4The Design of Everyday Things

Donald A. Norman, The Design of Everyday Things, Basic Books, 1988; revised and expanded edition, 2013

Linked to 28 chapters: supports 13 · contradicts 1 · mechanism 17 · same claim 3 · pairing 2

Norman opens the book by admitting that he cannot work doors. He pushes doors meant to be pulled, pulls doors meant to be pushed, and walks into doors that do neither but slide. The trouble is common enough that confusing doors are named after him, a distinction he notes was probably not what his parents had in mind. From the door he builds the argument the rest of the book carries out. A door has two possible operations and no moving parts worth the name, so when a person cannot tell which side to push, the fault lies with a designer who hid the pillar and the hinge for the sake of a clean front, leaving nothing to say where the supported edge is. What the door lacks is what every designed thing needs: discoverability, so that a person can work out what actions are possible and where to perform them, and understanding, so that its controls and states mean something. Norman names the six principles that produce both — affordances, signifiers, mappings, feedback, constraints and the conceptual model — and spends the book showing what happens when each is missing. A refrigerator whose two dials cannot be set is an annoyance; a control room whose displays misled the operators at Three Mile Island, an accident Norman was called in to analyse and which changed how he thought about design, is not. His conclusion is a flat refusal of the usual verdict: what gets filed as human error is nearly always design error, and the remedy is to change the thing, not to retrain or punish the person.

The psychopathology of everyday things

The story that opens the book belongs to a friend of Norman's, trapped in the entrance of a European post office: six glass swinging doors, then a second identical row, no visible hardware, so the doors evidently swung either way and all one had to do was push. He pushed one, went through, turned around for an instant and drifted slightly to the right, and after that nothing moved — not the next door, not its neighbour, not the door he had just come through. A swinging door has a pillar and a hinge on one side and nothing on the other, and the designer had hidden both in the interest of beauty; the man had been pushing on the hinges.

Affordance is the older term, taken from J. J. Gibson. An affordance is not a property of an object but a relation between an object and an agent: what that particular person, with that strength and reach, can do with that thing. A chair affords sitting for anyone and lifting only for someone strong enough. Glass affords seeing through and blocks passage, a combination Norman calls an anti-affordance.

Signifiers are the 2013 addition, and the preface explains why. Designers had adopted affordance immediately after the first edition and used it for something neither Gibson nor Norman meant: the circle drawn on a screen to show where to touch. Norman argued with them for years, lost, and decided the fault was his for not supplying the word they actually needed. Affordances determine what actions are possible; signifiers say where the action goes. A signifier is any perceptible mark that communicates appropriate behaviour, and it need not be deliberate: an airport windsock and a flag flown out of national pride do the same job once a person reads the flag for wind. For designers, signifiers matter more than affordances, and a hand-lettered sign taped to a door is an admission that the design failed.

Mapping is the relation between two sets, controls and the things they control, and Norman's example of it done well is the Mercedes-Benz seat adjuster, a control shaped like the seat itself: lift the front of the button to raise the front of the cushion, push the back back to recline. Feedback reports what an action did, and must arrive within about a tenth of a second, say what happened rather than merely that something did, and be ranked, because a device that announces everything is a device whose announcements get switched off.

Constraints Norman postpones. The sixth principle, and the one he says gives real understanding, is the conceptual model: a simplified explanation of how something works, which need not be complete or correct so long as it is useful. Scissors carry theirs on the outside — the holes are affordances and signifiers at once, their sizes constrain which fingers go where, and nothing is hidden. His Junghans radio-controlled watch carries none: five buttons, no hints, different meanings in different modes, and he cannot remember how to use it.

The most-copied example is the refrigerator he used to own. Two compartments, freezer and fresh food, two dials labelled to match, and a manual advising that one wait twenty-four hours after each adjustment for the temperature to settle. The controls implied that each dial governed the compartment named on it, which would require two thermostats and two cooling units. In fact there was one of each: one dial set the temperature, the other divided the cold air between the compartments. Given the model the controls implied, no amount of care would have worked; given the correct model, Norman still could not set it, because nothing revealed which dial was which or where the sensor sat, and the feedback took a day. Twenty-five years of grateful letters from readers followed, and none from the manufacturer, still selling the same arrangement while he prepared the revision.

Out of the refrigerator comes the triangle that organises the rest of the book. The designer holds a conceptual model of the product; the user builds one too, out of the thing's appearance, its behaviour, its manual, other things like it. Between them sits the product itself, no longer with the designer, and Norman calls everything perceivable from it the system image. Designer and user occupy disconnected corners and cannot speak to each other, so the whole burden of communication falls on the system image. This is also the paradox of technology: every function added to a device makes the device harder to learn, so the same advance that simplifies life complicates it.

The psychology of everyday actions

The second chapter opens with Norman's landlady in England, who could not open a metal filing cabinet, watched him wiggle it, twist the front panel and finally bang it with his palm until it slid open, and then apologised: she was so bad at mechanical things. Norman's reply is that the cabinet should have been apologising for being so bad with people. Her real difficulty was that when her plan failed she had nothing to fall back on, having no model of the mechanism inside.

Between wanting something and getting it lie two gaps. The Gulf of Execution is the distance between a person's intention and the actions the thing will accept: what can be done here, and how. The Gulf of Evaluation is the distance between what the thing then does and the person's ability to tell whether it worked. Signifiers, constraints, mappings and a conceptual model bridge the first, which Norman calls feedforward; feedback and the same model bridge the second.

The stages he derives from a dusk-lit armchair. He is reading; the light fades; the goal of reading fails and a new goal forms, more light. He could open the curtains, move, or switch on a lamp — that is planning. Having chosen the lamp he must still settle which hand and which motion — that is specifying. Then he acts. Then three stages run the other way: he perceives the state of the world, interprets it, and compares the outcome with the goal. Seven stages in all, most of them subconscious: a skilled driver thinks left and the sequence executes itself, while a learner must attend to each brake, mirror and signal separately. Asking why a goal is a goal leads upward, and Norman calls that a root cause analysis. He uses it to correct a line of Theodore Levitt's, that people do not want a quarter-inch drill but a quarter-inch hole. Levitt stopped too soon: nobody wants the hole either, they want the shelves up, which leaves open the possibility of shelves that need no holes.

The revision lays emotion over the same cycle as three levels of processing: the visceral, which hands the designer the whole domain of appearance and sound; the behavioural, where learned skill runs and every action carries an expectation that the feedback confirms or disappoints; and the reflective, which assigns cause and blame and supplies the memory that outlasts the use of the thing.

People are storytellers, Norman goes on, and a conceptual model is a kind of story, which is why folk theories flourish: most people believe a thermostat is a valve, so that turning it to maximum heats the room faster, when in most homes it is a switch and the extreme setting only makes the room overshoot. The same storytelling misdirects blame. When our own behaviour is odd we blame the circumstances; when someone else's is odd we blame their character. With everyday objects the pattern inverts, people blame themselves, and because each believes the difficulty is private, nobody reports it. Norman once evaluated a computer on which pressing Return where Enter was wanted destroyed the last few minutes of work. The designer replied that nobody had complained in months of use, and asked whether Norman had read the manual; they went and asked the staff, who said yes, they did that a lot. They had reported every fault the system produced and none of their own, because they had been told what to do and had simply erred. Repeated failure of this kind produces what psychologists call learned helplessness, and Norman suggests the design of everyday things manufactures it so reliably that it deserves to be called taught helplessness.

Knowledge in the head and in the world

Norman borrowed a friend's older Saab and found a note: to get the key out of the ignition, the car must be in reverse. Nothing in the car said so. That knowledge could live only in the head, and without it the key stayed in the ignition for good.

Most knowledge is not like that, and the demonstration is Nickerson and Adams's study of the American penny, published in 1979. Shown a set of drawings of one-cent coins, fewer than half of American college students could pick out the real one, and the result holds for currencies elsewhere. It has never stopped anyone spending money. Precise behaviour comes out of imprecise knowledge because knowledge is distributed between the head and the world, because great precision is rarely needed — only enough to tell the right choice from the wrong ones actually present — and because the physical world and cultural convention rule most options out.

Which is why changing the options is dangerous. In October 1986 France released a ten-franc coin near enough in size and weight to the half-franc that the public confused a coin worth about a dollar and a half with one worth eight cents; five weeks later the finance minister suspended it, and four weeks after that he cancelled it. The United States had done the same with the Susan B. Anthony dollar against the quarter, and Britain with the pound against the five-pence piece. Long-term British residents confused the new pound coin; newcomers and children, forming their descriptions from scratch, did not.

Constraints do the same work inside memory. Norman sets two puzzles: name three words meaning a mythical being, a building material and a unit of time; then name three words rhyming with post, eel and ear. Neither is solvable. Told that the two sets are the same words, almost everyone produces ghost, steel and year, which is what David Rubin and Wanda Wallace found in the laboratory. Short-term memory itself holds something like five to seven items and, for design purposes, is better assumed to hold three to five; distraction wipes it, which is why nurses write patient data on their hands when a privacy timeout logs them out mid-task.

What people use in place of precision is approximation. Professor Yutaka Sayeki could not remember which way to push the turn-signal switch on his motorcycle's left handlebar until he stopped thinking about the direction of the motorcycle and thought instead about the handlebar, which moves back for a left turn and forward for a right, exactly as the switch does. The model is wrong — a motorcycle is turned left by first steering right, so that the rider leans — and it works. Science needs truth; practice needs an answer good enough for the purpose.

Natural mapping is where head and world meet, and the case is the kitchen stove. Four burners, four controls, one to one, and people turn on the wrong one often enough to burn dinner and occasionally the house. The burners sit in a rectangle and the controls in a line, and mapping one dimension onto two leaves four possible arrangements even when each pair of controls governs the burners on its own side. All four are sold, sometimes side by side in one manufacturer's catalogue. Two fixes need no new parts: put the controls in a rectangle too, or stagger the burners so that they have an order from left to right. Best of all, Norman adds, is a control mounted on the thing it controls, and next best one adjacent to it.

The new section in the chapter is about culture, and it starts with a presentation remote Norman was handed in Asia. Two buttons, one above the other; he pressed the top one to advance and went backwards. Asking the audience, he found them split, and has found every audience since split, each half astonished the other exists. The question is not which button is correct but what is understood to move: some picture themselves moving forward through the slides, others picture the slides moving toward them. Cultures differ the same way about time — the Aymara of South America put the past in front, where it can be seen, and the future behind — so what feels natural in a mapping depends on a metaphor that is not shared.

Knowing what to do

The chapter on constraints opens with a fifteen-piece Lego motorcycle that a novice can assemble without instructions, because four kinds of restriction between them leave close to one way of doing it. Physical constraints limit what can be done at all — the peg fits the hole or it does not — though Norman complains that they usually work only after the attempt, where a visible constraint would have prevented it. Cultural constraints supply the script for a situation, so that a person who has never been in this restaurant knows what happens next; they are learned, they drift, and to violate one is to be marked as an outsider. Semantic constraints follow from what the thing means: a rider faces forward, so the windscreen goes in front. Logical constraints are the ones that leave one piece and one empty place.

Where a constraint is set directly across the path of an error, Norman calls it a forcing function, and he sorts them three ways. An interlock forces the order of operations: the microwave stops when the door opens. A lock-in keeps an operation going until it is properly finished, which is what the prompt to save before quitting does, and which companies also use less benignly to keep customers inside a format. A lockout keeps a person out of somewhere dangerous, as with the gate American fire codes require across a basement stairway so that people fleeing a fire do not run downward.

The chapter's long personal case is light switches, and it ends with Norman building his own panel, laid out as a plan of the house with each switch where its light is, because a row on a wall carries no mapping at all. The same lesson appears in a harsher setting: a report on small aircraft whose flap switch and landing-gear switch look and feel alike, with the National Transportation Safety Board noting that the fix has been known for fifty years. Norman's name for the missing step is task analysis, the observation of how the work is actually done, and he observes that electricians are not trained to do it. Where even that fails, he says, standardise — the principle of desperation, arrived at after enumerating every way a bathroom tap can be controlled and finding a mapping problem in all of them.

Human error? No, bad design

Estimates put the share of industrial accidents blamed on human error between seventy-five and ninety-five per cent. Norman's response is arithmetical: if the figure were one to five per cent he might believe people were at fault, but at ninety per cent something else is going on. When a bridge falls we change the design rules; when a person fails we assign blame and carry on exactly as before.

human error usually is a result of poor design

Root cause analysis is supposed to prevent this, and Norman's complaint is that it stops the moment a human appears in the chain. When a machine fails we ask why the part broke, whether the specification was too low, what applied the load; when a person fails we stop. His example is the crash of an F-22 in 2010 that killed the pilot. The Air Force investigation, released in 2012, blamed the pilot for failing to recover from a dive; in 2013 the Inspector General's office asked why sudden incapacitation or oxygen deprivation had not been considered, and the Air Force replied that its finding was supported by clear and convincing evidence. Norman parodies the exchange in three lines: it was pilot error, because the pilot failed to act; that is because he was probably unconscious; so you agree, the pilot failed to act.

The procedure he recommends instead is the Five Whys, developed by Sakichi Toyoda and used inside the Toyota Production System: when you have found a reason, ask why that was the case, and keep asking. The number is not five, and the method guarantees nothing, since why is ambiguous and its form implies a single cause where complex events have many. Norman once reviewed a set of electrocutions at an electric utility where every committee found the worker at fault, and so did the surviving workers; nobody asked what circumstances had produced the error, because to change the procedures would have meant changing a culture in which the field crews believed they made none. Years later he asked a friend at the company what had changed. Nothing had, and they were still injuring people.

The taxonomy is the part of the chapter designers use. A slip occurs when the goal is right and the action is not: Norman pours milk into his coffee and puts the cup in the refrigerator. A mistake occurs when the goal or the plan is wrong, so that correct execution makes matters worse. Slips arise in the lower stages of the action cycle, mistakes in the upper three, and memory lapses strike at either height; slips are commoner in experts, precisely because expert action runs without conscious attention.

Three kinds of slip bear on design. A capture slip happens when two sequences share an opening and the more practised one takes over; a colleague counting photocopies aloud reached ten and continued with jack, queen, king, having been playing cards, and the lesson is to design procedures that differ from the first step, not the fifth. A description-similarity slip acts on the wrong object because the internal description was not discriminating enough, as when a student throws his running shirt into the toilet instead of the laundry basket; rows of identical switches invite it, which is why aircraft controls are shape-coded so that the flap lever feels like a flap and the landing-gear lever like a wheel. A mode error happens when the same control means different things in different states, which is unavoidable once a device has more functions than controls. An Airbus crew descending to land believed they were setting an angle of descent and had in fact selected vertical speed, so that the figure 3.3 meant three thousand three hundred feet a minute rather than about eight hundred; afterwards Airbus changed the display so that vertical speed always shows four digits and angle two.

Mistakes Norman sorts using Jens Rasmussen's three modes of behaviour. Skill-based behaviour is the routine work of an expert and produces slips. Rule-based behaviour applies a known procedure to a recognised situation, and its mistakes come from recognising the situation wrongly or from following a rule that was badly framed: at the Kiss nightclub in Santa Maria, Brazil, in 2013, guards at first stopped people leaving a burning room because patrons sometimes left without paying, a rule written for one emergency and not the other. Knowledge-based behaviour is what remains when neither skill nor rule applies, and there the only real help is a good conceptual model. Rule-based mistakes are hard to catch because the evidence usually supports the wrong classification as well as the right one, and because hindsight makes the signal look obvious afterwards; Baruch Fischhoff's subjects could not predict outcomes above chance, yet judged the actual outcome plausible once told.

Social pressure runs underneath all of it. At Tenerife in 1977 a KLM 747 began its takeoff roll without clearance and struck a Pan American 747 taxiing on the same runway in fog, killing five hundred and eighty-three people; the first officer had raised a mild objection to one of the airline's most respected captains and let it go. The remedies are institutional as much as technical. Checklists work, and work best when two people run them, one reading and one doing, which is why aviation requires them and why medicine long resisted them as an insult to professional competence. Reporting must be safe, which is why NASA runs the aviation reporting system, why a pilot who files is exempted from penalty for minor infractions, and why Toyota's jidoka punishes failure to report rather than the error itself.

Behind the taxonomy sits James Reason's Swiss cheese. Each slice is a condition or a defence, and each has holes; an accident requires the holes in every slice to line up. Two conclusions follow. Do not look for the cause of an accident, because there is not one: every if only in the record is true and none of them is it. And accidents fall when you add slices, shrink holes, and make the slices unlike one another so that their holes do not align — what the chair of the American safety board calls design redundancy and layers of defence.

He allows that people are sometimes genuinely at fault — drunk, sleep-deprived, or deliberately violating a rule they know — and observes that hospitals demand of their staff hours of wakefulness that would ground a pilot. The closing move is resilience engineering, whose founding authors he quotes to the effect that safety is not a commodity to be counted, since it shows itself only in the events that do not happen. He ends on automation, which takes over dull work well, gives up on the complex just when it is needed, and fails without warning while the person is out of the loop. The cruise ship Royal Majesty ran aground on Cape Cod in 1997 after its navigation system quietly fell back to dead reckoning, a change announced by two small letters on a display nobody had needed to read for years.

Design thinking, and the business around it

The two chapters written new for 2013 begin with a rule Norman uses in consulting: never solve the problem he is asked to solve, because the stated problem is a symptom. Designers, unlike engineers and managers, are trained to widen the question before narrowing it, which from outside looks like going backwards. He gives the discipline two instruments. The first is the British Design Council's double diamond of 2005: diverge and converge once to find the right problem, then again to find the right solution. The second is the human-centred design cycle of observation, idea generation, prototyping and testing, repeated — observation meaning applied ethnography, because what people report doing and what they do diverge, and testing meaning small numbers and many rounds. Norman's own extension is activity-centred design, on the grounds that activities travel across cultures better than individuals do; a car's pedals, wheel, mirrors and gauges are shaped by driving rather than by drivers.

Then the chapter turns on itself with a section saying that none of this is how it really works. Norman's law of product development is that on the day the process starts it is behind schedule and above budget; he recounts a four-week deadline set by nothing but the date a factory in Spain would close for Christmas, and a scripted conversation in which design research is cut with a promise to do it next time, except that there is never a next time. Products must also satisfy people who will never use them, a purchasing department buying copiers on price and a feature list. Standards take so long that technology overruns them: Norman sat on the American high-definition television fight as Apple's representative, and the committee emerged in 1996 with several standards and two aspect ratios, about ten years before adoption and some thirty-five years after the Japanese work began.

The last chapter is about what business does to products. Featuritis is the disease and creeping featurism the symptom: existing customers ask for additions, competitors force matching, and a saturated market needs a reason to sell an upgrade. The Lego motorcycle that needed no instructions in 1988 has twenty-nine pieces in 2013 and comes with an instruction sheet. Against the wish for radical innovation Norman sets the record. Incremental innovation is hill climbing, one small step at a time, and can only reach the top of the hill it starts on; radical innovation tries a different hill and usually fails. The videophone was drawn in Punch in 1878, worked in the 1920s, was sold in Germany in the 1930s and in America in the 1960s, and became ordinary only in the 2010s; multitouch was built at the University of Toronto in the early 1980s and took nearly three decades to reach a pocket. Sholes's keyboard was arranged in the 1870s to stop the typebars of frequently paired letters jamming, not to slow typists, and Norman's own laboratory found Dvorak's 1930s layout only slightly faster, which was not enough to retrain the world.

Since 1988

Norman set out to update the examples and rewrote everything, and his summary of the result is five words long.

What has changed? Not much. Everything.

The principles held; the illustrations had not. Students were asking what a slide projector was, and neither the mobile phone nor the internet had been in general use when the first edition was written.

Four additions define the revision. The first is signifier, added because the design community had taken affordance and used it for something else, and because Norman decided after years of correcting them that the word they needed did not exist and he had better supply it. That surrender is the most honest passage in the book, and it is also evidence for the book's own thesis, since a term thousands of trained readers consistently misread was, by Norman's own standard, badly signified. The second addition is emotion, imported from Emotional Design and laid over the seven stages as three levels of processing. The third is culture, which qualifies the word natural in natural mapping: the presentation remote that split his audiences shows that a mapping natural under one metaphor of time is backwards under another. The fourth is the error taxonomy, cut back to the distinctions that change a design and extended so that memory lapses can produce either a slip or a mistake.

Two chapters are new outright, and they have aged the fastest. Norman had been an academic when he wrote the first edition and an executive at Apple and Hewlett-Packard by the time he wrote the second, and those two chapters are where that shows. The double diamond and the observe-ideate-prototype-test loop are now taught as method almost everywhere, and the backlash against them — that they promise creativity by procedure, and that a workshop with sticky notes is no substitute for knowing a domain — is aimed at a practice Norman helped popularise, though his own sections on budgets and cancelled research anticipate most of the complaint.

The error material has travelled furthest. Slips and mistakes, and the argument that blame stops an investigation where it should start it, are now standard in aviation, medicine and industrial safety, and the medical resistance to checklists Norman describes has substantially given way. Reason's Swiss cheese has had a harder time, criticised for making accidents look linear and safety look like what remains once failures are subtracted — a criticism pressed hardest by the resilience researchers Norman himself quotes, who went on to argue that safety is better studied through the work that goes right than through counts of what went wrong.

Some of the 2013 examples have already dated in the way Norman feared, though he had guarded against it by avoiding named companies where he could, on the reasoning that nobody remembers the companies of twenty-five years ago. The door is still there, the refrigerator is still there, and the stove burners are still in a rectangle above a row. The one claim left standing without much evidence is the strong form of the title argument, that human error is essentially always design error; Norman qualifies it himself in a short section admitting that drunk drivers and sleep-deprived surgeons are at fault, and sets deliberate violations aside as another subject. What remains is not a proof but a rule of investigation — keep asking why past the point where a person appears. Norman wrote the second edition to last until 2038.