1) Information Pull vs. Push: The Same Information, Delivered
Differently, Shifts the ETTO Balance in Opposite Directions

Information pull is user-initiated: the operator retrieves information
when ready to process it. Information push is system- or
sender-initiated: the system determines the timing and delivers
information regardless of the recipient’s current state. On the surface,
both increase information accessibility — but their effects on the
rhythm of decision-making are fundamentally different.

In pull situations, users are more likely to be in a prepared state
when processing information. This makes it easier to include
thoroughness activities — comparison, verification, and rechecking.
In push situations, the interruption arrives unannounced, creating
pressure to suspend the current task and respond immediately.

From an ETTO perspective, as the proportion of push interactions
increases, the system tends to tilt toward efficiency to avoid loss of
control. Judgments become faster and shallower: close the issue quickly,
process with minimum information, terminate early to prepare for the
next interruption.

2) The Dual Effect of Alarm Automation: Cognitive Burden Decreases,
but Temporal Uncertainty Increases

Hollnagel’s industrial alarm example remains directly relevant. Monitoring
automation removes the burden of manually scanning every indicator —
creating capacity for broader situational awareness and plan adjustment.
In this respect, automation clearly supports the thoroughness side of
the trade-off.

However, automation simultaneously converts pull structures into push
structures. Operators no longer know when the next alarm will arrive,
and they cannot be confident how much time they can invest in the
current task. The result: automation reduces the volume problem while
reducing temporal predictability.

This change reshapes behavior. People shift from investing time safely
to keeping time available safely. Finishing quickly and maintaining
readiness for the next event becomes the default strategy;
thoroughness is relegated to a conditional option, exercised only when
the situation explicitly allows it.

3) Decision-Making in Interrupt-Dense Environments: Maintaining
Control Replaces Achieving Optimal Accuracy as the Primary Goal

In environments with frequent interruptions, the decision-making
objective is not achieving the optimal solution. The more realistic
operational target is maintaining control — managing the incoming flow
of events so that no single event overwhelms the system’s capacity to
respond. Understanding every event perfectly is a secondary concern.

This is why practitioners routinely select “good enough, fast” answers.
From the outside, this can appear hasty. From the inside, it is a
defensive strategy to prevent backlog accumulation. The ETTO Principle’s
core contribution is precisely the ability to read this context rather
than misclassify it as negligence.

Operational improvement must align with this reality. Requiring
thoroughness in a high-interrupt environment without modifying the
interrupt structure places practitioners in a double-bind. Reducing
interrupt density or establishing mode-switch rules — pre-agreed criteria
for shifting between thorough and streamlined processing — can attenuate
efficiency bias while maintaining system control.

4) Descriptive Decision Rules: Describe What People Actually Do
Under Time Constraints, Not What They Should Do

Hollnagel identifies a recurring pattern in the research literature. As
evidence accumulated that human behavior diverges from normative models,
the field’s response was to produce relaxed normative models — moving
from optimization to satisficing. This represented genuine progress.

The critical limitation, however, is that this shift did not adequately
address the time problem. Distributing the comparison of alternatives
across multiple stages still does not help when total decision time is
insufficient. Elegant models and models that accurately describe the
field are not the same thing.

The ETTO Principle demands a descriptive turn. Rather than beginning
with “what should people do?”, the prior question must be: “given the
time structure they actually face, what do people reliably do?” That
pattern must be described in observable, operational terms before any
redesign can be targeted at the right variables.

5) EBA and Prospect Theory: Useful Models, but the Time-Window
Problem Remains Unresolved

Elimination by Aspects (EBA) reduces the burden of choice by
sequentially eliminating alternatives based on ordered attribute
thresholds. Prospect theory accounts for choice through an editing
phase and an evaluation phase, using loss-gain framing rather than
utility maximization. Both are substantially closer to observed
behavior than classical maximization.

From the ETTO perspective, however, these models structure the
trade-off more than they resolve it. They describe how judgment is
segmented — but when the full decision window is insufficient, pressure
to abbreviate some segment persists regardless of which model governs
the process.

What operational practice therefore requires is not a better algorithm
but better operational condition design. Even the most carefully
structured stepwise decision rule is undermined when deadlines,
interruptions, and approval bottlenecks remain unchanged. Adopting a
decision model without addressing the time architecture that surrounds
it does not prevent the same failures from recurring.

6) Practical Information Environment Design: Better Timing Is More
Valuable Than More Information

ETTO-informed information design is not dashboard expansion. The core
question is not “how much information to provide” but “when and how to
allow information to interrupt.” Critical alerts and advisory
notifications must be separated, and non-urgent information should be
consolidated into batch delivery windows to reduce interrupt frequency.

Decision windows also need structural protection. During high-hazard
task transitions, for example, non-urgent push notifications can be
suppressed for a defined interval while only safety-critical events pass
through. This is not information concealment — it is information timing
optimization.

Metrics must be redesigned to match. Alarm closure rate alone can make
efficiency look positive while thoroughness degrades. Recurrence rate,
rework rate, false-positive response cost, and downstream consequences
of deferred judgment must all be tracked to assess whether the
information environment actually protects decision quality.

7) Chapter 2-3 Summary: Information Environment Design Is ETTO Design

The conclusion of Chapter 2-3 is precise. Information should not
simply be maximized — it must be introduced at the right moment and
in the right form. When the balance between pull and push breaks down,
decision-making acquires a structural efficiency bias. This is a system
timing problem, not an individual attitude problem.

The unit of improvement is therefore not user training alone. Alarm
policy, interrupt rules, the time assumptions embedded in stepwise
decision procedures, and the composition of reporting metrics must all
be designed together. The ETTO Principle is the lens that makes this
connection visible.

Chapter 2-4 will address judgment heuristics and work-related ETTO
rules — examining which shortcut rules people actually use in the
field, when those rules are useful, and when they become dangerous.
The progression moves from the information environment that shapes
decision conditions to the decision rules that emerge within them.

For EHS practitioners, the most immediate application from Chapter 2-3
is alarm policy redesign using intervention-type classification rather
than severity classification alone. The same alarm information arrives
very differently depending on whether it interrupts ongoing work or
appears in a planned review window. Separating alarms into three
categories — immediate-action required, batch-processable, and advisory
— and suppressing non-urgent push during high-hazard operational windows
can maintain control without degrading alert sensitivity. In process
safety contexts, this maps directly onto alarm rationalization programs
aligned with ISA-18.2, where alarm priority, response time, and
operator loading are managed as an integrated system rather than
individual alert configurations.

Decision records must capture temporal context, not just outcome. When
logging a decision, the record should include not only which options were
available but also: the actual time permitted for the decision, the
number of active interruptions at the time, which review items were
deferred, and the assigned owner and scheduled time for follow-up
verification. This shift moves post-incident analysis from “why was the
decision wrong?” to “what conditions made that decision look correct in
the moment?” — and that is the precise question that enables system
correction rather than individual correction.

In high-alarm-volume environments such as DCS and SCADA control rooms,
information hygiene protocols add a further layer of protection.
Requiring context tags on alarm issuance — hazard severity, estimated
impact window, immediate action required — allows receiving operators to
triage without fully parsing each alarm. Presenting alarms of the same
type as a consolidated group within a defined time window rather than
as individual interruptions reduces the cognitive context-switching
cost that drives shallow processing. The combination of tagged issuance
and batched receipt on the receiving side simultaneously reduces the
downside of push while preserving necessary alert sensitivity.

Operators should not be evaluated on alarm closure speed alone.
The downstream cost of ignored alarms, the concentration loss caused
by false positives, and the rate of critical review items deferred by
repeated interruptions must be tracked alongside closure rate to reveal
what ETTO gradient the information system is actually producing.
When metrics change, behavior changes — not because operators become
more careful, but because the system stops structurally rewarding
shallow-fast processing over accurate-complete processing.

The broadest principle is that designing the information environment
means designing the time environment. When the time environment improves
— when pull windows are protected and push interruptions are bounded —
decision quality improves systematically without requiring any increase
in individual capability. Hollnagel’s point is structural: fix the
container, and the decisions made inside it improve as a consequence.
ETTO analysis is the diagnostic that identifies which features of the
information environment are producing which decision patterns — so that
the redesign can be targeted rather than generic.