Week 10: Cry wolf: trust and alarm fatigue

What happens to a warning system's credibility the tenth time it's wrong, and why the driver-assistance features most likely to matter are also the ones most likely to get switched off

26 April 2027

Open the slides

A warning that never fires isn’t being watched — nobody knows whether it works. A warning that fires constantly isn’t watched either — the driver has learned it doesn’t need to be. The only zone where a warning does its job sits narrowly between those two failures, and a real driver-assistance system drifts out of it easily. The guiding question: what happens to a warning system’s credibility the tenth time it’s wrong?

Trust is a resource, and every false alarm spends it

Earlier weeks treated an alert as a message with a fixed meaning — this colour means this urgency, this icon means this fault. What they didn’t model is that a driver’s response isn’t fixed; it’s a running average of every previous time this exact alert fired and what happened next. If a lane-departure warning has chimed nine times on a familiar commute for nine faded lane markings and zero actual departures, the driver reaches the tenth chime already having decided, unconsciously, that this alert is noise. The system hasn’t changed. The driver’s model of it has.

A driver's-eye dashboard view showing an illuminated lane-departure warning icon overlaid on a windscreen view of a road with faded, inconsistent white lane markings and no other visible hazard
Fig. 10.1 — A technically correct alert and a wasted one at the same time: the markings really are ambiguous, and the driver’s trust drops regardless of whether the sensor was “right.”

Two things this isn’t

It’s tempting to treat a false alarm as a bug to be fixed, and the driver who disables the alert as careless. Neither holds up. Forward-collision and lane-departure systems trade false positives against missed detections as a matter of tuning: a threshold set to catch every genuine lane departure will also catch faded paint and unsignalled lane changes, because the sensor can’t always tell those apart from the outside. Loosen it and missed detections rise instead — the false-alarm rate a driver experiences is a chosen output of where a manufacturer set that threshold, and manufacturers have made visibly different choices. And reduced response to an unreliable signal is a well-documented perceptual response to any alert that fires more often than it’s informative, holding whether the operator is a driver, a nurse, or a pilot — attention is finite, and a signal proven uninformative is, correctly, no longer worth spending it on.

Case study: from the cockpit to the dashboard

Alarm fatigue was studied first, and most rigorously, in aviation. Cockpit alarm research through the 1970s–80s, prompted by accidents in which pilots had silenced or ignored a correct warning after a string of false ones, established the basic finding: as an alarm’s positive predictive value drops, trained operators reliably slow their response to it, and eventually stop responding at all.

A photograph of a vintage commercial airliner cockpit instrument panel showing rows of amber and red annunciator warning lights alongside a prominent master caution indicator light
Fig. 10.2 — Where the research started: a panel of alarms trained crews learned to distrust one false trip at a time.

That same research lineage now studies ADAS directly. Lane-departure and forward-collision warnings show meaningful false-positive rates under specific conditions — faded lane markings, tight urban curves, a stopped vehicle on an overpass read as a collision hazard — and survey data consistently finds a share of owners disabling these features over alerts they judged unnecessary. The mechanism is identical to the cockpit case: the alert that fires wrongly the tenth time is the one already distrusted by the time it might, on the eleventh, be right. A synthesis worth taking from both literatures is graded, confidence-scored alerting — a soft cue for an ambiguous case, a hard cue reserved for high-confidence ones — rather than one binary alarm for every confidence level.

A screenshot of an online consumer complaint or forum post in which a car owner describes repeated false lane-departure or collision warnings on a specific road condition, and states that they disabled the feature as a result
Fig. 10.3 — The tenth false alarm doesn’t just fail to warn — it produces this: the feature turned off, on purpose, by the owner.
This week’s channel, against the framework

Alarm fatigue itself, read against the six-question framework introduced in week 1: urgency the system still states plainly, even after the driver has stopped believing it; visibility unchanged, foveal or peripheral depending on the alert type; meaning technically intact but functionally degraded — the icon still means what it always meant, the driver just no longer trusts that meaning; modality typically visual and audible together, same as week 6; timing, the variable that actually does the damage — a system that fires too often trains its own timing into irrelevance; and a required action the driver increasingly substitutes with a different one entirely: turning the feature off. The framework’s five other dimensions can all be individually correct and the system can still fail, because trust decays across repeated firings, not within any single one.

No assessment is due this week. Next week: what happens when the same alert crosses a border, tuned to a different threshold of “urgent enough” under Euro NCAP, NHTSA and Japanese regulation.

Teaching team