wild animals.
about the alarming event. For example, the because the continuous alarm is disturbing. Terrorists often intentionally generate false
sound attributes can reflect attributes of the haz- Later, after the maintenance work is finished, alarms to reduce the sensitivity of security
ard. When a suspicious object is detected near the operator might forget to return the alarm forces to the real alarms.
the fence, the pitch can be inversely proportion- back to the operational working mode. The To ensure that the alarm sound alerts the
al to the object size, so that small objects will alarm system is disabled, but the operator is users, the rate of false alarms should be mini-
sound light and large objects will sound heavy. unaware of it. mized. How can we reduce the rate of false
The rhythm can be directly proportional to the The design of continuous alarms is delicate alarms? A well-known method according to
object’s speed, so that the rhythm of a fast and requires careful analysis of the alerting sit- “human detection theory” is to adjust the alert
object will sound fast, and so on. uation. For example, consider the chemical threshold. For example, suppose that the work-
plant in the previous section, after a first alarm. ing temperature of a chemical process is in the
Multi-Sensory Alarms Typically, it takes some time for the operational range between 80 to 100 degrees, and that in
The amount of system-generated annoy- team to find out the source of the problem and a certain tank the temperature rises occasionally
ance the audience can tolerate should be to fix it. If during that time the system keeps to temperatures higher than 100 degrees even
regarded as a resource of limited capacity. If alerting, the alarm might disturb the team in during normal operation, resulting in false
this resource is wasted the audience becomes the problem solving. On the other hand, if the alarms. By changing the alert threshold to 105
insensitive to the alarm. For example, consider a alarm stops after a while, and the team is busy degrees, the rate of false alarm should
chemical plant in which the system alerts solving another problem, they may forget to decrease. The problem with this approach is
about exceptional parameters in the produc- take care of the first problem. Also, if the sys- that by reducing the rate of false alarms, we
tion line—such as too high or too low tem provides continuous alarms, then the team increase the chance of missing real alerts. In
temperature, pressure, or percentage of spe- might turn it off intentionally, in an attempt to the chemical process example, when the tem-
cific composites, etc. focus on problem solving. perature rises above 105, the alarm may
www.usabilityprofessionals.org Volume 5, Issue 3, 2006 User Experience 13
Suppose that a system generates an alarm
sound; the speakers are connected and sound
is enabled. How can we make sure that it is
audible, namely, above the hearing threshold
and the background noise, so that the users
can actually hear it? Sound audibility can be
assured using the same test proposed for
The intrusive way—The same test sound
used for sound assurance is used also to
detect situations of non-audible alert sound.
Non-intrusive ways—Automatic sound
level adjustment through special hard-
ware; for example, a modified version of
the yet-theoretical sound tester mentioned
above. The modified version can compare
the level of test sound with the level of
background noise and user-adjusted
threshold levels and provide visual alerts
when it is too low.
provide too short notice to enable recovery in Sound Assurance Conclusion
cases of real hazards. How can we be sure that a system gener- The challenge for designers of control pro-
Another method for reducing the rate of ates alert sounds? Can the system know that the grams, especially of those used in
false alarms is by risk analysis, namely, by speakers are disconnected or that the sound safety-critical and mission-critical systems, is
careful examination of possible scenarios and switch is in the “Off” position? Or, can the sys- to enable carefree interaction so that the
adjusting the alert threshold to the situation. tem tell when the team discussion is over, and users do not need to worry about missing
For example, if the alarm system of a jail therefore the sound should be turned back on? sound alarms. This enables the users to focus
measures the size and speed of objects cross- The system cannot decide automatically on their main jobs, and to handle emergency
ing the fence, then the system may avoid when the sound should be enabled or disabled. situations successfully.
most of the false alarms triggered by wind or This is the user’s task. The only thing that we Traditional sound design does not support
by small animals. can do in the design phase is to help the users this requirement sufficiently; users are
become aware of situations in which sound is required to continuously stay tuned to the test
Sound Reliability disabled. We achieve this by providing continu- sound and to identify situations when the
Did you ever wonder why monitors in emer- ous test sounds, such as the beeps of medical alarm sounds are missing or below hearing
gency rooms beep continuously, as often seen monitors. Practically, “sound assurance” means threshold.
in movies? Obviously, the annoying sound indi- ensuring that the users can hear the test sounds. As sound designers pay better attention to
cates that the particular patient requires special This can be accomplished in various ways: the technical, operational, environmental, and
attention. Also, the continuous beeping ensures The intrusive way—The user is the watch mental details, systems that require sound
that the personnel can rely on the sound—that dog. It is the user’s duty to always listen to alerts will become more reliable, and will
the monitor will actually provide an alarm the sounds and to notice the absence of place less burden on their users. The relation-
should the patient’s situation get worse. test sounds. ship between user, operator, and designer
But then why is it so annoying? Beep, Non-intrusive ways—The system can will approach a better balance, one that will
beep, beep… Is it intended for the person- detect situations when sound is not being ensure safety and allow the alarms to fulfill
nel, to ensure that they are vigilant? Or is it generated and notify the users using mes- their natural role.
intended to encourage the patient to recover, sages displayed on a monitor. This can be
to go back home, away from the beep, done with special hardware; for example, ABOUT AVI HAREL
beep, beep…? Couldn’t the monitor design- a sound tester made up of a test sound
ers provide relaxing, elevator-style generator, a mixer, a sensitive micro- Avi Harel is a mathematician with
background music instead? Or do they care phone adjacent to the system speakers, thirty years of expertise in user
more about development costs, and less and a comparator. The tester generates interface design and development.
about the users? Beep implementation is hardly-audible test sounds, mixes the test Avi is the inventor of ErgoLight
straightforward. Playing tunes requires some sounds with the system sounds, captures patents and award-winning soft-
extra development efforts. the mixed sound through the microphone, ware tools for incorporating human factors in system
The risks are that the users occasionally and provides visual alarms when no design (http://ergolightsw.com/CHI/Company/
turn the sound off because it interferes with traces of the test sound are found in the Articles.html). Avi is the founder and active manager
their ongoing activities. And consequently, mixed sound. This solution is still theoreti- of ErgoLight Ltd. (http://ergolight-sw.com).
they might not be alerted when needed. cal, waiting for its first implementation.
14 User Experience Volume 5, Issue 3, 2006 www.usabilityprofessionals.org