Document Sample
Alarm-Reliability Powered By Docstoc
					Alarm Reliability
What If an Alarm Goes Off
and No One Hears It? BY AVI HAREL

                he first time I used sound for alerting was in May 1948, just a few seconds after I was born.
                Presumably, the sound I generated was intended to notify my mother about the existence of a
                new creature to care for, day and night, for years. Later, I used sound occasionally to warn
                my parents about particular troubles that I experienced: pains, hunger, thirst, fatigue,
                boredom, and so on.

     Who were the sound users, and for what            designers from Rafael. The documents that we      target of the alert; and the designers who
purpose did they use it? We were three users           wrote described the processes that the system     define when and how the operators will control
altogether: I was the system, designed by              should support. We knew that the operator         the sound and what the audience will hear.
God, but also a user of the sound—I generated          should control the sound. However, the specifi-       Which type of user was I? Apparently, I
the sound to report about the troubles I expe-         cations did not mention when or how to use        was each of them. In the first example, I was
rienced; my mother used the sound to learn             sound in the system operation.                    the operator. In the second, I was the audi-
about my troubles; and God, the system                      There are three types of users involved in   ence. In the third, I was the designer.
designer, used sound to let my mother know             the previous examples the operator who con-       Apparently, most of the experience that sound
when I was in trouble.                                 trols the sound generation; the audience, the     designers have—that is relevant to sound
     I cannot remember the exact date of the
first time I used a sound alarm generated by
a human-made system. It was probably as a
pedestrian trying to cross the street.
Presumably, a car driver was using the horn
to warn me about being in danger. Here
again we were three users of the system
sound: the car driver who operated the horn;
I (the audience), who used the sound to avoid
a mishap, and the car designer, who
designed the car with a horn so that the oper-
ator could alert me about the threat.
     In 1981, I was in charge of the requirement
specifications of a control system that Rafael,
the Armament Development Authority (ADA) of
Israel, proposed for the national security services.
Here again there were three types of users: the
operator (the system administrator) who sets the
sound parameters; the commanders who use
the sound as “customers,” and we, the

10 User Experience Volume 5, Issue 3, 2006            
design—is from being the second type of             systems is that users interact with the system in   conditions. Consider the example of the
user, namely, the audience of other systems         bursts; in normal situations they can feel          supertanker operating in the wrong mode, in
that they observe and use.                          relaxed and idle, but in exceptional situations     which the rudder was not connected to the
    Sound designers must learn when and             the interaction becomes effortful and intensive.    steering wheel. The initial indication for the
how to use sound to alert about risky situa-        Examples of control systems include:                wrong mode was not very obvious—it was
tions; how to ensure that the audience will             Certain mission-critical industrial systems     the missing clicking typical of course
attend the alarm and recognize the risk; what           such as production line control systems         change. Clearly, the mode indication was
sound to provide in various situations; when            Safety-critical industrial systems including    not by design. It was not in the operational
to start and stop the sound; and how to                 chemical process control and power plant        specification. Apparently, none of the opera-
adapt the sound attributes (pitch, level,               control systems                                 tion designers thought about how the ship’s
rhythms, etc.) to the hazard; and more.                 Transportation control systems including        captain would notice that the systems were
                                                        air traffic control, urban traffic control,     in the wrong mode. Had they considered
Risky Systems                                           and railway control systems                     this at design time, they would probably
    Sound is used extensively in user interface         Medical monitors used in hospital emer-         have specified a clear indication of the
design for entertainment and IT applications.           gency rooms                                     exceptional situation, including both sound
For entertainment applications, such as games           Command and control systems used in the         and visual cues.
and videos, the sound quality is a key factor of        military, police, emergency services, and
the user experience. However, its role is often         rescue forces                                   Alert Design
secondary: users can enjoy many games or                Security systems such as fence control or           The first step of alert design is risk analy-
videos even when the sound is turned off.               surveillance systems                            sis. This activity is application specific and
    For IT applications (such as office applica-                                                        performed by subject matter experts. The
tions), sound design is pragmatic; it is            Alerting                                            output of this activity is a list of potential
commonly used to provide additional feed-               A main function of control systems is to        hazards about which the audience needs to
back and to alert users about exceptional           alert the users about deviations from normal        be warned.
situations. The effect of using sound on the
user experience is not dramatic; many users
of such applications keep the speakers off.
    Sometimes, however, the effect of sound
design on the user experience is very dramatic.
One of the incidents that Steven Casey
describes in his extraordinary book Set Phasers
on Stun is such an example. The true tale “A
Memento of Your Service” is about a super-
tanker operating in the wrong mode in which
the rudder was disconnected from the steering
wheel, resulting in an ecological disaster.
Casey mentions that an initial indication for the
exceptional situation was the lack of clicking
from the gyro compass, which was typical
during course changes. Unfortunately, the ship’s
captain became aware of the lack of clicking
only after it was too late.

Control Systems
     The subsystem of the supertanker that con-
trols the navigation is an example of a control
system. A common characteristic of control

                                                                  Volume 5, Issue 3, 2006 User Experience    11
    The second step of alert design is channel         which the audience might fail to perceive the      Basic Sound Design
allocation, which means deciding which percep-         alarm? Typically, control systems have four            Users might miss the alert even when it is
tual channel of the audience will be in charge of      potential sources for alarm failure: technical,    audible because they are busy doing some-
the mental activities involved in alarm process-       operational, environmental, and mental.            thing else that requires their full attention. The
ing. This step consists of the following parts:                                                           design challenge is to shift the user focus from
    Capturing the alarm—Ensuring that the              Technical                                          what they are doing to the alert, even when
    audience will notice the exceptional                   In case of a technical problem, such as        the users are operating under stress, such as
    situation                                          when the speakers are disconnected, and            in an emergency.
    Risk recognition—Providing hints about             there is no sound at all.                              To attract the user’s attention to the alarm,
    the risk level associated with the alarm.                                                             the alarm sound should be well distinguished
    Hazard identification—Providing details            Operational                                        from the audio signals that the users receive
    required to identify the sources of the               When the sound is disabled, because             regularly during normal operation.
    risky situation                                    somebody turned it off, for example, to                Sound is defined by composition of tones,
    Typical designs rely on both the visual and        enable noise-free team discussion.                 each consisting of sound attributes: pitch,
audio channels of the audience. Sound is nor-
mally used to attract the attention of the
audience to the exceptional situation and to
indicate the kind of hazard. The video channel
is used to get details about the situation.
    The final step of alert design encompass-
es the detailed design—including sound
design—intended to ensure hazard detec-
tion and recognition, and visual design,
intended to enable hazard identification.

Alarm Reliability
     To make sure that the users are aware of
the exceptional situation, we need to ensure
that the system generates alarms that are audi-
ble and well distinguished from background
noise and from other operational sounds, and
that the sound breaks any mental barriers.
Unlike IT applications, in which the users may
work with the sound turned off, sound is essen-
tial for reliable alerting of control systems. The
reason is that users of control systems are not
dedicated to the interaction, and therefore they       Environmental                                      level, rhythm, duration, etc. Sometimes the
might not observe any visual alerts that the sys-         When the sound is too low, below hear-          composition of tones forms a tune. For exam-
tem provides. The users may be idle, as during            ing threshold, because somebody reduced         ple, cellular phone companies enable users to
night shifts (a design challenge commonly                 it when it was disturbing.                      set tunes as a convenient means to identify
known as “the vigilance problem”), or very                In case of temporarily noisy conditions,        the callers. How can we decide which values
busy doing something else (actually their main            such as when operating a vacuum cleaner         to set for these attributes? How do we select
duties) during other hours. In any case, it can-          or when there is construction nearby.           tunes for alarms?
not be assumed that they always attend the                                                                     The traditional methodology for software
control system. Therefore, the key to reliable         Mental                                             development is incremental. You learn what
alerting is good sound design.                             When the sound is too weak to wake up          existing systems can do and you build a new
     It is a measure of trust. Can the audience            the users during a night shift.                system that has more features and works bet-
be sure that they will be notified about the               When the users disregard the sound,            ter. This approach is inadequate for sound
exceptional situations and that they will actually         because of mental blackout due to emer-        design. One problem is that there are only a
notice the alarm? If they cannot trust the system          gency stress (a phenomenon called              few good designs and many poor designs.
alarm they are in a continuous alert situation,            “tunneling effect”), or when they are too      Most existing systems do not handle even the
which ensures that they will get tired and be              busy doing something else.                     most frequent failure modes.
liable to misperceiving alert situations.                  Here is the main challenge for sound                But, a more severe limitation is that it is
Therefore, alert reliability is essential to gaining   designers: find ways to work around these          difficult to decide which of the existing
attention during exceptional situations.               problems to ensure that the audience will be       designs is good and which is bad.
                                                       aware of existing technical problems and of             Fortunately, we have a better, reliable
Barriers to Alarm Reliability                          audibility limitations, and help them notice the   source of knowledge about alarms: the safest
    What can go wrong with the system                  alarm even when they are very tired or very        way to handle alarms is by imitating nature.
alarm? What are the typical situations in              busy doing other tasks.                            This approach is commonly used in “artificial

12 User Experience Volume 5, Issue 3, 2006               
intelligence,” where we apply our knowledge               In a typical failure of a chemical process,           To enable the team to focus on problem
about natural processes to designing artificial       more than one parameter might deviate from            solving, we need to stop the annoying sound.
systems, making them look “intelligent.”              normal conditions. For example, in case of a          However, to remind the team about the con-
     Learn from nature how to set the sound           leakage from a valve, the temperature in a            tinuous hazard, we need to provide annoying
attributes. Note how babies call their parents        tank may drop below normal and the pres-              sounds every now and then.
when they are in trouble; examine how par-            sure may rise above normal. In addition, the
ents cry “watch out” to warn their children,          temperature and pressure of subsequent tanks          Repeating Hazards
and how a bird warns his spouse when a cat            may deviate from the normal. If the system                The first true tale in Casey’s Set Phasers on
is getting too close. Typically, the level, pitch,    alerts about each of the parameters individu-         Stun is about the well-documented accidents
and rhythms of the alarming sounds are higher         ally, regardless of the other parameters, then        of the radiotherapy equipment Therac-25. The
than in normal communication. But more                the audience might become overwhelmed                 machine provided an error message
important than the physical attributes is the         with alarms which might hamper the problem            “Malfunction 54,” but the operator disregarded
impact of sound on its audience. When                 solving. Careful failure analysis is required to      this message because too many similar mes-
designing sound for entertainment we think of         automatically identify the source of the excep-       sages were involved in normal operation of
tunes, melodies, and their entertaining effects.      tional situation and to alarm about the source        the machine. The result was serious radiation
Alerting sound, on the contrary, should be            rather about the exceptional sensory data.            burns, since that message meant that the radi-
annoying for the audience. It should make
them stop what they are doing and pay atten-
tion to the warning signs.
                                                      When designing sound for entertainment we
Hazard Recognition
    Basic sound design is about a singular
                                                      think of tunes, melodies, and their entertaining
hazard. It targets the first activity in alarm
processing, namely, to capture the audi-              effects. Alerting sound, on the contrary, should
ence’s attention. In almost all practical
systems this is insufficient because the audi-
ence needs to distinguish between various             be annoying for the audience.
situations. For example, the alarm tunes
about possible penetration to a secured               Continuous Alarms                                     ation was not turned off when it should have
base can distinguish between detection of                  Continuous alarms are alarms associated          been.
suspicious objects and instances of hard-             with exceptional situations that prevail for a             False alarms are a main barrier to oper-
ware failure. Also, if a camera detects an            long time. Consider an example of a surveil-          ational vigilance. Casey sites another
object moving close to a surrounding fence,           lance system, in which the system alerts about        example of this effect in the true tale “Never
the alarm can be set to play a tune that              exceptional situations, such as people staying        Cry Wolf,” about a prisoner who escaped
sounds nice when the object’s direction is            in a forbidden zone. In a case in which peo-          from jail just by crossing its fences, knowing
parallel to the fence; or dissonant when the          ple would stay there for a while—for                  that the guards would disregard the alert
direction is towards the fence.                       example, doing maintenance—after the initial          because they were used to false alarms gen-
    The alarm sound can also provide hints            alarm, the system operator might turn it off          erated by the wind and by wild animals.
about the alarming event. For example, the            because the continuous alarm is disturbing.           Terrorists often intentionally generate false
sound attributes can reflect attributes of the haz-   Later, after the maintenance work is finished,        alarms to reduce the sensitivity of security
ard. When a suspicious object is detected near        the operator might forget to return the alarm         forces to the real alarms.
the fence, the pitch can be inversely proportion-     back to the operational working mode. The                  To ensure that the alarm sound alerts the
al to the object size, so that small objects will     alarm system is disabled, but the operator is         users, the rate of false alarms should be mini-
sound light and large objects will sound heavy.       unaware of it.                                        mized. How can we reduce the rate of false
The rhythm can be directly proportional to the             The design of continuous alarms is delicate      alarms? A well-known method according to
object’s speed, so that the rhythm of a fast          and requires careful analysis of the alerting sit-    “human detection theory” is to adjust the alert
object will sound fast, and so on.                    uation. For example, consider the chemical            threshold. For example, suppose that the work-
                                                      plant in the previous section, after a first alarm.   ing temperature of a chemical process is in the
Multi-Sensory Alarms                                  Typically, it takes some time for the operational     range between 80 to 100 degrees, and that in
     The amount of system-generated annoy-            team to find out the source of the problem and        a certain tank the temperature rises occasionally
ance the audience can tolerate should be              to fix it. If during that time the system keeps       to temperatures higher than 100 degrees even
regarded as a resource of limited capacity. If        alerting, the alarm might disturb the team in         during normal operation, resulting in false
this resource is wasted the audience becomes          the problem solving. On the other hand, if the        alarms. By changing the alert threshold to 105
insensitive to the alarm. For example, consider a     alarm stops after a while, and the team is busy       degrees, the rate of false alarm should
chemical plant in which the system alerts             solving another problem, they may forget to           decrease. The problem with this approach is
about exceptional parameters in the produc-           take care of the first problem. Also, if the sys-     that by reducing the rate of false alarms, we
tion line—such as too high or too low                 tem provides continuous alarms, then the team         increase the chance of missing real alerts. In
temperature, pressure, or percentage of spe-          might turn it off intentionally, in an attempt to     the chemical process example, when the tem-
cific composites, etc.                                focus on problem solving.                             perature rises above 105, the alarm may

                                                                      Volume 5, Issue 3, 2006 User Experience    13
                                                                                                          Audibility Assurance
                                                                                                              Suppose that a system generates an alarm
                                                                                                          sound; the speakers are connected and sound
                                                                                                          is enabled. How can we make sure that it is
                                                                                                          audible, namely, above the hearing threshold
                                                                                                          and the background noise, so that the users
                                                                                                          can actually hear it? Sound audibility can be
                                                                                                          assured using the same test proposed for
                                                                                                          sound assurance:
                                                                                                              The intrusive way—The same test sound
                                                                                                              used for sound assurance is used also to
                                                                                                              detect situations of non-audible alert sound.
                                                                                                              Non-intrusive ways—Automatic sound
                                                                                                              level adjustment through special hard-
                                                                                                              ware; for example, a modified version of
                                                                                                              the yet-theoretical sound tester mentioned
                                                                                                              above. The modified version can compare
                                                                                                              the level of test sound with the level of
                                                                                                              background noise and user-adjusted
                                                                                                              threshold levels and provide visual alerts
                                                                                                              when it is too low.

provide too short notice to enable recovery in       Sound Assurance                                      Conclusion
cases of real hazards.                                   How can we be sure that a system gener-              The challenge for designers of control pro-
    Another method for reducing the rate of          ates alert sounds? Can the system know that the      grams, especially of those used in
false alarms is by risk analysis, namely, by         speakers are disconnected or that the sound          safety-critical and mission-critical systems, is
careful examination of possible scenarios and        switch is in the “Off” position? Or, can the sys-    to enable carefree interaction so that the
adjusting the alert threshold to the situation.      tem tell when the team discussion is over, and       users do not need to worry about missing
For example, if the alarm system of a jail           therefore the sound should be turned back on?        sound alarms. This enables the users to focus
measures the size and speed of objects cross-            The system cannot decide automatically           on their main jobs, and to handle emergency
ing the fence, then the system may avoid             when the sound should be enabled or disabled.        situations successfully.
most of the false alarms triggered by wind or        This is the user’s task. The only thing that we          Traditional sound design does not support
by small animals.                                    can do in the design phase is to help the users      this requirement sufficiently; users are
                                                     become aware of situations in which sound is         required to continuously stay tuned to the test
Sound Reliability                                    disabled. We achieve this by providing continu-      sound and to identify situations when the
    Did you ever wonder why monitors in emer-        ous test sounds, such as the beeps of medical        alarm sounds are missing or below hearing
gency rooms beep continuously, as often seen         monitors. Practically, “sound assurance” means       threshold.
in movies? Obviously, the annoying sound indi-       ensuring that the users can hear the test sounds.        As sound designers pay better attention to
cates that the particular patient requires special   This can be accomplished in various ways:            the technical, operational, environmental, and
attention. Also, the continuous beeping ensures          The intrusive way—The user is the watch          mental details, systems that require sound
that the personnel can rely on the sound—that            dog. It is the user’s duty to always listen to   alerts will become more reliable, and will
the monitor will actually provide an alarm               the sounds and to notice the absence of          place less burden on their users. The relation-
should the patient’s situation get worse.                test sounds.                                     ship between user, operator, and designer
    But then why is it so annoying? Beep,                Non-intrusive ways—The system can                will approach a better balance, one that will
beep, beep… Is it intended for the person-               detect situations when sound is not being        ensure safety and allow the alarms to fulfill
nel, to ensure that they are vigilant? Or is it          generated and notify the users using mes-        their natural role.
intended to encourage the patient to recover,            sages displayed on a monitor. This can be
to go back home, away from the beep,                     done with special hardware; for example,         ABOUT AVI HAREL
beep, beep…? Couldn’t the monitor design-                a sound tester made up of a test sound
ers provide relaxing, elevator-style                     generator, a mixer, a sensitive micro-                              Avi Harel is a mathematician with

background music instead? Or do they care                phone adjacent to the system speakers,                              thirty years of expertise in user

more about development costs, and less                   and a comparator. The tester generates                              interface design and development.

about the users? Beep implementation is                  hardly-audible test sounds, mixes the test                          Avi is the inventor of ErgoLight

straightforward. Playing tunes requires some             sounds with the system sounds, captures                             patents and award-winning soft-

extra development efforts.                               the mixed sound through the microphone,           ware tools for incorporating human factors in system

    The risks are that the users occasionally            and provides visual alarms when no                design   (

turn the sound off because it interferes with            traces of the test sound are found in the         Articles.html). Avi is the founder and active manager

their ongoing activities. And consequently,              mixed sound. This solution is still theoreti-     of ErgoLight Ltd. (

they might not be alerted when needed.                   cal, waiting for its first implementation.

14 User Experience Volume 5, Issue 3, 2006          

Shared By: