Masking Between Reserved Alarm Sounds of the IEC 60601-1-8 International Medical Alarm Standard: A Systematic, Formal Analysis.

OBJECTIVE: In this work, we systematically evaluated the reserved alarm sounds of the IEC 60601-1-8 international medical alarm standard to determine when and how they can be totally and partially masked. BACKGROUND: IEC 60601-1-8 gives engineers instruction for creating human-perceivable auditory medical alarms. This includes reserved alarm sounds: common types of alarms where each is a tonal melody. Even when this standard is honored, practitioners still fail to hear alarms, causing practitioner nonresponse and, thus, potential patient harm. Simultaneous masking, a condition where one or more alarms is imperceptible in the presence of other concurrently sounding alarms due to limitations of the human sensory system, is partially responsible for this. METHODS: In this research, we use automated proof techniques to determine if masking can occur in a modeled configuration of medical alarms. This allows us to determine when and how reserved alarm sound can mask other reserved alarms and to explore parameters to address discovered problems. RESULTS: We report the minimum number of other alarm sounds it takes to both totally and partially mask each of the high-, medium-, and low-priority alarm sounds from the standard. CONCLUSIONS: Significant masking problems were found for both the total and partial masking of high-, medium-, and low-priority reserved alarm sounds. APPLICATION: We show that discovered problems can be mitigated by setting alarm volumes to standard values based on priority level and by randomizing the timing of alarm tones.

An Experimental Validation of Masking in IEC 60601-1-8:2006-Compliant Alarm Sounds.

OBJECTIVE: This research investigated whether the psychoacoustics of simultaneous masking, which are integral to a model-checking-based method, previously developed for detecting perceivability problems in alarm configurations, could predict when IEC 60601-1-8-compliant medical alarm sounds are audible. BACKGROUND: The tonal nature of sounds prescribed by IEC 60601-1-8 makes them potentially susceptible to simultaneous masking: where concurrent sounds render one or more inaudible due to human sensory limitations. No work has experimentally assessed whether the psychoacoustics of simultaneous masking accurately predict IEC 60601-1-8 alarm perceivability. METHOD: In two signal detection experiments, 28 nursing students judged whether alarm sounds were present in collections of concurrently sounding standard-compliant tones. The first experiment used alarm sounds with single-frequency (primary harmonic) tones. The second experiment's sounds included the additional, standard-required frequencies (often called subharmonics). T tests compared miss, false alarm, sensitivity, and bias measures between masking and nonmasking conditions and between the two experiments. RESULTS: Miss rates were significantly higher and sensitivity was significantly lower for the masking condition than for the nonmasking one. There were no significant differences between the measures of the two experiments. CONCLUSION: These results validate the predictions of the psychoacoustics of simultaneous masking for medical alarms and the masking detection capabilities of our method that relies on them. The results also show that masking of an alarm's primary harmonic is sufficient to make an alarm sound indistinguishable. APPLICATION: Findings have profound implications for medical alarm design, the international standard, and masking detection methods.

A formal approach to discovering simultaneous additive masking between auditory medical alarms.

The failure of humans to respond to auditory medical alarms has resulted in numerous patient injuries and deaths and is thus a major safety concern. A relatively understudied source of response failures has to do with simultaneous masking, a condition where concurrent sounds interact in ways that make one or more of them imperceptible due to physical limitations of human perception. This paper presents a method, which builds on a previous implementation, that uses a novel combination of psychophysical modeling and formal verification with model checking to detect masking in a modeled configuration of medical alarms. Specifically, the new method discussed here improves the original method by adding the ability to detect additive masking while concurrently improving method usability and scalability. This paper describes how these additions to our method were realized. It then demonstrates the scalability and detection improvements via three different case studies. Results and future research are discussed.

Generating Phenotypical Erroneous Human Behavior to Evaluate Human-automation Interaction Using Model Checking.

Breakdowns in complex systems often occur as a result of system elements interacting in unanticipated ways. In systems with human operators, human-automation interaction associated with both normative and erroneous human behavior can contribute to such failures. Model-driven design and analysis techniques provide engineers with formal methods tools and techniques capable of evaluating how human behavior can contribute to system failures. This paper presents a novel method for automatically generating task analytic models encompassing both normative and erroneous human behavior from normative task models. The generated erroneous behavior is capable of replicating Hollnagel's zero-order phenotypes of erroneous action for omissions, jumps, repetitions, and intrusions. Multiple phenotypical acts can occur in sequence, thus allowing for the generation of higher order phenotypes. The task behavior model pattern capable of generating erroneous behavior can be integrated into a formal system model so that system safety properties can be formally verified with a model checker. This allows analysts to prove that a human-automation interactive system (as represented by the model) will or will not satisfy safety properties with both normative and generated erroneous human behavior. We present benchmarks related to the size of the statespace and verification time of models to show how the erroneous human behavior generation process scales. We demonstrate the method with a case study: the operation of a radiation therapy machine. A potential problem resulting from a generated erroneous human action is discovered. A design intervention is presented which prevents this problem from occurring. We discuss how our method could be used to evaluate larger applications and recommend future paths of development.

Using Task Analytic Models and Phenotypes of Erroneous Human Behavior to Discover System Failures Using Model Checking.

Breakdowns in complex systems often occur as a result of system elements interacting in ways unanticipated by analysts or designers. In systems with human operators, human-automation interaction associated with both normative and erroneous human behavior can contribute to such failures. This paper presents a method for automatically generating task analytic models encompassing both erroneous and normative human behavior from normative task models. The resulting model can be integrated into a formal system model so that system safety properties can be formally verified with a model checker. This allows analysts to prove that a human automation-interactive system (as represented by the model) will or will not satisfy safety properties with both normative and generated erroneous human behavior. This method is illustrated with a case study: the operation of a radiation therapy machine. In this example, a problem resulting from a generated erroneous human action is discovered. Future extensions of our method are discussed.

Formally verifying human-automation interaction as part of a system model: limitations and tradeoffs.

Both the human factors engineering (HFE) and formal methods communities are concerned with improving the design of safety-critical systems. This work discusses a modeling effort that leveraged methods from both fields to perform formal verification of human-automation interaction with a programmable device. This effort utilizes a system architecture composed of independent models of the human mission, human task behavior, human-device interface, device automation, and operational environment. The goals of this architecture were to allow HFE practitioners to perform formal verifications of realistic systems that depend on human-automation interaction in a reasonable amount of time using representative models, intuitive modeling constructs, and decoupled models of system components that could be easily changed to support multiple analyses. This framework was instantiated using a patient controlled analgesia pump in a two phased process where models in each phase were verified using a common set of specifications. The first phase focused on the mission, human-device interface, and device automation; and included a simple, unconstrained human task behavior model. The second phase replaced the unconstrained task model with one representing normative pump programming behavior. Because models produced in the first phase were too large for the model checker to verify, a number of model revisions were undertaken that affected the goals of the effort. While the use of human task behavior models in the second phase helped mitigate model complexity, verification time increased. Additional modeling tools and technological developments are necessary for model checking to become a more usable technique for HFE.

Comparing perceptual judgment and subjective measures of spatial awareness.

Spatial awareness is important in domains where safety hinges on human operators keeping track of the relative locations of objects in the environment. While a variety of subjective and judgment-based measures have been used to evaluate spatial awareness, none have probed all three of its levels: (1) identification of environmental objects, (2) their current locations relative to the operator, and (3) their relative positions over time. This work compares new judgment-based measures of spatial awareness that probe all three levels of spatial awareness to conventional subjective measures. In the evaluation of 14 configurations of Synthetic Vision Systems head down displays (seven terrain textures and two Geometric Fields of View (GFOVs)), 18 pilots made four types of judgments (relative angle, distance, height, and abeam time) regarding the location of terrain points displayed in 112 5-s, non-interactive simulations. They also provided subjective demand, awareness, clutter, SA-SWORD, and preferred GFOV measures. Correlation analyses revealed that displays that received higher awareness and SA-SWORD subjective ratings were associated with smaller errors in abeam time judgments and, for SA-SWORD, smaller errors in relative distance judgments. Thus SA-SWORD provides insight into level 2 spatial awareness and both SA-SWORD and awareness provide insight into level 3 spatial awareness. ANOVA and chi(2) analyses revealed comparable results between display configurations that produced the minimum error in judgments and those recommended by the awareness, SA-SWORD, and preferred GFOV measures.

A Method for the Formal Verification of Human-interactive Systems.

Predicting failures in complex, human-interactive systems is difficult as they may occur under rare operational conditions and may be influenced by many factors including the system mission, the human operator's behavior, device automation, human-device interfaces, and the operational environment. This paper presents a method that integrates task analytic models of human behavior with formal models and model checking in order to formally verify properties of human-interactive systems. This method is illustrated with a case study: the programming of a patient controlled analgesia pump. Two specifications, one of which produces a counterexample, illustrate the analysis and visualization capabilities of the method.

Spatial awareness in synthetic vision systems: using spatial and temporal judgments to evaluate texture and field of view.

OBJECTIVE: This work introduced judgment-based measures of spatial awareness and used them to evaluate terrain textures and fields of view (FOVs) in synthetic vision system (SVS) displays. BACKGROUND: SVSs are cockpit technologies that depict computer-generated views of terrain surrounding an aircraft. In the assessment of textures and FOVs for SVSs, no studies have directly measured the three levels of spatial awareness with respect to terrain: identification of terrain, its relative spatial location, and its relative temporal location. METHODS: Eighteen pilots made four judgments (relative azimuth angle, distance, height, and abeam time) regarding the location of terrain points displayed in 112 noninteractive 5-s simulations of an SVS head-down display. There were two between-subject variables (texture order and FOV order) and five within-subject variables (texture, FOV, and the terrain point's relative azimuth angle, distance, and height). RESULTS: Texture produced significant main and interaction effects for the magnitude of error in the relative angle, distance, height, and abeam time judgments. FOV interaction effects were significant for the directional magnitude of error in the relative distance, height, and abeam time judgments. CONCLUSION: Spatial awareness was best facilitated by the elevation fishnet (EF), photo fishnet (PF), and photo elevation fishnet (PEF) textures. APPLICATION: This study supports the recommendation that the EF, PF, and PEF textures be further evaluated in future SVS experiments. Additionally, the judgment-based spatial awareness measures used in this experiment could be used to evaluate other display parameters and depth cues in SVSs.