Readiness Check
The system confirms the person can actually supervise (looking, present, hands ready) and escalates when they can't, instead of treating a body in the seat as a person in the loop.
Robotic heart surgery at the Freeman Hospital Draft
February 2015 · Newcastle upon Tyne, England
A patient became the first person in the UK to have his mitral valve repaired with the help of a surgical robot. The lead surgeon had practiced alone on a simulator and watched the procedure abroad, but had no hands-on training with the robot. The two outside experts brought in to support the team left the theater partway through without telling anyone. With the surgeon's head in the console and his voice coming through a tinny speaker, the team struggled to hear him. Stitches went in misaligned, the camera was blinded by blood, and no one had agreed when to stop and convert to open surgery. The heart stayed clamped for more than six hours, and the patient died days later. The coroner found that the death was due in part to the operation being done with robotic assistance.2
Anti-pattern: Body in the Seat Draft
Everyone the procedure depended on was assumed ready because they were in the room or on the schedule. Nobody checked that the surgeon was trained on the robot, that the experts would stay, or that the team had agreed when to stop.
Readiness Check
Therefore: Check that the person can actually supervise (looking, present, hands ready), escalate when they can't, and stop safely if nobody answers.
Simplified illustration.
Without
Driver monitoring
A hand on the wheel is all this check can sense.
With the pattern
Driver monitoring
- PROMPT
- CHIME
- SPOKEN
- STOP
This check watches the eyes. Set them on the phone and play.
The machine verifies the thing it is relying on, and stops relying on it when the check fails rather than continuing on an assumption.
The mechanism
supervision assumed → re-check while running
- 01Supervision assumedA human is nominally responsible
- 02Check itEyes, head position, hands, presence
- 03 · Key momentEscalate when it failsQuietly, then insistently
- 04Act if nobody answersSlow to a stop rather than continue
- 05Re-check while runningAttention lapses mid-task, not before it
On this page
Design considerations
- Measure attention, not presence. Hands on the wheel or a body in the seat doesn't mean someone is watching.3
- Treat supervision as part of the system. If a person watching is the safety plan, it has to be verified like any other component. Uber had cameras pointed at its operators and didn't check what they showed.4
- Escalate in steps. Start quietly, then insist.5
- End the ladder somewhere. Flashing, chiming and speaking are all ways of asking. A system that only asks has no answer for when nobody replies, which is the very case the check exists for. Slowing to a stop is what makes the rest honest.5
- Keep checking while running. Attention lapses during the task, not just before it.
In the field Draft
Observed · Automotive. Tesla, Mountain View. The car checked for hands on the wheel, and hadn't detected them for the last six seconds before it struck a barrier.3
Observed · Automotive. Uber, Tempe. The NTSB found the operator was visually distracted by her phone, and that Uber had cameras watching operators but didn't check that they were paying attention.4 Tempe is the opening story on Provenance Log.
Observed · Automotive. Super Cruise checks attention with an infrared camera on the steering column that tracks head position and eye movement,6 and escalates through a flashing light bar, chimes and seat vibration, then a voice prompt, to a slowdown to a stop if the driver still doesn't respond.5
Related patterns
- Precedes · 01The HandoffA takeover request assumes someone is ready to receive it. This is the check that assumption rests on, and the reason the escalation ends in a stop rather than a handover.
- Complements · 07Capability DisclosureDisclosure says where the machine will run; this says whether the human it is counting on is actually there. Both are preconditions checked before engagement rather than claims made in a manual.
- Complements · 12Return of ControlBoth treat the human's state as something to verify rather than assume — one before engaging, one before resuming.
- In tension with · 15Stop AnywhereOne assumes a supervisor who can act; this assumes nobody reliable is watching and gives the stop to whoever is there. Designing for both means deciding whose authority wins.
Sources
The NTSB has relayed the human-factors finding that drivers are poor at monitoring automation and do not perform well on tasks requiring passive vigilance,3 and this pattern is the uncomfortable consequence of taking that seriously. The cameras weren't the safeguard; looking at what they showed would have been.4 And even a check that reliably catches someone not watching only proves something true; it doesn't make the arrangement sound.
- Trust in Automation: Designing for Appropriate ReliancePaper
- Inquest findings and Regulation 28 Report to Prevent Future Deaths, robotic mitral valve repair at the Freeman Hospital, Newcastle upon TyneIncident
- Collision Between a Sport Utility Vehicle Operating With Partial Driving Automation and a Crash Attenuator, Mountain View, CaliforniaIncident
- Collision Between Vehicle Controlled by Developmental Automated Driving System and Pedestrian, Tempe, ArizonaIncident
- Super CruiseArticle
- Seeing Machines technology enables GM Super Cruise driver assistance systemArticle