Operator-Vigilance Dependency¶

Name the safety configuration in which a human operator's unaided sustained attention is the final live barrier against a severe hazard, under exactly the monotony and rarity that the vigilance literature says will degrade that attention — worsened, not helped, by more upstream automation.

Core Idea¶

Operator-vigilance dependency is the safety-critical configuration in which a human operator's sustained, unaided attention constitutes the final — and often the only live — barrier against a serious failure, under conditions that systematically degrade exactly that attention. The structural commitment is a design or operational arrangement that places a known-weak control in the load-bearing position of last resort: vigilance research (Mackworth 1948; Parasuraman, Molfese, and Molloy 1987) establishes that unaided sustained detection performance decays reliably with time on task, task monotony, high alarm-false-positive rates, and automation-induced workload reduction on the routine case; yet the defence-in-depth layers ahead of the operator handle the frequent events well enough that the operator's rare-event detection is the only remaining safety budget. The failure mode is sharpest in the configuration that produces it most reliably: automated layers ahead of the operator catch nearly all events, so the residual class that reaches the operator is rare; rarity means extended periods of uneventful monitoring, which accelerates the vigilance decrement; when the rare event finally arrives, it arrives into a degraded detection system. A low-salience annunciation of a mode transition on an automated flight deck after four hours of calm cruise is a canonical instance — the configuration, not the individual pilot, is the investigable subject. The "irony of automation" (Bainbridge 1983) sharpens the paradox: the more reliable the upstream automation, the worse the operator's residual detection performance on the rare events that automation fails to handle, so adding automated layers improves most outcomes while degrading the coverage that matters most when those layers fail.

Structural Signature¶

Sig role-phrases:

the upstream defence layers — the engineered/automated barriers ahead of the operator that catch nearly all frequent events
the residual rare class — the events that escape those layers and reach the operator, by construction infrequent
the operator's unaided attention — sustained, unsupported human monitoring placed in the load-bearing seat of last resort
the vigilance decrement — the documented decay of detection under time-on-task, monotony, non-actionable-alarm rate, automation-induced workload reduction, and operator state (a known-weak control)
the salience mismatch — the rare event's annunciation is weaker than the cognitive load it must penetrate
the cost of a single miss — the configuration's exposure equals the severe, rapid consequence of one undetected event
the irony-of-automation coupling — more reliable upstream automation makes the testing events rarer and the watch more monotonous, so the residual-detection term falls exactly where it is load-bearing
the pseudo-redundancy cut — the operator is one layer on the diagram but the only live barrier for the residual class; redundancy that exists on the slide, not in the moment that matters
the attribution-default trap — the configuration produces the finding "the operator failed to monitor," which names a person and hides the design choice

What It Is Not¶

Not "the operator failed to monitor." That verdict names a person and treats the missed detection as a lapse better attention would have prevented; the configuration relocates the investigable subject to the design choice that put unaided sustained attention in the load-bearing seat against a known vigilance decrement. The miss is the predictable expression of the choice, not a personal failing.
Not genuine redundancy. On the diagram the operator is one defence among several; in the activating case the upstream automated layers have absorbed every frequent event, so for the rare residual class the operator is the only live barrier. This is pseudo-redundancy — redundancy that exists on the slide but not in the moment that matters; only this branch is operator-vigilance dependency.
Not improved by adding upstream automation. The coupling runs the other way: more reliable automation ahead of the barrier makes the testing events rarer and the watch more monotonous, so the residual-detection term falls exactly where it is load-bearing. The "irony of automation" is that the same upgrade which improves the common case erodes the coverage that matters when automation fails.
Not automation bias, complacency, or alarm fatigue. Those are psychological mechanisms that erode vigilance — contributors and routes to the configuration's failure, not the configuration itself. Operator-vigilance dependency is the structural arrangement (a known-weak control in the last-resort seat); the mechanisms are how its weak control degrades.
Not automation-induced skill atrophy. A nearby but distinct failure: reliable automation making manual practice rare and degrading performance on exceptions fails by loss of skill, whereas this configuration fails by loss of attention. The two have different mechanisms and would be separate entries.
Not a diagnosis that holds once vigilance is aided. The "unaided" qualifier is load-bearing: attention backed by calibrated-salience alarms, a second cross-monitoring person, or a non-bypassable forcing function is a different and far stronger configuration. The weak-control finding applies specifically to unsupported sustained attention; the moment real support is present, it no longer holds.

Scope of Application¶

Operator-vigilance dependency lives across the sociotechnical-safety subfields of safety and human-factors engineering — the settings for which the vigilance literature (Mackworth, Parasuraman, Wickens) was developed; its reach is within that domain, and its generalizable skeleton (a known-weak control in the last-resort seat) belongs to the parents single_point_of_failure and defense_in_depth, while its distinctive content — the documented decay of human detection under monotony and the perverse automation coupling — does not travel off the human monitor. The configuration is the same across the habitats below, with little more than a substitution of operator role.

Aviation — pilot monitoring on highly automated flight decks, where the rare residual class (automation-mode confusion, sensor failure) is exactly where unaided vigilance fails (AF447, Asiana 214).
Healthcare — anesthesia, ICU, and long-shift nursing monitoring, where alarm fatigue, normalization of deviance, and shift duration erode the supposed final barrier.
Nuclear and process safety — control-room operators on a long quiet watch with most parameters nominal, the rare-deviation catch being the entire residual safety budget (Three Mile Island, Davis-Besse).
Financial operations controls — end-of-day reconciliation, surveillance dashboards, and four-eye checks reduced to a single tired analyst clicking through.

Clarity¶

Naming this configuration dislodges the verdict an investigation almost always reaches by default: "the operator failed to monitor." That phrase locates the fault in a person and treats the missed detection as a lapse that better attention would have prevented. The label relocates the investigable subject to the design choice that put unaided sustained attention in the position of last resort against a known vigilance decrement — making the missed detection the predictable expression of that choice rather than a personal failing. The question stops being "why didn't this operator catch it?" and becomes "why was catching it left to a control the human-factors literature already classes as weak under exactly these conditions?"

It also sharpens a distinction that the language of "layers" routinely hides: genuine redundancy versus pseudo-redundancy. On paper the operator is one defence among several; in the activating case the upstream automated layers have absorbed all the frequent events, so for the rare residual class the operator is in fact the only live barrier — redundancy that exists in the diagram but not in the moment that matters. Holding those two apart lets the analyst see that adding reliable automation ahead of a vigilance-dependent barrier does not merely fail to help; it actively erodes the residual coverage by making the testing events rarer and the monitoring more monotonous. The sharper question a practitioner can now ask is whether the final live barrier against a severe, fast hazard is unaided sustained attention — and if so, whether anything (calibrated-salience alarms, a second person, a forcing function) actually backs it up, or whether the redundancy is only on the slide.

Manages Complexity¶

The material being compressed is a large and superficially miscellaneous family of incidents: a pilot missing a mode annunciation after hours of calm cruise, an ICU nurse missing a sentinel cardiac change buried in an alarm flood, a control-room operator missing a slow parameter drift on a long quiet watch, a reconciliation analyst clicking past an exception on a single end-of-day screen. Examined individually these read as unrelated stories, each with its own operator, instrument, hazard, and proximate "lapse," and each tends to terminate in the same unhelpful verdict — the operator failed to monitor — which is a finding only in the sense that it names a person, not a mechanism. The concept collapses that sprawl to a single configuration with a single diagnostic question: was the final live barrier against a severe, rapid hazard a layer of unaided sustained human attention, and was that attention degrading for reasons the vigilance literature already predicts? When the answer is yes-and-yes, the configuration itself is the finding, and the heterogeneous case details — which sensor, which drug, which valve, which trade — drop out as substitutable instances of one structure rather than separate problems each demanding its own root cause.

What the analyst tracks in place of the full case is a short, bounded set of attention-degradation parameters drawn from the established human-factors evidence: time on task, task monotony, the rate of non-actionable alarms (alarm fatigue), automation-induced workload reduction on the routine case, the salience of the anomaly's annunciation relative to the prevailing cognitive load, and operator state factors (sleep, training currency). The qualitative outcome — whether the rare event is likely to be caught or missed — reads off the relationship among these as a chain of multiplicative decrements on a baseline detection rate, every term bounded above by documented human limits rather than free to be assumed away. The analyst does not re-derive each accident's psychology from scratch; the analyst checks where on these few axes the configuration sits and reads the residual detection coverage off their product. And because the load-bearing exposure is the consequence of a single missed detection, the configuration's risk is read off one further scalar — the severity-and-speed of the hazard that one miss admits — without modelling the full event tree.

The branch structure the concept supplies has two cuts that matter. The first is the redundancy cut: is the operator genuinely one of several independent live layers, or only one layer on the diagram while the upstream automated layers have absorbed every frequent event — leaving the operator as the sole live barrier for the rare residual class? Only the second branch (pseudo-redundancy) is operator-vigilance dependency, and locating a case in it tells the analyst that the redundancy shown on the slide does not exist in the moment that matters. The second is the automation cut, which the configuration makes legible and which is otherwise counterintuitive: because reliable upstream automation makes the testing events rarer and the monitoring more monotonous, adding such automation raises the vigilance decrement on exactly the residual events automation cannot handle — so the same intervention that improves the common-case outcome erodes the coverage that is load-bearing when it fails. The analyst reads that trade off directly from the configuration rather than discovering it incident by incident: more upstream reliability moves the residual-detection term down, not up. So in place of an open-ended hunt across dissimilar accidents for "what went wrong," the analyst holds one configuration, a handful of bounded decrement parameters, a single severity-of-one-miss scalar, and a two-branch redundancy/automation structure — and reads off whether the final barrier is the weak control in the load-bearing seat, how degraded its coverage is, and whether more automation will help or quietly hurt. A wide, case-specific investigative space becomes a single diagnosable configuration with a small parameter set and a fixed branch structure.

Abstract Reasoning¶

The first characteristic move is diagnostic: from a missed detection and the reflexive verdict "the operator failed to monitor," infer the underlying configuration — that unaided sustained attention had been placed in the load-bearing seat of last resort against a hazard that arrives rarely, monotonously, and with low annunciation salience. The signature being read is the conjunction of a rare residual event and a severe, fast consequence of one miss: when an investigation finds a trained operator who missed a single low-salience anomaly after a long quiet watch, the concept reads that not as a personal lapse but as the predictable output of a known-weak control operating exactly where the vigilance literature says it will decay. The move reasons FROM "competent operator, calm hours, faint annunciation, one missed catch with grave result" TO "the design left rare-event detection to degrading unaided attention" — relocating the investigable subject from the person to the configuration.

The second move is interventionist, and it carries a counterintuitive, named prediction that ordinary defence-in-depth reasoning gets backward. Adding reliable automation ahead of a vigilance-dependent barrier is predicted to worsen the barrier on the events that matter: more upstream reliability makes the testing events rarer and the monitoring more monotonous, so the residual-detection term falls. So the analyst reasons FROM "we will automate the routine case to catch more events" TO "the rare residual class that automation cannot handle will be caught less often, because the operator's attention is now more atrophied when it finally fires" — the irony-of-automation inference, read straight off the configuration rather than discovered incident by incident. The constructive side runs the same logic in reverse: the licensed fixes are exactly those that remove unaided attention from the final-barrier seat — calibrated-salience alarms, a second cross-monitoring person, a non-bypassable forcing function — each predicted to lift the residual-detection coverage by backing the weak control with something stronger, and each justified not by exhorting the operator to try harder but by re-engineering the seat.

The third move is boundary-drawing, separating the regime where the concept applies from where it does not. The decisive cut is genuine redundancy versus pseudo-redundancy: only when the upstream layers have absorbed every frequent event, leaving the operator the sole live barrier for the rare residual class, is the configuration operator-vigilance dependency — an operator who is truly one of several independent live layers is out of scope, and the redundancy shown on the diagram is real rather than only on the slide. A second boundary is the unsupported qualifier: vigilance backed by aided perception (decision support, pairing, forcing functions) is a different and far stronger configuration, so the inference licensed here is specifically about unaided sustained attention; the moment real support is present, the weak-control diagnosis no longer holds. The concept also bounds which hazards it speaks to — a severe and rapid consequence of a single miss, since the configuration's exposure is the cost of one undetected event; a slow or recoverable hazard does not load the final barrier the same way. Within these bounds the concept further supports a predictive / order-of-events inference: it specifies where on the bounded degradation axes (time on task, monotony, non-actionable-alarm rate, automation-induced workload reduction, annunciation salience, operator state) a configuration sits and predicts the residual detection coverage as the product of those documented decrements on a baseline rate — so the analyst can forecast, before any incident, that a barrier sitting deep on those axes will probably miss the next rare event, and can say which axis to move to recover coverage.

Knowledge Transfer¶

Within safety and human-factors engineering operator-vigilance dependency transfers as mechanism, and travels among its canonical four substrates with little more than a substitution of operator role. The configuration is the same whether the residual barrier is a pilot on a highly automated flight deck (AF447, Asiana 214, where the rare residual class — mode confusion, sensor failure — is exactly where unaided vigilance fails), an anesthesia/ICU/long-shift nurse under alarm fatigue and shift-duration decay, a control-room operator on a long quiet watch with most parameters nominal (Three Mile Island, Davis-Besse), or a reconciliation analyst reduced to a single tired pass through an end-of-day screen. Because the underlying vigilance literature (Mackworth; Parasuraman; Wickens) was developed across precisely these settings, the diagnostic question, the bounded degradation parameters (time on task, monotony, non-actionable-alarm rate, automation-induced workload reduction, annunciation salience, operator state), the genuine-versus-pseudo-redundancy cut, and above all the counterintuitive irony-of-automation prediction (more upstream reliability lowers the residual-detection term) all carry intact. So does the mitigation catalog: the aviation response — pair operation with explicit cross-monitoring, forcing-function checklists, decision-support alerts of calibrated salience, scheduled handoffs — restates directly into surgical/anesthesia CRM and checklists, into nuclear procedural-step verbalization and peer-check, and into finance maker-checker workflows with non-bypassable thresholds, every one an instance of the same rule: do not let unaided sustained attention be the final barrier.

Beyond sociotechnical safety the honest report is (B) shading into near-vacuity, and it should be stated plainly. The concept's distinctive predictive force comes from four elements that are constitutive of its home substrate: a human operator in a sustained-monitoring role, a defence-in-depth engineered context in which that operator is the residual layer, the human-factors evidence base on the vigilance decrement, and a high-consequence rapid-onset hazard that converts one missed detection into harm. Strip these and what remains is the bare proposition "if you put a known-weak control in the load-bearing seat, it will fail" — true but tautological, and already carried by the catalog parents it instantiates: single_point_of_failure (here the single point happens to be attention) and defense_in_depth together with its failure modes (here defence-in-depth has collapsed to one live layer that is human and unaided). Those parents are what genuinely generalize, and any cross-domain lesson about over-relying on a fragile last line should be carried by them. The piece that makes operator-vigilance dependency non-trivial — the documented, quantifiable decay of human detection under monotony and the perverse automation coupling — does not travel, because outside a human monitor there is nothing whose attention degrades on the curve the vigilance research measures. So the cross-substrate move is either the tautology (carried by single-point-of-failure / defense-in-depth) or a metaphor that borrows the "weak final barrier" shape while dropping the human-attention mechanism that supplies all the predictive content; there is no third, mechanistic, cross-substrate reading to endorse. (A nearby but distinct phenomenon worth separating: automation-induced skill atrophy — reliable automation making manual practice rare and degrading performance on exceptions — fails by loss of skill rather than attention, and would be its own entry.) The honest boundary is therefore that the configuration is a precise failure pattern inside sociotechnical safety, fully portable among its operator roles, whose generalizable skeleton belongs to defense_in_depth and single_point_of_failure and whose distinctive content stays home. See Structural Core vs. Domain Accent.

Examples¶

Canonical¶

Norman Mackworth's Clock Test (1948), commissioned to explain why RAF radar operators missed submarine contacts late in their watches, is the demonstration on which the whole configuration rests. Observers watched a plain clock hand that ticked in small regular steps but occasionally made a rare "double jump," which they were to report. Over a two-hour vigil, detection did not hold steady: accuracy fell sharply within the first half hour and continued to erode, so that many of the infrequent signals late in the watch went undetected — a decline driven purely by time-on-task and monotony, not by any change in the signal. Mackworth had isolated, and quantified, the vigilance decrement: unaided sustained attention is a known-weak control precisely under rarity and monotony, exactly the conditions a last-resort human monitor faces.

Mapped back: The rare double-jump is the residual rare class and the observer's monitoring is the operator's unaided attention placed as sole detector. The measured fall in detection over the watch is the vigilance decrement — the documented decay under time-on-task and monotony that makes the control weak. Because a missed double-jump (in the wartime referent, a missed contact) is consequential, the setup also isolates the cost of a single miss: detection performance, not signal strength, is what fails.

Applied / In Practice¶

Hospital clinical-alarm safety is this configuration in a live clinical setting. Bedside monitors in ICUs and telemetry units generate a flood of alerts, of which a large majority — commonly reported above 85% — are non-actionable (artifact, minor transient, or duplicate). Clinicians habituate to the constant noise, so the rare truly sentinel change (a genuine lethal arrhythmia) must penetrate an attention already dulled by thousands of false alerts. After patient deaths linked to silenced or missed alarms, the U.S. Joint Commission issued a Sentinel Event Alert on alarm safety (2013) and made alarm management a National Patient Safety Goal. Crucially, adding more automated monitoring worsened the problem — more sensors meant more alarms, deepening the fatigue on exactly the rare event that mattered.

Mapped back: The upstream monitors are the upstream defence layers whose non-actionable flood produces the salience mismatch — the sentinel change's alert is no louder than the noise it must cut through. The nurse is nominally one of several safeguards but is in fact the pseudo-redundancy cut: the only live barrier for the rare true event. That more monitoring automation deepened alarm fatigue is the irony-of-automation coupling, and the reflexive "the nurse missed the alarm" verdict is the attribution-default trap the concept relocates onto the configuration.

Structural Tensions¶

T1: Common-case gain versus residual-case erosion (the irony of automation). The configuration's defining paradox is that the same upstream automation which catches nearly all events — an unambiguous improvement on the frequent cases — is exactly what degrades the operator's detection of the rare events automation cannot handle, by making the watch rarer and more monotonous. There is no way to have the common-case benefit without the residual-case cost: the reliability that thins the event stream is precisely what atrophies the attention held in reserve for the stream's tail. So a genuinely good intervention (automate the routine) silently moves the load-bearing coverage down. The tension is that ordinary defence-in-depth reasoning treats every added layer as monotonically protective, while here the last human layer is anti-correlated with the reliability of the layers ahead of it. Diagnostic: Does adding this automated layer improve the common case while making the residual rare event both rarer to the operator and harder to catch — and is that residual event the one that actually kills?

T2: Configuration-as-subject versus operator accountability (relocating blame without dissolving it). The concept's core service is relocating the investigable subject from the person ("the operator failed to monitor") to the design choice that seated unaided attention as last resort — analytically correct, and just, since it stops scapegoating a predictable human limit. But pushed to its limit the move can dissolve accountability entirely: if every missed detection is "the configuration," then genuine negligence, skipped procedures, and fitness-for-duty failures are absorbed into a systemic verdict that asks nothing of the operator. The tension is that the same reframe which rescues a competent operator from unfair blame can, over-applied, remove the individual responsibility that motivates diligence in the first place. Systems thinking and personal accountability both have claims here, and the configuration deliberately tilts toward the former. Diagnostic: Is the missed detection the predictable output of a known-weak control under documented decrement (configuration's fault), or does it reflect a specific dereliction the design did not force (where accountability still attaches)?

T3: Backing the weak control versus the fixes regenerating the failure (mitigations that bite back). The licensed remedies all remove unaided attention from the last seat — calibrated-salience alarms, a second cross-monitoring person, a non-bypassable forcing function. Each is sound, yet each can reintroduce the very failure it treats. More alarms are how alarm fatigue was created, so a poorly-calibrated salience upgrade deepens the flood; a second monitor invites diffusion of responsibility, where each watcher relies on the other and joint vigilance falls below solo; forcing functions add rigidity that breeds workarounds and automation of the check itself. The tension is that the interventions operate on the same human-attention substrate that is failing, so they can shift the decrement rather than remove it, and "add a backup" is not automatically additive. The fix must be engineered against the same vigilance limits that motivated it. Diagnostic: Does the proposed backup introduce a genuinely independent detection channel, or does it load the same degrading attention (more alarms, shared-responsibility monitoring) and merely relocate the decrement?

T4: Genuine versus pseudo-redundancy (a cut that is clear on the slide and murky in the moment). The decisive scoping cut — is the operator truly the sole live barrier for the residual class, or one of several independent layers — is what distinguishes operator-vigilance dependency from ordinary defence-in-depth. But establishing which branch a case is in requires knowing whether the upstream layers have in fact absorbed every frequent event, leaving the rare residual class genuinely unhandled, and that is an event-by-event, often retrospective judgment. Designers count the operator as a bona fide layer precisely to certify the design; the concept says that layer is frequently illusory in the activating moment. The tension is that the diagram and the moment disagree, and telling genuine from pseudo-redundancy demands reconstructing what actually reached the operator versus what the upstream layers caught — information that is clearest only after the miss. Diagnostic: For the rare residual class specifically, is there any other live, independent barrier in the moment it arrives — or does the redundancy exist only on the block diagram?

T5: Known-weak control versus irreplaceable last catch (the human is there because automation cannot be). The concept classes unaided sustained attention as a known-weak control and urges removing it from the last seat. But the reason the residual class reaches a human at all is often that these events are exactly the novel, ambiguous, un-anticipated ones automation cannot be built to catch — the human monitor is weak on the vigilance curve yet uniquely capable of recognizing the unmodeled failure. So the fragile barrier is also, frequently, the only barrier that could exist for genuinely open-ended anomalies. The tension is that "do not let unaided attention be the final barrier" is sound where the residual event is automatable and evasion where it is not: sometimes there is no calibrated alarm to write because no one knew in advance what to alarm on. Over-engineering the human out can remove the one component that handles the truly unforeseen. Diagnostic: Is the residual event one that could be reliably automated or forcing-functioned away (weak control is replaceable), or intrinsically novel and unmodelable (the fragile human catch is the only possible one)?

T6: Autonomy versus reduction (a safety configuration or a keyed single-point-of-failure). The entry is unusually candid that stripping its four constitutive elements — a human monitor, a defence-in-depth residual seat, the vigilance-decrement evidence base, and a rapid high-consequence hazard — leaves only the tautology "a known-weak control in the load-bearing seat will fail," already carried by single_point_of_failure (the single point here being attention) and defense_in_depth collapsed to one live human layer. Those parents are what generalize, and any cross-domain lesson about over-relying on a fragile last line belongs to them. What does not travel is the non-trivial content — the documented, quantifiable decay of human detection under monotony and the perverse automation coupling — because off the human monitor there is nothing whose attention degrades on Mackworth's curve. The tension is between a precise, portable-within-safety failure pattern and the recognition that its generalizable skeleton is its parents while its distinctive predictive force stays home. Diagnostic: Resolve toward single_point_of_failure / defense_in_depth when the lesson is about over-relying on a fragile final barrier in any substrate; toward named operator-vigilance dependency when the fragile barrier is a human monitor whose attention decays on the vigilance curve.

Structural–Framed Character¶

Operator-vigilance dependency sits at mixed — a structural single-point-of-failure skeleton carrying a genuinely empirical, home-bound mechanism (the human vigilance decrement). Its evaluative weight reads mildly framed: it is a safety failure configuration, and naming it relocates a finding (from "the operator failed to monitor" to a design choice), which carries a mild normative charge about where fault lies — though the underlying vigilance decrement it rests on is itself neutral. Human-practice-bound reads framed but in an unusual way: the configuration requires a human operator whose attention decays, so it dissolves off the human monitor — yet the vigilance decrement is a documented psychophysical regularity (Mackworth's Clock Test; Parasuraman), a fact about human cognition rather than an institutional convention, which lends the criterion a structural undertone. Institutional origin reads structural: the distinctive content is grounded in the empirical vigilance literature, not manufactured by an agency or survey — it is a measured curve, not an artifact of a tradition. Vocab-travels reads framed: the specific machinery (the decrement, salience mismatch, irony-of-automation coupling) has no referent off a human monitor, though the parent skeleton travels. Import-vs-recognize is bimodal — within sociotechnical safety it transfers as mechanism across aviation, healthcare, nuclear, and finance with only a role substitution, but beyond it collapses to a tautology carried by its parents or a metaphor that drops the mechanism.

The portable structural skeleton is a known-weak control placed in the load-bearing seat of last resort — which is exactly what the configuration instantiates from its umbrella parents single_point_of_failure (here the single point is attention) and defense_in_depth collapsed to one live human layer. Those parents are what generalize to any fragile-final-barrier lesson; the quantified decay of human detection under monotony and the perverse automation coupling are the distinctive content that stays home. Its character: a single-point-of-failure skeleton whose non-trivial predictive force comes from an empirically-measured fact of human attention, structural in the skeleton it instantiates from its parents and home-bound in the vigilance decrement that supplies its bite.

Structural Core vs. Domain Accent¶

This section decides why operator-vigilance dependency is a domain-specific abstraction and not a prime — and the case is unusually clean, because the entry itself shows that what generalizes is a tautology carried by its parents while the non-trivial content is welded to the human monitor.

What is skeletal (could lift toward a cross-domain prime). Strip the human-factors substrate and a thin relational structure survives: a known-weak control has been placed in the load-bearing seat of last resort, so a defence-in-depth arrangement that looks multiply redundant on paper has in fact collapsed to one live barrier for the class of events that matters. That skeleton factors, without residue, into the two parents the entry instantiates: single_point_of_failure (the failure of one component takes down the whole — here the single point happens to be attention), and defense_in_depth (layered independent barriers) together with its failure mode of collapsing to a single live layer. Both are genuinely substrate-portable: a backup generator that is the only real defence against blackout, a lone reviewer who is the sole check on a deploy, a single seal holding back a pressure vessel all instance "the redundancy on the diagram is not redundancy in the moment." That much is mechanism and travels anywhere there are barriers and a hazard.

What is domain-bound. Everything that makes the entry non-trivial is welded to the human monitor and does not survive extraction. The distinctive content — the vigilance decrement as a documented, quantifiable decay of unaided sustained detection under time-on-task, monotony, non-actionable-alarm rate, and automation-induced workload reduction (Mackworth's Clock Test; Parasuraman; Wickens); the salience mismatch between a faint annunciation and the load it must penetrate; and above all the irony-of-automation coupling, in which more reliable upstream automation makes the watch rarer and more monotonous and thereby drives the residual-detection term down exactly where it is load-bearing — all presuppose a human whose attention degrades on a measured curve. The decisive test is the entry's own: strip the human operator, the defence-in-depth residual seat, the vigilance-evidence base, and the rapid high-consequence hazard, and what is left is the bare, tautological "a known-weak control in the load-bearing seat will fail." Off the human monitor there is nothing whose attention degrades on Mackworth's curve, so the entire predictive payload evaporates and only the parent skeleton remains.

Why this does not clear the prime bar. A prime's vocabulary travels and its transfer is recognition of the same mechanism, not analogy. This entry's transfer is bimodal and, unusually, near-vacuous beyond its home. Within sociotechnical safety it travels intact as full mechanism — the diagnostic question, the bounded degradation parameters, the genuine-versus-pseudo-redundancy cut, the irony-of-automation prediction, and the mitigation catalogue carry from aviation to healthcare to nuclear to finance with little more than a substitution of operator role, because the same vigilance literature underwrites all of them. Beyond it, there is no third mechanistic reading to endorse: the cross-substrate move is either the tautology "put a weak control in the last seat and it fails" (which is just single_point_of_failure / defense_in_depth and needs no new name) or a metaphor that borrows the "fragile final barrier" shape while dropping the human-attention mechanism that supplies every bit of the predictive content. And when the bare structural lesson is wanted cross-domain — do not over-rely on a fragile last line of defence — it is already carried, in more general form, by exactly those two parents. The cross-domain reach belongs to single_point_of_failure and defense_in_depth; "operator-vigilance dependency," as named, is the human-monitor keying of that skeleton, and its distinctive predictive force is inseparable from the vigilance decrement that should stay home. (A near neighbour, automation-induced skill atrophy, fails by loss of skill rather than attention and is a separate entry — a reminder that the specificity here is the human-cognition mechanism, not the redundancy skeleton.) It clears the domain-specific bar sharply within sociotechnical safety, but its only substrate-spanning content is the single-point-of-failure skeleton its parents already carry.

Relationships to Other Abstractions¶

Current abstraction Operator-Vigilance Dependency Domain-specific

Parents (2) — more general patterns this builds on

Operator-Vigilance Dependency is a kind of Single Point of Failure Prime

Operator-Vigilance Dependency is the sociotechnical-safety species of Single Point of Failure in which one human noticing capacity is the last live barrier.
Operator-Vigilance Dependency presupposes Alertness Prime

Operator-Vigilance Dependency requires a standing, depletable capacity to notice rare low-salience signals before harm occurs.

Hierarchy paths (5) — routes to 4 parentless roots

Operator-Vigilance Dependency → Single Point of Failure → Center Of Gravity → Leverage Points → Feedback

Show alternative paths (4)

Not to Be Confused With¶

Alarm fatigue, automation complacency, and automation bias. The psychological mechanisms by which sustained attention erodes — habituation to a non-actionable-alarm flood, over-trust in a reliable automated aid, uncritical acceptance of its output. These are contributors and routes to the configuration's failure, not the configuration itself: operator-vigilance dependency is the structural arrangement (a known-weak control seated as last resort), and these are how that control degrades. Tell: are you naming why the operator's attention decayed (a mechanism), or the design choice that made that decaying attention the sole live barrier (the configuration)?
Automation-induced skill atrophy. A nearby but distinct failure: reliable automation making manual practice rare, so the operator's performance on hand-flown exceptions degrades. It fails by loss of skill; operator-vigilance dependency fails by loss of attention. Same automation-reliability trigger, different degraded faculty and different remedy (recurrent practice vs backing the final barrier). Tell: when the rare event arrives, does the operator notice but cannot handle it (skill atrophy) or fail to notice it at all (vigilance dependency)?
The irony of automation (Bainbridge). The broad principle that the more reliable the automation, the more critical and the more degraded the residual human role becomes. Operator-vigilance dependency is the specific safety configuration that exhibits one face of that irony — the attention-decay face — as a diagnosable arrangement with bounded decrement parameters and a redundancy cut. Principle-vs-instance: the irony is the general observation, this entry is the particular failure mode it names. Tell: is the reference the general paradox of automation's residual role (the irony), or the concrete arrangement where unaided attention is the final barrier against a rare, fast hazard (this configuration)?
Normalization of deviance. The gradual social drift by which a repeatedly-tolerated departure from safe practice becomes the accepted standard. It is a slow shift in what counts as acceptable across many decisions; operator-vigilance dependency is a momentary detection failure by a known-weak control under monotony. One erodes the standard over time; the other erodes attention over a watch. Tell: did an accepted practice quietly drift toward the unsafe over many iterations (normalization of deviance), or did a single rare signal go undetected by a fatigued monitor (vigilance dependency)?
Single point of failure and defense-in-depth (the parents it instantiates). The substrate-neutral skeleton — a known-weak control in the load-bearing seat, a layered defence collapsed to one live barrier for the class that matters. Any cross-domain lesson about over-relying on a fragile last line belongs to these parents; what makes this entry non-trivial — the quantified vigilance decrement and the perverse automation coupling — does not travel off a human monitor. Tell: strip the human operator and there is nothing whose attention degrades on Mackworth's curve, and "a weak control in the last seat will fail" is just single point of failure. (Treated fully in a later section.)

Neighborhood in Abstraction Space¶

Operator-Vigilance Dependency sits in a crowded region of the domain-specific corpus (37^th percentile for distinctiveness): several abstractions share nearly its structure, so a description that fits it tends to fit its neighbors too.

Family — Unclustered & Miscellaneous (309 abstractions)

Nearest neighbors

Computed from structural-signature embeddings · 2026-07-12