It is useful to be able to specify a proposed human-computer interface formally before building it, particularly if a mockup suitable for testing can be obtained directly from the specification. A specification technique for user interfaces, based on state transition diagrams, is introduced and then demonstrated for a secure message system application. An interpreter that executes the resulting specification ~s then described. Some problems that arise in specifying a user interface are addressed by particular features of the technique: To reduce the complexity of the developer's task, a user interface is divided into the semantic, syntactic, and lexical levels, and a separate executable specification is provided for each. A process of stepwise refinement of the syntactic specification, leading from an informal specification to an executable one is also presented. Since the state diagram notation is based on a nondeterministic model, constraints necessary to realize the system with a deterministic interpreter are given.Writing a formal specification of the user interface of a computer system before building it permits the interface designer to consider a variety of possible user interfaces and describe them precisely and compactly without actually having to code them. It also permits the application of human performance models to the specifications to obtain information about the user interfaces they describe before building them [1,15]. The specifications can be checked for certain undesirable properties of the user interface, such as almost-alike states [14], interactive deadlock [4], and character-level ambiguity [18]. Further benefits accrue if a prototype or mockup of the user interface of the proposed system can be constructed directly from the specification. Problems with the proposed user interface can then be identified early in the design process, when they are easier to fix. While many prcspective users will f_nd a formal specification of a proposed system difficult to understand, they will have much less trouble evaluating a mockup system and identifying deficiencies in its user interface, both through informal demonstrations and formal experiPermission to copy without fee all or part of this material is granted provided that the copies are not made or distributed for direct commercial advantage, the ACM copyright notice and the title of the publication and its date appear, and notice is given that copying is by permission of the Association for Computing Machinery. To copy otherwise, or to republish, requires a fee and/or specific permission.© 1983 ACM 0'89791-121-0/83/012/0028 $00.75 ments.This paper describes a specification technique for user-computer interfaces and its use in the development of a secure military message system. The specifications are executed interpretively to provide a working prototype of the system. The paper describes the specification technique by means of an example. Then, it shows the decomposition of both the design process and the specification itself into the semantic, ...