Pattern 11 · Before
Readiness Check
The system confirms the human is actually able to supervise — looking, present, hands available — and escalates when they are not, instead of treating a body in the seat as a human in the loop.
The mechanism
supervision assumed → re-check while running
- 01Supervision assumedA human is nominally responsible
- 02Check itEyes, head position, hands, presence
- 03 · Key momentEscalate when it failsQuietly, then insistently
- 04Act if nobody answersSlow to a stop rather than continue
- 05Re-check while runningAttention lapses mid-task, not before it
At 02: Super Cruise watches with an infrared camera on the steering column, tracking head position and eye movement rather than asking for a periodic wheel tug.
At 03: The ladder runs light bar flashing green, then flashing red with chimes and seat vibration, then a voice prompt to take control.
Without / with the pattern
Anti-pattern: Body in the Seat
Human in the seat, then Attention elsewhere, then Nobody supervising
Body in the Seat: presence is treated as attention. At Tempe the NTSB found the probable cause was the operator's failure to monitor the road and the automation because she was visually distracted by her phone; Uber had cameras watching operators but did not spot-check that they were paying attention.
With the pattern
Attention checked, then Escalating prompts, then Stop if unanswered
The machine verifies the thing it is relying on, and stops relying on it when the check fails rather than continuing on an assumption.
Related patterns
- Precedes · 01The HandoffA takeover request assumes someone is ready to receive it. This is the check that assumption rests on, and the reason the escalation ends in a stop rather than a handover.
- Complements · 07Capability DisclosureDisclosure says where the machine will run; this says whether the human it is counting on is actually there. Both are preconditions checked before engagement rather than claims made in a manual.
- Complements · 12Return of ControlBoth treat the human's state as something to verify rather than assume — one before engaging, one before resuming.
- In tension with · 15Stop AnywhereOne assumes a supervisor who can act; this assumes nobody reliable is watching and gives the stop to whoever is there. Designing for both means deciding whose authority wins.
Sources
The NTSB's framing after Williston was that humans are very poor at monitoring automated systems, and this pattern is the uncomfortable consequence of taking that seriously. If supervision is the safety case, then supervision is a system component, and an unverified component is a guess. Uber had cameras pointed at its operators and did not check what they showed.2 The cameras were not the control; looking at them would have been.
What makes the Super Cruise version work is that the ladder ends somewhere.3 Flashing, chiming and speaking are all ways of asking, and a system that only asks has no answer for the case where nobody replies — which is precisely the case the check exists for. Slowing to a stop is the part that makes the rest honest. The harder question is the one the research leaves open: if a person cannot reliably watch an automated system for an hour, a check that catches them not watching has established something true without making the arrangement sound.