A Formal Model-Based Approach for Designing Interruptions-Tolerant Advanced User Interfaces

Palanque, Philippe; Winckler, Marco; Martinie, Célia

doi:10.1007/978-3-642-14562-9_8

Cited by 1 publication

(1 citation statement)

References 43 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Thus, they should be included in formal verification analyses concerned with generating erroneous human behavior. Palanque et al (2011) have modeled interruptions when evaluating systems with task analytic behavior models. Doherty et al (2008) have investigated a resourced action approach to modeling human goal directed behavior without formally articulated task models.…”

Section: Discussionmentioning

confidence: 99%

Generating phenotypical erroneous human behavior to evaluate human–automation interaction using model checking

Bolton¹,

Bass²,

Siminiceanu³

2012

International Journal of Human-Computer Studies

View full text Add to dashboard Cite

Breakdowns in complex systems often occur as a result of system elements interacting in unanticipated ways. In systems with human operators, human-automation interaction associated with both normative and erroneous human behavior can contribute to such failures. Model-driven design and analysis techniques provide engineers with formal methods tools and techniques capable of evaluating how human behavior can contribute to system failures. This paper presents a novel method for automatically generating task analytic models encompassing both normative and erroneous human behavior from normative task models. The generated erroneous behavior is capable of replicating Hollnagel’s zero-order phenotypes of erroneous action for omissions, jumps, repetitions, and intrusions. Multiple phenotypical acts can occur in sequence, thus allowing for the generation of higher order phenotypes. The task behavior model pattern capable of generating erroneous behavior can be integrated into a formal system model so that system safety properties can be formally verified with a model checker. This allows analysts to prove that a human-automation interactive system (as represented by the model) will or will not satisfy safety properties with both normative and generated erroneous human behavior. We present benchmarks related to the size of the statespace and verification time of models to show how the erroneous human behavior generation process scales. We demonstrate the method with a case study: the operation of a radiation therapy machine. A potential problem resulting from a generated erroneous human action is discovered. A design intervention is presented which prevents this problem from occurring. We discuss how our method could be used to evaluate larger applications and recommend future paths of development.

show abstract

Section: Discussionmentioning

confidence: 99%