Generating phenotypical erroneous human behavior to evaluate human–automation interaction using model checking

Abstract

Breakdowns in complex systems often occur as a result of system elements interacting in unanticipated ways. In systems with human operators, human-automation interaction associated with both normative and erroneous human behavior can contribute to such failures. Model-driven design and analysis techniques provide engineers with formal methods tools and techniques capable of evaluating how human behavior can contribute to system failures. This paper presents a novel method for automatically generating task analytic models encompassing both normative and erroneous human behavior from normative task models. The generated erroneous behavior is capable of replicating Hollnagel’s zero-order phenotypes of erroneous action for omissions, jumps, repetitions, and intrusions. Multiple phenotypical acts can occur in sequence, thus allowing for the generation of higher order phenotypes. The task behavior model pattern capable of generating erroneous behavior can be integrated into a formal system model so that system safety properties can be formally verified with a model checker. This allows analysts to prove that a human-automation interactive system (as represented by the model) will or will not satisfy safety properties with both normative and generated erroneous human behavior. We present benchmarks related to the size of the statespace and verification time of models to show how the erroneous human behavior generation process scales. We demonstrate the method with a case study: the operation of a radiation therapy machine. A potential problem resulting from a generated erroneous human action is discovered. A design intervention is presented which prevents this problem from occurring. We discuss how our method could be used to evaluate larger applications and recommend future paths of development.

Modeling Operator Behavior in the Safety Analysis of Collaborative Robotic Applications

“…Nevertheless they should be able to replicate human erroneous behavior, so that a verification process can detect the hazardous situations raised by them. Currently, model-based techniques that include human errors focus on interface devices and not physical collaboration and contacts [10]. For example, Physiograms [19] model interfaces of physical devices and [9,36] study the impacts of miscommunication in human-human collaboration while interacting with critical systems.…”

Designing and optimizing a healthcare kiosk for the community

“…Studies have contrasted the efficiency of various input modalities, for example the use of touch screens versus manual controls and tangible elements (Rogers et al, 2005;Zuckerman and Gal-Oz, 2013). There are also studies focusing on the use of formal methods to improve interactivity, such as the use of model checking to verify safety properties (Bolton et al, 2012); nonlinear programming to calibrate and tune the properties of the design prior to implementation (Eslambolchilar and Murray-Smith, 2008), and optimization though the use of parametric design problem solving (Motta and Zdrahal, 1996) (examples from outside of healthcare). This paper focuses on the design of the physiological kiosk from the perspective of optimizing HMI and improving measurement accuracy.…”

Using PVS to support the analysis of distributed cognition systems

“…This work shares with ours the concerns that (i) the model should take into account the broader system (environment, interactions between individuals and devices, and interactions among individuals), and that (ii) the non-experts of formal methods should be able to use the developed tools for analysing realistic systems. The approach was then extended in [8] to address multi-agent systems, human-human communication, and non-normative behaviour. Our work differs from theirs in that we aim to use formal methods to support informal approaches based on distributed cognition for analysing what users do in the wild (i.e., their actual behaviour), which can be different from the normative behaviour (e.g., what is reported in written documents of user manuals).…”