By: R. Hanmer, G. Stymfal
Published in: PLoPD4
Category: Fault-Tolerant Systems, Telecommunications
Summary: Solves problems in interaction between a telecommunications switching system and humans.
To make human communication with a large and complex machine easier and more reliable, use a standard messaging format. MML (huMan-Machine Language, an international standard) and PDS (Program Documentation Standard) are two examples.
To use MML for a large community of users, use a central communication point or gatekeeper and design and use an internal interface language that supports the MML.
You're using IO Gatekeeper. Who should see the output? Define different output classifications. The gatekeeper should mark different terminal/console connections to receive output for only some classifications or logical channels.
You're using IO Gatekeeper. Important information is hidden or delayed by less important information. A lot is output to workers even after applying George Washington Is Still Dead and The Bottom Line. Prioritize messages. Display higher priority messages before lower priority messages. The alarm system should use the priority tag to sound the appropriate alarm. Use Timestamp to convey a better understanding of the system state.
You're using IO Triage but messages may not come out in the order requested by subsystems. Use a sequence number for all messages when the gatekeeper receives them.
You're using Mind Your Own Business. To decide what logical channel receives the results of a specific manual input request, display the output to the logical channel that made the request. A worker usually uses one terminal at a time. Send it to terminals monitoring the logical channel. Use IO Triage
You're using IO Gatekeeper. To avoid too many messages that say the same thing, the gatekeeper should track messages and send only announcements that represent a real change of state. A problem might be detected hundreds of times, but if the state isn't changing frequently, the messages might be overkill.
You're using IO Gatekeeper. Many messages about the same type of event are flooding the output. The gatekeeper should group messages about a common event, and display just a summary message that includes the number of occurrences. Provide the entire output upon request, as it may be essential to identify problems. Use Shut Up and Listen so humans can input a message.
The human-machine interface is saturated with error reports, even though you're using The Bottom Line, George Washington Is Still Dead, or IO Triage. Display a message when taking the first action in a series that could lead to an excess number of messages. If the abnormal condition ends, display a message that everything is back to normal. Do not display a message for every change in state. People can't do anything about the messages except watch them anyway. So don't bother printing. Use Audible Alarm if something can't wait five minutes. This pattern is an extension of Five Minutes of No Escalation Messages [Adams+96]
You're using IO Triage. Humans should be heard by the system. Users should be able to disable output. The gatekeeper is flooding the output stream even though you're using George Washington Is Still Dead and The Bottom Line. The gatekeeper should give human input a higher priority than displaying output information, but not lose output messages. Human input messages should have a priority level comparable to critical output messages.
You're using Mind Your Own Business. When one subsystem allows humans to access information, another subsystem may need the information. Allow a subsystem to insert a message into the input message stream to be processed just like any other input message.
You're using Mind Your Own Business. The terminal isn't near the worker. Provide remote terminal connections so that workers can always plug in a terminal IO device and create a "beltline terminal." Allow workers to redirect output to their beltline terminals.
You're using IO Triage and People Know Best. To notify workers immediately about a significant problem, report alarms audibly in the office. Remote visual indicators, such as colored lights, should also be used.
You're using Audible Alarm and People Know Best. Workers need to know where to look for problems. Divide the office into small grids to locate the error. Tie alarm circuits together to report to the main office. When an alarmable situation occurs in a grid, alert all concerned personnel.
You're using Alarm Grid. Design the alarm system to allow easy insertion of new office-specific alarms unique to a field site.
You're using Audible Alarm. Act on all requests to silence an alarm, but don't remember them. When the system detects an alarmed condition, sound the alarm regardless of how recently the silence request was received.
You're using IO Gatekeeper. Critically important information must get to other computer systems. Sometimes the gatekeeper is too slow or is in a partial capability mode, or the system can't afford the resources to send a message to a nearby system. Provide a hard-wired messaging connection.
You're using IO Gatekeeper. Sometimes the gatekeeper is too slow or is in a partial capability mode, or the system can't afford the resources to do IO. String a Wire does not provide enough information. Display output via brute force mechanisms such as writing directly to a logical channel, thereby avoiding the IO system.