Can a Forcing Function Stop Mistakes
A forcing function removes the option instead of warning against it. Seat belts, drink-driving interlocks and a false missile alert show what that buys, what it costs, and why a confirmation prompt is not one.
Answer to the question
Can a forcing function stop mistakes?
Yes, while it stays in place. A forcing function removes the option instead of warning against it. In one randomised trial, drivers with an alcohol interlock fitted reoffended less often (relative risk 0.36), yet no trial showed a lasting effect after removal, and Congress ended the 1974 seat belt interlock.
Key takeaways
- A forcing function removes the option instead of warning against it, and Don Norman sorted the family into interlocks, lock-ins and lockouts.
- A Cochrane review led by Charlene Willis in 2004 found that in the one randomised trial, drivers with an alcohol interlock fitted reoffended less often (relative risk 0.36), and no trial showed a lasting effect once it was removed.
- The 1974 seat belt interlock was ended by an act of Congress signed on 28 October 1974, and the record describes the systems as intensely unpopular with drivers.
- In Hawaii in 2018 the FCC found no procedure stopped one person sending a missile alert, and the false alert took 38 minutes to correct. A confirmation prompt asks one person to decide twice, and the agency's fix was a second credentialed officer.
On American passenger cars of the 1974 and 1975 model years, an interlock tied the ignition to the seat belts. Unbuckled, the engine would not start.
The practical rule is short. Where one costly mistake keeps happening in the same place, stop asking people to be careful and remove the option. Designers call the result a forcing function, and Don Norman sorted the family into interlocks, lock-ins and lockouts, as the designer Dan Lockton summarises him. A forcing function works on the situation, not on the person standing in it, so it holds when attention does not. It has two costs, and the cases below show both: people resent it, and it teaches nothing that survives its removal.
Two interlocks and what each one cost
The requirement for this forcing function sat in Federal Motor Vehicle Safety Standard 208, section S4.1.2, until 29 October 1974. The National Highway Traffic Safety Administration then deleted it, because recent legislation had mandated that. President Ford's signing statement of 28 October, on the act approved the day before, says it "does away with the so-called seat belt interlock systems". The record describes them as intensely unpopular with drivers.
NHTSA's own later letter is plain about what changed. The interlock was not banned, but manufacturers could no longer use it to meet the standard. Compliance moved to lap and shoulder belts in the front outboard seats, lap belts elsewhere, and a reminder system.
Norman, quoted by Lockton from The Psychology of Everyday Things, tells designers to decide whether people will deliberately disable a forcing function. Here the disabling happened in a legislature. This forcing function removed a choice drivers believed was theirs, and drivers had a vote. That is our reading of the episode, not a finding of the sources cited.
The same forcing function later turned up in drink-driving law, with a breath test standing between the driver and the starter motor. A Cochrane review published in 2004 by Charlene Willis and colleagues gathered the controlled trials. In the one randomised trial, drivers with an interlock fitted reoffended less often than controls while it was in the car, with a relative risk of 0.36 and a 95 per cent confidence interval of 0.21 to 0.63. The non-randomised trials broadly agreed.
The reviewers rate most of the studies as not high quality, and few offenders choose to have a device fitted, which limits what can be concluded about how well the result would carry to everyone convicted.
No trial, randomised or not, showed a lasting benefit once the device was removed. A forcing function does not teach. It holds the line for as long as it is fitted, and the behaviour it was built to stop comes back when it goes.
A forcing function does not teach. It holds the line for as long as it is fitted.
A confirmation prompt is not a constraint
On 13 January 2018 a warning officer at the Hawaii Emergency Management Agency sent a ballistic missile alert to phones across the state at 8.07 am. The correction came at 8.45, 38 minutes later. The Federal Communications Commission's Public Safety and Homeland Security Bureau reported that the officer believed the threat was real, having heard "this is not a drill" but not "exercise, exercise, exercise" in the drill recording. Other officers on the watch floor recognised an exercise. No procedure prevented a single person from sending the alert, and the software asked "Are you sure that you want to send this Alert?" in the same words for a test and a live message.
A confirmation box asks the same person to decide twice. A forcing function makes the alert unsendable until a second person acts. The agency adopted exactly that, according to the FCC's remarks of 30 January 2018: two credentialed warning officers must sign in and validate every alert and test. The Bureau's final report spread the fault across a person, a shift handover and a system with no second check.
A confirmation box asks the same person to decide twice.
Cliff Kuang and Robert Fabricant use the episode in User Friendly (2019), alongside two fatal vehicle-automation cases, as an example of blame landing on the user. Kuang's phrase for the move is that blaming the user is "the most comforting message because it means that the least has to change". The older cockpit version of that argument is in [When the Design Is to Blame, Not You](https://thewhyweproject.com/articles/when-the-design-is-to-blame-not-you).
Choosing what to constrain
Norman's three kinds ask different questions. An interlock asks what must be true before the next step: belts fastened, breath clean, a second officer signed. In our plain terms, a lock-in asks what must not be allowed to stop, and a lockout asks what must not be allowed to start or be entered.
Our reading of the three cases gives three tests before building a forcing function. The mistake must be costly. It must recur in the same place. And any legitimate exception needs an exit that leaves a trace, such as a second person or a log, because a constraint with no exit is the one people remove.
A forcing function also differs from its softer relatives. A default, as in [Why You Never Change the Setting](https://thewhyweproject.com/articles/why-you-never-change-the-setting), can be undone with a click. The same machinery can be aimed at the user rather than for them, as in [The Sludge That Keeps You Subscribed](https://thewhyweproject.com/articles/the-sludge-that-keeps-you-subscribed). The difference is who the constraint serves, and whether the person it binds would agree to it on a calm day.
An organisation that answers a recurring catastrophic error with a poster has not avoided the cost of a forcing function, because it has handed that cost to whoever stands at the screen on the one bad day, who must then supply the attention the system declined to build in.
Common questions
Can a forcing function stop mistakes?
Yes, while it stays in place. It removes the option instead of warning against it, but the evidence here shows people resent it and the effect does not outlast it.
What is a forcing function in design?
A built-in constraint that makes the intended action the only available one, so the outcome does not depend on the person remembering or choosing. Norman's three kinds are interlocks, lock-ins and lockouts.
Do forcing functions change behaviour for good?
The evidence here says not by themselves. In a Cochrane review, drink-driving interlocks reduced reoffending while fitted, and no trial showed a lasting effect after removal.
Is a confirmation dialog a forcing function?
Not in the strict sense. It leaves the same person to decide again. A second person's validation, or a step that cannot be skipped, removes the option instead.
Sources
Kuang, C., & Fabricant, R. (2019). User Friendly: How the Hidden Rules of Design Are Changing the Way We Live, Work, and Play. New York: MCD / Farrar, Straus and Giroux
Willis, C., Lybrand, S., & Bellamy, N. (2004). 'Alcohol ignition interlock programmes for reducing drink driving recidivism.' Cochrane Database of Systematic Reviews, CD004168. doi:10.1002/14651858.CD004168.pub2
Ford, G. R. (1974). “Statement on Signing the Motor Vehicle and School Bus Safety Amendments of 1974.” 28 October 1974. The American Presidency Project. https://www.presidency.ucsb.edu/documents/statement-signing-the-motor-vehicle-and-school-bus-safety-amendments-1974
National Highway Traffic Safety Administration (1974). “Interpretation of Federal Motor Vehicle Safety Standard 208, S4.1.2: ignition interlock deleted 29 October 1974.” NHTSA interpretation letter. https://www.nhtsa.gov/node/127646
Wiley, J. (2018). “False Emergency Alert in Hawaii.” Remarks, Federal Communications Commission Open Meeting, 30 January 2018. https://docs.fcc.gov/public/attachments/DOC-348923A2.pdf
Honolulu Star-Advertiser (2018). “FCC final report on false missile alert cites human error and poor safeguards.” Secondary source for the final report. https://www.staradvertiser.com/?p=731454
Norman, D. A. (1988). The Psychology of Everyday Things. New York: Basic Books; revised as The Design of Everyday Things (2013). Interlock, lock-in and lockout are taken from Lockton (2005), a secondary summary, 'Everyday things & persuasive technology', Architectures of Control