INTRODUCTION Multiple alarm events are most likely to occur with highly sophisticated, closely coupled systems (Stanton, 1994). Greater numbers of alarms or alerts associated with components and subsystems increase the potential for sensing multiple (but less critical) anomalies and for false alarms, despite improved reliability. In addition, the interconnectedness of elements within modern systems can allow an out-of-bounds situation in one component to affect others, cascading into multiple indications in a domino-like manner. The result is that some systems (e.g., nuclear power plants and advanced aircraft, which have hundreds of potential alarms) inherently increase the likelihood that more than one alarm might have to be interpreted at the same time, particularly as unusual situations arise. More alarms may make it increasingly difficult for operators to decipher the underlying cause, thereby diluting the usefulness of the alarms. Sheridan (1981) cited the confusion over the loss of coolant incident at the Three Mil e Island nuclear power plant, when more than 500 annunciators changed status within the first few minutes of the incident. Adams (1989, p. 15) related that "one operator said he would have liked to have thrown the alarm panel away. In the designers' well-meaning attempts to inform about everything, they informed about nothing." Facing more than one alarm poses several problems for human operators. First, it adds the role of systems diagnostician to that of operator, who now may be forced to rapidly determine the causes and relationships among various and often ambiguous indications, then to take appropriate action. Second, it becomes increasingly difficult to organize and prioritize actions for multiple out-of-tolerance indications as their numbers increase, especially when secondary effects obscure the root cause. One approach is to add checklists and to establish additional procedures covering each potential situation. However, in highly complex systems, the problem of providing operators with complete sets of prescribed procedures to handle every alarm combination could grow exponentially. Beyond sheer numbers, different combinations of alarms, warnings, and alerts may indicate unique abnormalities by simultaneous actuation or by cascading in unanticipated hierarchies. Including all possible indications that encompass decidedly low probability events, even if possible, would add tremendously to the list of possible procedures and could overwhelm operators. Presenting too much information, especially of differing levels of importance, might disrupt normative decision-making strategies, particularly during the haste and distraction of an emergency. Some operators use shortcuts or rule-of-thumb heuristics when faced with problems (Wickens, Gordon, & Liu, 1998, pp. 192-196). This seems particularly likely with problems posed by unanticipated multiple alarms, especially when under extreme mental workload or time pressure. Edworthy (1997) discussed the issue of urgency mapping for alarm and warning designs, emphasizing the consistent use of stimuli or cues (including colors, tones, or signal words) and suggesting that inconsistencies among cues used for representation creates increased operator workload and more errors. This implies that an operator, under urgent conditions, may rely on surface cues rather than taking the time for deeper analysis of meaning. Einhorn and Hogarth (1982) also pointed out that mental models of systems may be incomplete or even erroneous, as might be revealed by wrong actions made in attempts to understand unusual associations among alarms. Perceptual biases may further intrude, interfering with proper selection or relating of r elevant information. Klein (1993) suggested that experienced operators at times might respond to situations based on their initial perceptions, bypassing much of the conventional decision-making process. Examples vary. …
['Richard D. Gilson', 'Mustapha Mouloua', 'Amy S. Graft', 'Daniel P. McDonald']
Behavioral Influences of Proximal Alarms