Appropriate Friction

The harder an action is to undo, the more deliberate the interface makes it.

Therac-25 radiation therapy machine

March 21, 1986 · Tyler, Texas

A patient lay on the treatment table while the operator, in the next room, typed in his prescription. She mistyped one setting and corrected it within seconds, and the correction triggered a flaw in the machine's software: it fired a beam far stronger than prescribed. The console said the opposite. It showed “MALFUNCTION 54,” a pause marked low priority, and a dose of 6 units against the 202 she had asked for — an underdose. Malfunction messages were commonplace on this machine and most of them meant nothing, so she pressed P to proceed, the routine fix. He had felt the first shock and was getting up to go for help; the video monitor was unplugged and the intercom was broken, so she neither saw nor heard him. He died five months later, one of six patients the Therac-25 overdosed between 1985 and 1987.4

Anti-pattern: One-Tap Catastrophe

The most dangerous action on the console, carrying on after a malfunction, took one keystroke. And because the machine raised malfunctions constantly, the pause meant nothing: operators had learned that proceeding was normal. Earlier models carried hardware interlocks that physically prevented this kind of overdose — on the Therac-20 the same software bug only tripped a breaker. The Therac-25 did not duplicate them all, and leaned on software instead.

Appropriate Friction

Therefore: Make irreversible actions deliberately harder than routine ones, say exactly what will happen, and keep that friction rare enough to still mean something.

Without

Drone payload release

Zone
B
Altitude
120 m
Payload
Armed

Tap to release the payload.

With the pattern

Drone payload release

Zone
B
Altitude
120 m
Payload
Armed

Hold for two seconds. Let go early and nothing happens.

A pause that restates the consequence catches slips before they become incidents.

The mechanism

intent → execute + log

  1. 01IntentOperator starts an action
  2. 02Weigh stakesReversible? Who’s affected?
  3. 03 · Key momentAdd frictionConfirm, delay or second trigger
  4. 04CommitRe-affirm with the consequence shown
  5. 05Execute + logAction runs, provenance kept

At 02: Friction scales with consequence. Low-stakes, reversible actions stay fast.

At 04: Restate the consequence (“Release payload over zone B”), never just “Are you sure?”

On this page

Design considerations

  • Reserve friction for what can't be undone. A pause that appears everywhere gets cleared from habit, and then it protects nothing.43
  • Name the consequence, not the doubt. “Release payload over zone B” makes the operator check; “Are you sure?” only makes them click.
  • Treat frequent warnings as a defect. The Therac-25 raised malfunction messages constantly — one clinic logged an average of 40 dose-rate faults on some days — and most of them meant nothing, so clearing them became routine. Every warning that doesn't need action trains people to ignore the one that does.4
  • Don't let software be the only safeguard. The Therac-25's predecessors had hardware interlocks that made the same bug harmless. Its makers chose not to duplicate them all and leaned on software instead, and the software failed.4
  • Scale friction with the stakes. Routine, reversible actions stay fast; a hold, a delay or a second trigger is for the rest.2

In the field

Observed · Medical. Therac-25: carrying on after a malfunction was one keystroke deep, on a console whose malfunction messages were commonplace enough that clearing them was the normal thing to do.4

Observed · Aviation. On a Boeing 737 flight management computer, a route change is held as a modification rather than flown: the page title reads MOD, an ERASE prompt appears, and the EXEC key lights. The new route does not take effect until EXEC is pressed.5

Sources

  1. Design Frictions for Mindful Interactions: The Case for MicroboundariesAnna L. Cox et al. · 2016Paper
  2. A Model for Types and Levels of Human Interaction with AutomationRaja Parasuraman, Thomas B. Sheridan and Christopher D. Wickens · 2000Paper
  3. Humans and Automation: Use, Misuse, Disuse, AbuseRaja Parasuraman and Victor Riley · 1997Paper
  4. An Investigation of the Therac-25 AccidentsNancy G. Leveson and Clark S. Turner · 1993Incident
  5. The Boeing 737 CDU/FMC ExplainedArticle