Obradovich

Human Factors, 38(4), 574-592, 1996 USERS AS DESIGNERS:
HOW PEOPLE COPE WITH POOR HCI DESIGN
IN COMPUTER-BASED MEDICAL DEVICES
Human Factors, 38(4), 574-592, 1996 Abstract
In this paper, we examine how users interact with a computer-based
infusion device adapted for terbutaline infusion to treat preterm labor in
women experiencing high-risk pregnancies. This study examines: (1) the
HCI deficiencies in the device as related to this context of use, (2) how the
device characteristics increase the potential for error, and (3) the tailoring
strategies developed by users to insulate themselves from failure.
Interviews with nurses and tests of the behavior of the infusion device in
different conditions identified several classic HCI deficiencies: complex
and arbitrary sequences of operation, mode errors due to poor
differentiation of multiple operating modes intended for different contexts,
ambiguous alarms, getting lost in multiple displays, and poor feedback on
device state and behavior.
Human Factors, 38(4), 574-592, 1996 Technological change and economic pressure are moving medical practice out of hospitals and into the home or other alternative health care settings.
Patients with chronic conditions may be able to move out of the hospital throughthe use of infusion devices that support self-administration of drugs. For example,diabetics may use these infusion devices for insulin therapy, or women with highrisk pregnancies may use these devices to self-administer drugs that controlpreterm labor.
These changes are made possible by changes in medical technology-- automated infusion devices. But these new computer-based devices, if designedpoorly from a user-centered point of view (Norman, 1988), can induce erroneousactions. Previous studies of computer-based medical devices in critical caremedicine have found that computer-based medical devices often exhibit a varietyof classic human-computer interaction (HCI) deficiencies such as poor feedbackabout device state and behavior, complex and ambiguous sequences of operation,multiple poorly distinguished modes, and ambiguous alarms (Cook, Potter, Woodsand McDonald, 1991; Moll van Charante, Cook, Woods, Yue, and Howie, 1993;Cook and Woods, in press). These deficiencies are important because they havebeen shown to increase the potential for erroneous actions and to impair thephysician's ability to detect and recover from errors (e.g., Cook, Woods, and Howie,1992).
In this paper we extend the results of those studies of physician interaction with computer-based medical devices to the home health care context. Weexamined how nurses and patient/operators interact with a computer-basedinfusion device used for terbutaline infusion to treat preterm labor in womenexperiencing high-risk pregnancies. This device was originally used in insulinadministration for diabetics, but was adapted to assist in the control of pre-termlabor.
The purpose of the study was to investigate how nurses and patient/operators used the device in the context of control of preterm labor and toidentify characteristics of the device that make its operation difficult and prone toerror. Our investigations also focused on how the perinatal nurses developedstrategies to work around or guard against the human-computer interaction (HCI)deficiencies in the device (Cook and Woods, in press). These adaptations ortailoring strategies occur because patients and their nurse caregivers wereresponsible for achieving their own goals -- for the patient to remain at homeduring a difficult pregnancy, and to have a successful delivery as close to term aspossible, regardless of the design of the computer-based device.
Three kinds of investigations were carried out: (a) interviews with nurses about how they used the device and about how patients/operators used the device,(b) “bench” tests that explored how the device behaved, how the displaysrepresented those states and activities, and the control sequences needed to interactwith the device across a range of tasks and contexts relevant to terbutaline therapyfor preterm labor, and (c) observations of nurses programming the device toaccomplish different tasks.
Human Factors, 38(4), 574-592, 1996 This paper describes three aspects of user-device interaction: (1) the HCI deficiencies in the device as related to this context of use, (2) how the devicecharacteristics increase the potential for error, and (3) the tailoring strategiesdeveloped by users to insulate themselves from failure.
TERBUTALINE THERAPY FOR CONTROL OF PRETERM LABOR The focus of this investigation was the use of a computer-based infusion pump for terbutaline therapy with pregnant women experiencing preterm labor.
Terbutaline is a member of the drug class--beta-adrenergics, and affects adrenergicreceptor sites. The drug interacts with the beta receptor sites leading to uterinerelaxation.
Control of pre-term labor is a 24 hour a day therapy, and patient/operators may need to interact with the infusion pump at any time (e.g., changing an emptysyringe in the middle of the night). The therapy consists of a background base rateand with periodic larger doses which are adjusted empirically for each patient toachieve control of pre-term labor. Therapy plans need to be adjusted over time foreach patient to avoid recurrence of preterm labor because physical changes occur aspregnancy advances (i.e., changes in contractions) and because desensitization ofthe beta receptor sites occurs due to terbutaline use.
The medication can affect the patient’s physiological and mental state at the same time that the patient is an active user of the device. Adverse side effects ofterbutaline are increased heart rate, increased cardiac contractility, tachycardia,palpitations, tremors, restlessness, anxiety, and nausea (Sala and Moise, 1989). Inaddition to having to cope with the side effects of the medication, thepatient/operator also experiences stress due to the uncertainty of her situation, thequestion of the medical risks to herself and to her baby, and confinement to bedrest.
Under-administration of the medication may lead to under control of contractions. Over-administration can produce toxicity (acutely or cumulatively)which can be a very serious threat to the health of the baby and to the mother.
Therapy plans are developed, monitored, and modified to control contractionswithout exceeding toxicity limits.
A COMPUTER-BASED INFUSION PUMP IN HOME HEALTH CARE Nurse caregivers perform the initial set-up of the infusion pump for terbutaline therapy for each patient. They program the infusion device to deliverdoses of medication with certain time intervals between doses as well as setting anunderlying basal rate if it is needed. The dose and delivery intervals are based oneach individual patient's medical requirements. Table 1 lists some of theoperations the nurse must perform as part of her tasks.
Human Factors, 38(4), 574-592, 1996 Once the device has been programmed by the nurse for a specific patient, the patient, at home, must perform regular tasks to ensure that she receives the therapyas prescribed and when needed. Table 2 illustrates a sample of the normal dailyprocedures required of the patient and the operations that she must perform inorder to implement those procedures.
Improper programming or use of the device can result in under- or over- administration of terbutaline. Failure to successfully operate the infusion device orfailure to control preterm labor can have varying degrees of impact: a call to thenurse, a trip to the hospital, a prolonged hospital stay, or premature delivery.
Another type of failure occurs when a patient is screened out as a potentialcandidate for terbutaline therapy at home because they are unable to operate thepump successfully.
The specific device in question is a portable, battery-operated, electronic infusion pump (Model 404-SP, MiniMed® Technologies, Sylmar, Calif.). It is oneexample of a class of infusion devices, i.e., syringe pumps, for use with therapiesrequiring delivery of small volumes of high concentration medication (Figure 1).
The pump is used with 3-mL syringes (3 mg of terbutaline sulfate per 3-mL). Themedication is pumped through a 42-inch long infusion set (tubing used to delivermedication from the pump into the tissue) with a flexible teflon cannula (aneedleless tubing attached to the infusion set) that is inserted into the tissue justbeneath the surface of the skin (subcutaneously). Infusion sites are selected in theupper or lower abdomen or the anterior thigh and changed every three to fourdays.
Users interact with the device through four multi-function buttons: select (SEL), activate (ACT), up arrow, and down arrow. In principle, the SELect buttonallows the user to "page" through the different programming displays. TheACTivate button allows the user to "activate" the various screen displays to changethe settings (e.g., the time, amount of a demand dose, profile settings). The up anddown arrow buttons allow the user to increase or decrease the setting (for example,to change the time or to increase or decrease the medication dose).
The device operates in a hierarchy of multiple modes. Two regulate drug delivery: one is used for insulin therapy (rate mode); the other for terbutalinetherapy (interval mode). If the pump is set in the rate mode, medication isdelivered continuously at a programmed rate (from .000 ml/hr. to .720 ml/hr. in.002 ml/hr. increments). When the pump is set in the interval mode, medicationis delivered intermittently at a programmed dose size or bolus (from .000 ml to .998ml in .002 ml increments) with a time interval between doses. In the interval Human Factors, 38(4), 574-592, 1996 mode, it is also possible to set an underlying basal rate (from .000 to .250 ml/hr.),which enables flexibility in the therapy prescribed. Figures 2 and 3 graphicallyillustrate examples of therapy with each delivery mode. These two kinds oftherapy are significantly different. They are designed for different medicationstreating different kinds of medical conditions.
Insert Figures 2 and 3 approximately here.
Some of the other modes that can be used while the pump is in either rate or interval mode are profile mode and lock-out mode. Profile mode allows the userto program up to six different dose/time interval settings (profiles) during a 24-hour period. These profiles will repeat every 24 hours until the user changes theprogramming.
The lock-out modes block user access to device functionality. There are three lock-out levels. In Lock-Out level 0, all functions are accessible. Lock-Out level 1allows for all functionality except for setting maximum dosage levels and forresetting the “Totals” display. In this mode, the user can set the Dose and Intervalor Rate, set the “Demand Dose” to preset maximums, deliver a demand dose, putthe pump in and out of “Suspend” mode (this pauses drug delivery, for example,while changing the syringe), and reset the time. The only functions available to thepatient/operator with Lock-Out level 2 is to deliver a preset “Demand Dose”, and toplace the pump in and out of “Suspend” mode.
The four buttons actually perform multiple functions depending upon the sequence of key presses. For example, to deliver a demand dose, thepatient/operator must press the SELect button twice and the ACTivate buttontwice. To put the device in Suspend mode (e.g., when changing the syringe), shemust press the SELect button five times (if the device is in interval mode) and theACTivate button twice.
Information is provided to users through an LCD panel (approximately 3/4" by 1"). We constructed a map of the possible displays that could be called up andviewed on the LCD panel as one part of our investigation of the device. We foundthat the LCD serves as the viewport to multiple screen displays nested at two levels.
The basic operations of the device for terbutaline therapy are arranged under sevendifferent screen displays. Under each of those displays are one to seven differentdisplays. Figure 4 maps a portion of the display space (it illustrates the screendisplays that are nested under the Maximum Settings Display as an example). Notethat users can see only one of these display at a time.
Human Factors, 38(4), 574-592, 1996 Alarm messages appear on the LCD panel accompanied by auditory alarms that consist of a number of beeps. The number and rate of beeps are meant toindicate different device states and abnormalities.
Three kinds of investigations were carried out. Nurses were interviewed about how they used the device and about their experiences with howpatients/operators used the device. The investigators conducted “bench” tests ofthe device that explored how it behaved, how the displays represented those statesand activities, and the control sequences needed to interact with the device across arange of tasks and contexts relevant to terbutaline therapy for preterm labor.
Nurses were observed while programming the device to accomplish different tasks.
We iterated across these types of investigations in order to identify (1) error prone tasks or situations (mode error), (2) characteristics of the device that create orenhance the potential for error (e.g., multiple modes with poor feedback aboutdevice state) contribute to error prone and difficult to observe, (3) characteristics ofthe context of terbutaline therapy that interact with the device characteristics toprovide opportunities for error, and (4) the tailoring strategies developed by usersover time to work around error prone tasks and device deficiencies.
In the bench tests one of the authors (JHO) operated the infusion device in situations that are likely to occur in the context of terbutaline therapy. Deviceindications and behavior were explored in all of the situations noted in Tables 1and 2. As part of the bench tests, we mapped the organization of displays that couldappear on the LCD panel (Figure 4). Control sequences for typical user tasks werealso identified. The bench tests explored device behavior when errors occur inthese control sequences.
The three types of investigations were iterative and intermixed. For example, results from interviews would define situations where confusionsseemed to occur. We would then conduct a bench test to define exactly how thedevice behaved in that situation including the consequences of erroneous entries(e.g., the control sequences needed, the displayed indications and alarms thatresulted, the device activity that resulted). Armed with this backgroundinformation, we would then observe how a nurse uses the device by presenting herwith a context where she needed to interact with the device, observing herbehavior, and following up with a discussion of difficulties she experienced or hadseen others experience. Another type of iteration occurred when we identifiedareas in the bench tests where one might expect user problems to occur. We wouldthen use this information to query nurse users about their experiences andexperiences of the patients they supervised. For these cases we also might observeseveral nurses programming the device. Data were combined across these differentsources to specify places where users would be expected to have trouble using thedevice. In these activities we paid particular attention to strategies that nurses orpatients had developed to protect themselves from HCI difficulties.
One of the authors had used this device as a patient/operator when the system first went into use in this region of the country. We were able to use this Human Factors, 38(4), 574-592, 1996 experience as a baseline to see how the community of practice (nurses andpatient/operators) had developed tailoring strategies to cope with problematicaspects of device design. In the interviews with perinatal nurses, we specificallyexamined how users learned to train, inform, and proceduralize the tasks so thatnurses and patient/operators could use this device despite its difficulties from anHCI perspective.
We were able to do this study only because of the cooperation of individual nurses. One of the nurses we worked with was responsible for training the nurseswho are the primary caregivers for patients using the device. This nurse has beeninvolved in the use of the device since it was first introduced for terbutalinetherapy in her company. The other nurses we interviewed have worked with thisdevice an average of three years, are responsible for programming the therapy andfor all other aspects of care for the patient experiencing preterm labor.
The investigations of device behavior in different conditions identified several classic human-computer interaction deficiencies in the infusion device(Norman, 1988; Cook et al., 1991).
Complex and arbitrary sequences of operation. All of the user's normal tasks are accomplished using just four buttons. But these buttons are used in manydifferent sequences to accomplish these tasks. To set up or modify a therapy plan,requires a complex sequence keystrokes. For example, when programming thepatient's profiles in the interval mode (different dose-interval settings), the nursemust press the SELect button seven times, the ACTivate button twice, the SELectbutton once, the ACTivate button three times, the SELect button once, then thearrow keys are used to adjust the interval to the desired setting. Once the desireddose and interval are on the display, the nurse must press the ACTivate button, setthe time for the next profile, press the ACTivate button, use the arrows to set thedose and interval for that profile, and so on until the desired number of profiles areprogrammed (up to a maximum of six for a 24-hour period). As a result of theinterface design, users must remember the sequence of keystrokes needed toaccomplish a task and where they are in the sequence of keystrokes for this task.
This creates frequent opportunities for misoperation.
Furthermore, the interface exhibits low error tolerance. For example, hitting one of the buttons the wrong number of times (six instead of seven) may produce alegal sequence of commands resulting a different result than expected or desired. Itis also possible with one erroneous keystroke to destroy all the previousprogramming. If one presses the wrong button, for example, at a late stage inentering a series of profiles, she will have to begin re-programming from the firstprofile to correct the erroneous action.
Human Factors, 38(4), 574-592, 1996 Different operating modes intended for different contexts. The multiple modes create the potential for mode errors. A mode error is a basic type oferroneous action that a human user can commit by executing an intention in a wayappropriate to one mode of the device when the device is actually in another mode(Norman, 1988). This is a critical issue since programming the pump while it is inthe wrong mode can result in an incorrect delivery of medication. For example, ifone intends to program in interval mode (dose levels and time intervals betweendoses) but the device is actually in rate mode, the device will accept user input butinterpret it as specification of different infusion intervals. The device will deliver a continuous rate of medication rather thanboluses of medication being delivered at pre-specified times as intended. Figure 9illustrates how this mode error can change the medication therapy significantly.
The potential for mode error exists in part because the displays provide only very weak indications about which mode the device is in at any given time. Forexample, one display, the Normal Operating Screen, provides some indication ofwhat medication delivery mode the device is in, but no delivery mode indicationsare available on any of the other display pages. There are indications of othermodes (lockout level, suspend mode) on displays but in many cases theseindications may not be very salient or observable to users given the context (stress),their training, and other demands.
If a mode error occurs that effects the drug infusion pattern, there is no feedback about actual device behavior available to help patient/operators or nursesmonitor whether actual delivery of medication matches the desired therapy plan.
The combination of multiple modes with weak feedback about device state makes mode errors a predictable consequence of the design. We found in testingthe device in realistic scenarios that it is easy for mode errors to occur. Nurses wereaware of the potential for mode errors, at least in some of the cases (confusing rateand interval modes).
Ambiguous alarms. The infusion device has 13 alarm states, seven of which are signaled by the same auditory alarm. The visual display for the alarms iscryptic and ambiguous (e.g., E01 is displayed when the device has encountered andrecovered from a system error, and E2 is displayed when the device hasencountered a system error that may result in an over-infusion). One result is thatusers treat the alarms as a generic master caution signal.
Getting lost. This device is activated by a sequence of button presses. But depending on the screen that is displayed or the level of lock-out the device is in,the same actions can produce different results, putting the user into differentdisplays. Given the arbitrary command sequences and the lack of feedback, it is easyfor users to enter a command and then find themselves looking at a differentdisplay than the one they were expecting. They get lost in the complex commandsequences. When this occurs, they have to re-orient by escaping from the task theywere attempting to carry out and starting the interaction over from the beginning.
Pressing the SELect button once and the ACTivate button once is one example of how the same sequence of actions will put the user into differentdisplays depending on device state. When the lock-out level is 0 and the Normal Human Factors, 38(4), 574-592, 1996 Operating Screen is displayed, pressing the SELect button once and the ACTivatebutton once will call up the Dose-Interval Page with the dose value blinking(which indicates that the dose can be changed). If the starting point is the“Suspend” screen display (i.e., the device is in Suspend mode and is not deliveringmedication), pressing the SELect button once and the ACTivate button once willresult in the display of the Normal Operating Screen and a resumption ofmedication delivery.
If the lock-out level is 1 or 2 and the user again starts from the Normal Operating Screen display page, the same action sequence produces a third result. Inthis situation when the user presses SELect once and ACTivate once, nothinghappens for six to seven seconds and then the Normal Operating Screen isdisplayed. What has occurred is that the user has taken a sequence of operationsthat are not allowed for the lock-out level, but the user is never informed that heraction is illegal. When a user makes an illegal entry, the system does nothing for 6to 7 seconds and then reverts to the Normal Operating Screen. The user receivesno other feedback that the machine has judged her inputs to be illegal. Theappearance of the Normal Operating Screen can come as a surprise leaving the userconfused and wondering how she got there; did she inadvertently enter acommand to go to this surprising display or did the system do somethingautomatically.
Poor feedback on device state and behavior. A user’s perception of a device depends on an interaction between its capabilities and the feedback mechanismsthat influence what is observable about system behavior in relation to events in the environment. What feedback is available depends upon the “image” the devicepresents to users (Norman, 1988). Effective feedback or observability is more thanmere data availability; observability depends on the cognitive work needed toextract meaning from the data available (Sarter, Woods, and Billings, in press).
Poor feedback or low observability occurs when it is difficult to notice, attend to orprocess the available indications. Factors that affect how difficult it is to interpretavailable indications include how much background knowledge users must bringto bear, how much users must integrate multiple pieces of data from differentplaces, how easy it is to recognize “interesting” changes or events, and howattentional demands affect data search -- how users know when to look where.
This device provides little or no feedback about its state or behavior. If a user is in the wrong mode (rate versus interval), only the initial screen display differs.
The other displays used in programming the device are identical for the two modesand provide no indication of which mode the device is in. For example, lock-outmode is indicated by a small “L” in a relatively crowded display which indicatesthat the device is in either Lock-out level 1 or 2. The absence of the L indicatesLock-out level 0. Furthermore, patients/operators are not informed or trained tocheck for the correct lock out mode.
When an erroneous action occurs, the device often provides little or no feedback to help the user realize that an error has occurred or to aid the user inunderstanding what has led to surprising changes in device behavior. There islittle feedback about the amount of medication being delivered and whether itmatches the therapy plan. The complexities of the device make it possible that Human Factors, 38(4), 574-592, 1996 erroneous actions can inadvertently reprogram the therapy without the user beingaware of the consequences of their actions, for example, if the device is not in Lock-out level 2. In general the device has low observability and this lack of feedbackexacerbates or contributes to many of the above problems.
For example, consider the situation where the pump is in Lock-out level 2 and the user intends to stop the delivery of medication by putting the pump inSuspend mode. This is a typical device state for patient/operators and this action isa part of the sequence of activities for changing the syringe or the infusion set (afrequent task for patient/operators). The user presses the SELect button five timesand then, not attending to or not understanding the meaning of what is displayed,presses the ACTivate button. If only four of those button presses successfullychanged the displays, the patient would be at the Totals screen display when shepressed the ACTivate button. In Lock-out level 2, this action results in the NormalOperating Screen being displayed because in this mode, the Totals screen displaycan be viewed but cannot be activated. So, the patient will find herself in a displaythat she had not expected, the action intended was not taken (suspension ofmedication delivery), and the patient has no feedback as to why.
The limited feedback provided to the user about device state and behavior is particularly troubling (a) because it limits error recovery (Woods et al., 1994) and (b)because some of the error traps inherent in device design can lead to the actualdelivery of the medication being different from what the user thinks she hastriggered. Depending on the specific error, the device may function but over- orunder-medicate. Since there is no clear feedback available about the devicesactivities, it is difficult to detect over-medication. Under-medication is indicated bythe failure to control preterm contractions. With other errors the patient/operatormay be unable to get the device to function precipitating calls for assistance andrunning the risk of failure to control preterm contractions.
Our investigations included analyzing how the system of people and artifacts evolved over time to produce generally successful performance (Cook and Woods,in press). This adaptation or tailoring process occurs because users are responsiblenot just for the device operation, but also for the larger performance goals of theoverall system (i.e., for the patient to remain at home during a difficult pregnancy,and to have a successful delivery as close to term as possible). These stakeholderstailor their activities to insulate the larger system from device deficiencies (Woodset al., 1994).
Examples of the tailoring that have occurred since the introduction of the infusion device within the one perinatal services organization examined includethe following: Developing a Patient Guide. The perinatal nurses recognized that patients/ operators were experiencing various difficulties interacting with the device andthat the manuals provided by the manufacturers of the pump were inadequate tohelp patients operate the device. Based on their model of the sources of thesedifficulties, the nurses developed procedures, checklists and information in theform of handwritten and verbal instructions. Over several years the nursing staff Human Factors, 38(4), 574-592, 1996 refined, broadened, and eventually formalized this information as a user helpmanual or what they call a patient guide.
Modifying Procedures. In addition to formalizing a patient guide, the nursing staff changed, modified, and eliminated existing procedures, as well as,introduced new procedures: 1. Having the patient/operator change the syringe at the same time everyday. Initially, the patient/operator was instructed to change the syringe onlywhen the high-pressure alarm beeped, indicating that the syringe was empty. Thisoften resulted in the patient/operator needing to replace the syringe after beingawakened in the night. This is a sufficiently complex task to do even when wideawake. It is possible to incorrectly insert the syringe so that no medication is beingdelivered and yet have no feedback that this is occurring.
2. Having the patient/operator give a daily medication total readout to their nurse caregiver. The procedure of reporting daily medication totals began with thenurses having a vague realization that they were getting dosage errors from thedevice. In other words, they began to suspect that actual amount of medicationdelivered might be significantly different than that called for in the therapy plan.
They recognized that they needed to figure out some way to monitor for thesedosage errors so that they could then develop error recovery plans. Theyinnovatively made use of some features of the device in developing a procedure tohelp them detect and recover from dosage errors.
This procedure made use of a device feature that totaled the device’s assessment of what medication had been delivered over some period of time. Touse this feature the patient has to go to a specific screen display (the “Totals”display) and inform the nurse (via telephone) of the value displayed under thelabel “medication totals”. The patient/ operator then has to clear the value so thatthe machine’s running summary will represent a new total for the next interval(the time interval for this check was once each day at the same time). Nothing isprovided to help the patient carry out this task (e.g., no written procedure). Thenurse remotely provides the programming instructions to do this over the phone.
The nurse then uses the data, in comparison to the therapy plan, to infer whether the device is delivering the medication as intended or whethermisadministrations are occurring such as excessive demand doses (extra boluses ofmedication). This safety check sometimes reveals that the device was notdelivering the amount intended and that patients were initiating more demanddoses than they were authorized. But there are no formal aids to help the nursingstaff perform this inference which requires several data transformations andcomparisons.
3. Eliminating "demand dose to air" procedure when changing the syringe. This procedure was initially used every time the device ran out of medication anda new syringe was installed. The procedure involved delivering a demand dosewhose purpose was to pump the medication to the tip of the syringe to take up anyslack between the syringe driver and plunger. When .05 ml had been delivered,the patient had to place the pump in Suspend mode to stop the delivery. After thedemand dose had been stopped, the patient then had to restart the delivery ofterbutaline. This procedure was stressful for the patient to perform because whilein the middle of the difficult procedure of changing the syringe, the patient had to Human Factors, 38(4), 574-592, 1996 perform other programming tasks. This procedure was eliminated given theworkload of the procedure to eliminate any slack and the potential for error,coupled with the fact that the possibility of reduced delivery of terbutaline is notcritical at this point.
4. Using a paper clip to close the pages of documentation that discuss the delivery mode of medication not being used. In terbutaline therapy for womenexperiencing preterm labor, the interval mode of delivery is used. The displaypages for all but the initial display are identical for both rate and interval modes,and, as a result, the programming instructions in the manual look the samealthough the detailed sequence of keystrokes varies slightly. However, followingthe procedure for the rate mode can significantly alter the therapy the nurse thinksshe is initiating. Nurses discovered that they could be following the instructions inthe manual for setting up rate mode therapies rather than the intended intervalmode therapies. In other words, they could make a mode error in selectingprogramming instructions. To avoid programming terbutaline therapies in thewrong mode, they began to paper clip pages of the manual together.
Although the practitioners have tailored their strategies and behavior to cope with the complexities of this infusion device, their adaptations can be brittle,weak, or expose the system to other risks through side effects (Woods et al., 1994).
For example, there are several potential side effects associated with the newprocedure for reporting and evaluating daily medication totals (the intended ormain effect is to detect dosage errors). For example, if the patient/operator does notcorrectly zero the machine’s running summary, the procedure will not provideaccurate data for the nursing staff to detect misadministrations.
In addition, the procedure has side effects that may not be benign given the other HCI problems. One such side effect may occur in the following way. In orderto reset the running summary to zero, the patient/operator must change lock-outlevel in order to receive the authority to change the values on the relevant screendisplay. Then after recording or reporting the daily medication total, the patientmust reinitiate the stronger lock-out level (the nurse guides them through thisremotely as part of the procedure). However, if the patient/operator errs inattempting to reinitiate Lock-out level 2, she has access to the full functionality andcomplexity of the device. Subsequent misprogramming can change significantlythe therapy delivered. For example, the patient could find herself in displays withwhich she is unfamiliar, and in the attempt to escape from those displays tofamiliar ones, she could reprogram her drug regimen without realizing that shehad done so. Furthermore, the indication of lock-out mode is weak (a small “L”appears in a relatively crowded display which indicates that the device is in eitherLock-out level 1 or 2; the absence of the L indicates Lock-out level 0) andpatients/operators are not informed or trained to check for the correct mode. Ironically, a procedure developed to make up for the lack of feedback is limited by the very same device problem.
Another example of the brittleness of user tailoring can be found in the nurse relying on a paper clip to ensure that she does not inadvertently program thepump in the interval mode while intending to follow the instructions for the ratemode. While this adaptation is typical of the resourcefulness of users to cope with Human Factors, 38(4), 574-592, 1996 clumsy devices, this activity is obviously brittle as the paper clip may be lost or maybe inadvertently placed on the wrong pages.
Our investigations identified several classic human-computer interaction deficiencies in this infusion device given the context of terbutaline therapy to treatpreterm labor at home: lack of feedback on device state and behavior, complex andarbitrary sequences of operation, ambiguous alarms, and multiple operating modesintended for different contexts. These problems occur repeatedly in computer-based devices in general (Norman, 1988) and in computer-based devices for medicalapplications (Cook et al., 1991; Moll van Charante et al., 1993).
These characteristics are problematic because they predictably create the potential for erroneous assessments and actions. For example, in this case as inothers, multiple modes with weak indications of mode status will lead to modeerrors. Thus, erroneous assessments and actions are not simply “human error;”rather, these errors are symptoms of underlying design deficiencies (Woods et al.,1994).
These design deficiencies matter because they produce the potential for errors that contribute to critical incidents and outcome failures -- in this casemisadministration of therapy. Note that these design-induced errors do not alwaysproduce a misadministration. Other circumstances or factors must be present foran HCI problem to contribute to the chain of events leading to failure. In otherwords, HCI deficiencies are a kind of latent failure (Woods et al., 1994). It is a factorpresent in the system which can contribute to an outcome failure if other triggeringand potentiating factors are present (Reason, 1990).
Because practitioners are responsible agents in their domain of practice, they actively work to insulate the larger system from device deficiencies as they perceivethem (Cook and Woods, in press; Woods et al., 1994). We identified a variety ofuser tailoring strategies in this particular case. But notice how user tailoring can actto hide underlying design deficiencies from other parties. We also found evidencethat user tailoring may be only partly successful. The adaptations, while useful innarrow contexts, can be brittle or produce unanticipated side effects which producenew paths towards failure.
The latent failure chain, where HCI design deficiencies can be one contributor to an accident sequence if other potentiating factors occur, has manyimplications for the development of computer-based medical devices. The mostbasic is implication is that avoiding design-induced human-computer breakdownsis important. Furthermore, it is part of the responsibility of developmentorganizations in the medical technology field to avoid design-induced human-computer breakdowns as part of their design process. Similarly, developmentorganizations and regulatory authorities need to begin to test and evaluatecomputer-based medical devices with respect to human-computer interactionissues. HCI is much more than a luxury factor or marketing edge; it is fundamentalto patient safety and device efficacy.
Human Factors, 38(4), 574-592, 1996 Cook et al. (1991), and Moll van Charante et al. (1993) illustrate and discuss how to carry out evaluations of computer-based medical devices in order toidentify HCI deficiencies and the potential consequences of those deficiencies.
These studies show how it is critical to perform error analyses in the design of newcomputer-based systems (Norman, 1988). In other words, instead of showing howthe device can work in textbook cases, we try to show how effective interactions canbreak down if complicating factors arise. By finding potential breakdown points,the device can be modified to make human-computer cooperation in context morerobust.
Since the medical technology industry’s level of awareness about effective human-computer cooperation is an issue, it is appropriate to note that there was noorganizational support for this research as an opportunity to understand device useor to redesign the device, training or procedures. In part this occurs because findingdevice deficiencies and exposing error traps is a politically, legally and financiallycharged enterprise. As a result, our ability to collect and report all of the kinds ofdata that we would want to fully analyze the potential for error was limited. Forexample, we would have liked to set up a mechanism to identify and analyze acorpus of actual incidents (e.g., as in Cook, Woods and McDonald, 1991), and wewould have liked to observe patients or prospective patients during training andactual device use. Despite these larger organizational issues, individual nurseswere willing to share information about their experiences and demonstrate deviceuse to us.
Characterizing the problems and deficiencies in device use in context point to new design concepts. Some of these can be ways to make the current displaysand control sequences more usable. However, understanding HCI in context canpoint to deeper implications for re-design. One of these is how to provide moreeffective feedback about device state and activities. The infusion pump is anautomated system: given a set of instructions, the device will act to implement theprogrammed therapy and it will continue to act unless explicitly instructed to stopor change, even if that therapy regimen is not appropriate or is not what wasintended. Miscommunications can occur where users can think that they havecommunicated one intention, but the device has interpreted the users inputs in adifferent way. Such miscommunications between users and automated systemshave been one contributor to accidents in aviation (Sarter et al., in press; Billings,in press). Thus, it is very important to have an effective feedback mechanism thatallows the practitioner to understand what the automation is actually doing tosupport the process of error detection and recovery.
One implication of this research and other research on practitioner interaction with automated systems is that displays should help users perceivewhat the automation is doing and what it is going to do relative to expectations orplans (Woods et al., 1994, chapter 5). In this case, the graphic representations weused to illustrate the different therapy plans possible with this device provide witha starting point for developing more effective feedback (see Figures 2, 3 and 7). Thekey is the realization that human-computer interaction and device behavior are allabout different bolus sizes, rates of infusion and time intervals. What is Human Factors, 38(4), 574-592, 1996 informative are dose-time relationships. This provides the basic frame of referencefor developing a more effective representation of device activity (what will it do?what is it doing?) and a more effective human-computer interaction (how does auser instruct the automation?).
Currently, users can see only one profile or dose-interval setting at a time.
Each dose size, rate, or interval is entered one value at a time through a series ofcommands. Users cannot see the larger therapy plan as in Figures 2 or 3. Thus,they have to build up and maintain their own mental model of what has beenprogrammed relative to the desired therapy plan one piece at a time. Because ofthe inability to see the therapy plan as it is being programmed and the inability tosee the relationship between actual drug delivery and the programmed therapy, thepotential for error increases: one can enter a therapy plan incorrectly orinadvertently modify the therapy without being aware of it.
The graphs of therapy plans in Figures 2 and 3 point us towards the kind of display that is needed to provide better feedback as a nurse sets up or modifiestherapy plans -- an enhanced dose-interval graphic representation (see Yue et al.,1992 for another example of a new graphic concept for providing improvedfeedback on the activities of a different type of infusion pump). As the practitionerbuilds the therapy plan, we want to show a graph of that plan, mappinginformative relationships within a larger frame of reference (Woods, inpreparation). The relevant frame of reference is the relationship of dose level andintervals between doses. Within this frame of reference we can show a variety ofimportant relationships analogically: basal rate, demand dose, intervals, andconstraints on doses such as frequency or cumulative dose. Representing therapiesin this way makes it clear that interval mode and rate mode are very different(compare Figures 2 and 3).
An enhanced dose-interval representation also enables us to simplify the instructions needed to set up or modify therapy plans (remember that in thecurrent case programming errors can force users to start over again because ofdevice intolerance to misentries or because of user uncertainty about what theyhave actually entered). The dose-interval graph provides the basis for designing adirect manipulation interaction (Hutchins, Hollan, and Norman, 1986) where userscould directly indicate on this graph the doses, intervals, basal rates that they wantto enter or modify (for example, via point and drag operations using a pen-basedinput device or some other pointing device).
Finally, an enhanced dose-interval graph provides a means to monitor the activities of the infusion device. This is done by following one of the graphicdesign principles from Woods (1995): “Highlight contrasts. Representations shouldhighlight and support observer recognition of contrasts . -- some departure from areference or expected course. Representing contrast means that . one shows howthe actual course of behavior follows or departs from reference or expectedsequence of behavior given the relevant context. Representing contrast signalsboth the contrasting states or behavior and their relationship (how behaviordeparts from or conforms to the contrasting case).” We can represent contrast by plotting actual administrations against the therapy plan and constraints on the dose-interval graph. Figure 5 shows the targetwe would like to achieve for one case where a mode error results in the device Human Factors, 38(4), 574-592, 1996 interpreting the nurse’s inputs being as specifying a rate type of therapy when sheintends to modify an interval therapy plan. The contrast between actual drugdelivery and therapy plan stands out. In this way, one makes it easy for observersto see departures from the therapy plan, in effect, highlighting anomalies.
Of course, developing enhanced and dynamic dose-interval graphs would require a great deal of design work, wrestling with many interacting constraints,and examining many different kinds of contexts and situations. However, theconcept illustrates how studying device use in context can point the way to newdesign directions.
There often is a distinction made between home health care and critical care medicine as being very different domains within the overall health care field (e.g.,the general public as the user versus highly trained medical specialists; occasionalor temporary users versus experienced chronic users). The example of in-hometherapy for control of preterm labor illustrates that advances in technology aremaking it possible to move aspects of medicine that involve critical care into thehome. The risks in this case do not disappear as care moves from the hospital intothe home setting. Therapy is still designed and adjusted empirically for eachpatient based on feedback over time. Tasks associated with the collection andmanagement of information do not disappear.
not the criticality of the care, but the providing care. Health care is based on a system of multiple cooperating agents --cognitive activities are distributed over a set of people and machine agents such asthis infusion device. Note that this system is larger than the device and the patientor nurse.
The introduction of the infusion device and the shift from in-hospital to in- home control of pre-term labor changes the roles and responsibilities of thedifferent participants in the therapy system (Figures 6 and 7 illustrate thedistributed system for each setting). The patient has a different role and becomes anactive participant in her therapy -- a patient/operator. She is required to (a) deliverdemand doses when uterine activity is greater than a pre-determined threshold, (b)change the infusion site, (c) change the syringe when empty, and (d) monitor heruterine activity, blood pressure, and heart rate. How the perinatal service nursegathers information about the impact of therapy and how the nurse adjustsdelivery of medication changes as well. A new component of supervisory controlis introduced into the nursing function as traditional nursing functions aredelegated in part to the patient/operators.
Insert Figures 6 and 7 approximately here.
Information about the effects of therapy is critical to modifying the therapy and to early recognition of problems. The use of automated infusion devices in thehome changes how this information is gathered and distributed to the people Human Factors, 38(4), 574-592, 1996 responsible for problem recognition (e.g., approach to toxicity limits), and therapydecisions (e.g., the need for closer monitoring in the hospital). The opaque systemimage presented by the infusion device and the opportunities for misoperationcreated by poor interface design impair this distributed therapy system’s ability todetect potential problems.
Is the Human-Machine Ensemble Effective or Flawed? When one investigates and discovers HCI deficiencies, stakeholders may ask, "Do these problems mean that the device is ‘bad?’” or “Should its use be avoided?""Because there are HCI deficiencies in this infusion device, should we abandonterbutaline therapy in the home?" This is not a useful way to see the implicationsof such studies. Technology creates the opportunity for moving desirable andmedically useful functions such as the control of preterm labor out of the hospitaland into the home. However, this change in technology also transforms thedistributed cognitive system. People have new roles. The need for effectivecoordination across the multiple agents goes up. The distributed system can breakdown in new ways (Woods et al., 1994).
Technology-centered design misses these implications of changing technology on the role and information needs of the people involved in medicalcare. The infusion device studied here, like other technology-centered devices inmedicine and other fields, exhibits classic flaws in human-computer coordination.
These flaws predictably create the potential for certain kinds of erroneous actions(e.g., mode errors) and misassessments. As responsible practitioners, the people inthe system attempt to tailor the device and their strategies to insulate themselvesfrom the potential difficulties. Despite their efforts, when other potentiating factorsare present, predictable forms of misassessments and erroneous actions cancontribute to the evolution of critical incidents.
This study adds to the growing body of work that shows how technology- centered development of automation can lead to new types of difficulties inoperation (Billings, in press; Sarter et al., in press). This is not a problem of "over-automation," but rather a problem in the coordination between the automatedsystem and the various stakeholders who use the technology. Making theautomation function as a team player requires designers to attend to the context inwhich the device is to be used and the new kinds of tasks users perform.
Making automation function as a team player requires designing the distributed system of human and machine agents that manages the activity inquestion. The challenge for the human factors community is to steer thedevelopment of medical technology towards user-centered approaches in all facetsof medical care.
Human Factors, 38(4), 574-592, 1996 Billings, C. E. (in press). Aviation Automation: The Search For A Human-Centered Approach. Hillsdale, N.J.: Lawrence Erlbaum Associates.
Cook, R. I., Potter, S. S., Woods, D. D., & McDonald, J. S. (1991). Evaluating thehuman engineering of microprocessor-controlled operating room devices. Journalof Clinical Monitoring, 7:217-226.
Cook, R. I., Woods, D. D., & McDonald, J. S. (1991). Human Performance inAnesthesia: A Corpus of Cases. Cognitive Systems Engineering Laboratory Report,Ohio State University, prepared for Anesthesia Patient Safety Foundation, April.
Cook, R. I. and Woods, D. D. (in press). Adapting to New Technology in theOperating Room. Human Factors.
Cook, R. I., Woods, D. D., & Howie, M. B. (1992). Unintentional delivery ofvasoactive drugs with an electromechanical infusion device. Journal ofCardiothoracic and Vascular Anesthesia, 6: 238-244.
Hutchins, E., Hollan, J., & Norman, D. A. (1986). Direct manipulation interfaces. InD. A. Norman and S. Draper (Eds.), User centered system design: New perspectivesin human-computer interaction. Hillsdale, NJ: Erlbaum.
MiniMed® Model 404-SP Infusion Pump Programming Guide (1988) MiniMed®Technologies, Sylmar, CA.
Model 404-SP Instruction Manual (1988) The MiniMed® Infusion Pump.
MiniMed® Technologies, Sylmar, CA.
Moll van Charante, E., Cook, R. I., Woods, D. D., Yue, L., & Howie, M. B. (1993).
Human-computer interaction in context: Physician interaction with automatedintravenous controllers in the heart room. In H. G. Stassen, editor, Analysis,Design and Evaluation of Man-Machine Systems 1992, Pergamon Press.
Norman, D. A. (1988). The Psychology of Everyday Things. Basic Books, New York.
Reason, J. (1990). Human Error. Cambridge University Press, Cambridge, England.
Sala, D. J., & Moise, K. J., Jr. (1990). The treatment of preterm labor using aportable subcutaneous terbutaline pump. Journal of Obstetric GynecologicalNeonatal Nursing, 19:108-15.
Sarter, N., Woods, D. D., and Billings, C. E. (in press). Automation Surprises.
Human Factors, 38(4), 574-592, 1996 In G. Salvendy, editor, Handbook of Human Factors/Ergonomics, second edition,Wiley, New York, in press.
Woods, D. D. (1995). Towards a Theoretical Base for Representation Design in theComputer Medium: Ecological Perception and Aiding Human Cognition. In J.
Flach, P. Hancock, J. Caird, and K. Vicente, editors, An Ecological Approach ToHuman Machine Systems I: A Global Perspective, Erlbaum, 1995.
Woods, D. D. (in preparation). Visualizing Function: The Theory and Practice ofRepresentation Design in the Computer Medium. Manuscript in preparation.
Woods, D. D., Johannesen, L., Cook, R. I., & Sarter, N. (1994). Behind HumanError: Cognitive Systems, Computers and Hindsight. Crew Systems ErgonomicInformation and Analysis Center, Dayton, OH.
Yue, L., Woods, D. D., & Cook, R. I. (1992) Reducing the potential for error throughdevice design: Infusion controllers in cardiac surgery. Cognitive SystemsEngineering Laboratory Report 92-TR-01.
Human Factors, 38(4), 574-592, 1996 Figure 1. External view of a portable, battery operated micro-processor-basedinfusion pump. This is one example of a class of automated infusion devices(syringe pumps) that deliver small volumes of high concentration medication.
Figure 2. Example therapy in Interval Mode. In this mode, the pump isprogrammed to deliver medication by setting dose size in milliliters (mL) and atime interval between doses. An underlying basal rate can also be set. Figure 2illustrates a therapy plan with continuous basal rate of medication of .05 mL/hourwith boluses (doses) of .25 mL delivered at different time points (programmed as“profiles”): at 12:00 a.m. (profile 1), at 4:00 a.m., 6:00 a.m. (profile 2 - 2 hourintervals), at 8:00 a.m. (profile 3), at 12:00 p.m., 2:00 p.m., 4:00 p.m., 6:00 p.m. (profile4 - 2 hour intervals), and at 8:00 p.m. (profile 5).
Figure 3. Example therapy in Rate Mode. In this mode, the device is programmedto deliver medication by setting a rate in milliliters per hour, with the ability tohave up to six different rates in a 24 hour period. Figure 3 illustrates a therapyplan with an underlying basal rate of .05 mL/hour and four profiles: increasing therate to .10 mL/hour for a six hour interval (profile 1), decreasing the rate to .05mL/hour for a four hour interval (profile 2), increasing the rate to .10 mL/hour fora four hour interval (profile 3), and decreasing the rate to .05 mL/hour for a sixhour interval (profile 4).
Figure 4. An illustration of nested screen displays. The basic operations of thedevice for terbutaline therapy are arranged under seven different displays. Undereach of those screen displays are one to seven different displays.
Figure 5. Mode error can affect the delivery of medication. In the case illustrated,the intended therapy was to be programmed in interval mode, but due to a modeerror, the device was programmed while in rate mode. The contrast between actualdrug delivery and the therapy plan stands out in this representation.
Figure 6. Distributed system for health care when the patient is in the hospital forcontrol of pre-term labor. Compare with Figure 7. Note the patient is cared forwith little participation in the health care process.
Figure 7. Distributed system for health care when the patient remains at homewith an automated infusion device to control of pre-term labor. Compare withFigure 6. The introduction of the infusion device changes the distributed healthcare system. For example, the patient now has an active role in managing her owncare by interacting with the device and informing the health practitioner ofmedication delivery, interventions, and their impact on her status.
Table 1. Procedures performed by the nurse during the initial set up of the device.
Human Factors, 38(4), 574-592, 1996 Table 2. Typical procedures performed by the patient/operator during the dailyuse/operation of the device.

Source: http://csel.eng.ohio-state.edu/woods/medicine/infusion_devices/HF96.pdf