Generating Erroneous Human Behavior From Strategic Knowledge in Task Models and Evaluating Its Impact on System Safety With Model Checking

Self Cite

Human-automation interaction (HAI) is often a contributor to failures in complex systems. This is frequently due to system interactions that were not anticipated by designers and analysts. Model checking is a method of formal verification analysis that automatically proves whether or not a formal system model adheres to desirable specification properties. Task analytic models can be included in formal system models to allow HAI to be evaluated with model checking. However, previous work in this area has required analysts to manually formulate the properties to check. Such a practice can be prone to analyst error and oversight which can result in unexpected dangerous HAI conditions not being discovered. To address this, this paper presents a method for automatically generating specification properties from task models that enables analysts to use formal verification to check for system HAI problems they may not have anticipated. This paper describes the design and implementation of the method. An example (a pilot performing a before landing checklist) is presented to illustrate its utility. Limitations of this approach and future research directions are discussed.Index Terms-Formal methods, human-automation interaction (HAI), model checking, system safety, task analysis.

Section: Property Generation Extensionsmentioning

confidence: 99%

Automatically Generating Specification Properties From Task Models for the Formal Verification of Human–Automation Interaction

Bolton

Jimenez

Paassen

et al. 2014

Self Cite

“…These models have been used in the evaluation of human operator performance for a variety of purposes including usability evaluation [27], [33], timing analysis of human tasks [27], and alerting systems [34], [35]. Researchers have shown the usability of formal methods in verifying human operator behavior encompassed by task analytic models accomplishing their desired goals and/or avoiding dangerous system operating modes [35], [36]. Some models have been extended to incorporate erroneous human behavior into task models so that their impact can be evaluated as part of the formal verification [31], [36].…”

Section: A User Models In Human-computer Interactionmentioning

confidence: 99%

“…Researchers have shown the usability of formal methods in verifying human operator behavior encompassed by task analytic models accomplishing their desired goals and/or avoiding dangerous system operating modes [35], [36]. Some models have been extended to incorporate erroneous human behavior into task models so that their impact can be evaluated as part of the formal verification [31], [36].…”

Section: A User Models In Human-computer Interactionmentioning

confidence: 99%

A Human Operator Model for Medical Device Interaction Using Behavior-Based Hybrid Automata

Niezen

Eslambolchilar

2016

This paper describes the design and implementation of a control-theoretic model that can be used to model both the discrete and continuous behavior of a human operator. The human operator model can be used to compare different device user interfaces in terms of human performance. The implemented human operator model combines an ON-OFF control model and a behavior-based hybrid automaton with three controllers. The controllers, defined as continuous, discrete, and fine-tuning behavior, simulate the user's conceptual model of the user interface. The device model used is that of a commercial syringe pump with chevron keys, described as a formal specification. Results of the human operator model simulation were generated for 20 different numbers obtained from syringe pump log files. The simulation results were compared over 33 trials to a lab study employing a device based on the formal specification. The result of the simulation shows a significant similarity to the result of the lab study for all the numbers used.

“…Bolton et al [21]- [23] also consider user task models. More precisely, they have developed a framework to analyze and predict the impact of human errors and system failures.…”

Section: Related Workmentioning

confidence: 99%

Automatic Detection of Potential Automation Surprises for ADEPT Models

Combéfis¹,

Giannakopoulou

Pecheur

2016

This paper describes how to automatically detect potential automation surprises in interactive systems, within a rapid automation interface design tool named ADEPT. The proposed analysis method in this paper is based on a conformance relation, called full-control, between the model of the actual system and a mental model of it, that is, its behavior as perceived by the operator. The method can, among other things, automatically generate a so-called minimal full-control mental model for a given system. Systems are well designed if they can be described by relatively simple mental models for their operators, which can be assessed with the minimal full-control mental model generation algorithms. During the generation, potential automation surprises are detected and highlighted with execution examples that may lead to confusion. The analysis methods are based on an enriched version of labeled transition systems to describe the system and mental models. In order to be able to integrate the analysis method within ADEPT, a semantics for ADEPT models makes it possible to translate them into enriched LTSs. The proposed translation is automated for a specified class of ADEPT models that are characterized and defined in this paper. A case study demonstrates the proposed analysis framework and informs how the integration with ADEPT can be improved.Index Terms-ADEPT toolset, formal methods, human factors, human-machine interaction.