Design of Everyday Things - Norman, Don [74]
THE BORN LOSER by Art Sansom
The Born Loser, May 11, 1986. Copyright © 1986 NEA Inc.
There is no analogous forcing function for removing the key upon leaving the automobile. As we have already seen, those automobiles that have door locks that can be operated only by a key (from outside the vehicle) do introduce a forcing function: if you want to lock the door you can’t leave the key in the car. If a forcing function is really desired, it is usually possible to find one, although at some cost for normal behavior. It is important to think through the implications of that cost—to decide whether people will deliberately disable the forcing function.
The history of seatbelts in autos provides a good example. Despite all the evidence that seatbelts are an effective means of saving lives, some people dislike them enough that they refuse to wear them, probably because the perceived risk is so much less than the actual, statistical risk. For a short period, the United States tried a forcing function on seatbelts: a special interlock was installed on each new car. If the driver’s and passengers’ belts were not fastened, the car would not start (and a buzzer would sound). This forcing function was so disliked that most drivers had their mechanics disconnect it. The law was quickly changed.
There seemed to be three problems. First, many people did not want to wear seatbelts, and they resented the mechanical forcing function. Second, the forcing function couldn’t distinguish legitimate cases in which the seatbelt should not be buckled from illegitimate ones. Thus, if you wanted to carry a package in the passenger’s seat, the weightsensing element in the seat registered a person, so the car wouldn’t start unless the passenger seat’s buckle was fastened. Third, the mechanisms were not reliable, so they often failed—buzzing, stopping the engine, and being an overall nuisance. Those people who couldn’t figure out how to disconnect the forcing function simply buckled the belts permanently, fastening the buckle when the seat was unoccupied and stuffing it under the seat. So if a passenger really wanted to use the belt, it couldn’t be done. Moral: it isn’t easy to force unwanted behavior upon people. And if you are going to use a forcing function, make sure it works right, is reliable, and distinguishes legitimate violations from illegitimate ones.
Forcing functions are the extreme case of strong constraints that make it easy to discover erroneous behavior. Not every situation allows such strong constraints to operate, but the general principle can be extended to a wide variety of situations. In the field of safety engineering, forcing functions show up under other names, in particular as specialized methods for the prevention of accidents. Three such methods are interlocks, lockins, and lockouts.
An interlock forces operations to take place in proper sequence (figure 5.4). Microwave ovens and television sets use interlocks as forcing functions to prevent people from opening the door of the oven or taking off the back of the television set without first turning off the electric power: the interlock disconnects the power the instant the door is opened or the back removed. The pin on a fire extinguisher or hand grenade and the safety on a rifle are other examples of interlocks; these forcing functions prevent the accidental use of the devices.
A lockin keeps an operation active, preventing someone from prematurely stopping it. The sad stories of those who turn off word processors without first saving their work could be avoided with the use of a lockin. Suppose the on-off switch were a “soft” switch, not really disconnecting the power, but sending a signal to the program to quit, checking that all files had been saved, and then, after all the appropriate housekeeping operations had been completed, turning off the power. (Of course, a normal power