AbstractÐThis paper examines and proposes an approach to writing software specifications, based on research in systems theory, cognitive psychology, and human-machine interaction. The goal is to provide specifications that support human problem solving and the tasks that humans must perform in software development and evolution. A type of specification, called intent specifications, is constructed upon this underlying foundation. Index TermsÐRequirements, requirements specification, safety-critical software, software evolution, human-centered specifications, means-ends hierarchy, cognitive engineering.

Increased automation in complex systems has led to changes in the human controller's role and to new types of technology-induced human error. Attempts to mitigate these errors have primarily involved giving more authority to the automation, enhancing operator training, or changing the interface. While these responses may be reasonable under many circumstances, an alternative is to redesign the automation in ways that do not reduce necessary or desirable functionality or to change functionality where the tradeoffs are judged to be acceptable. This paper describes an approach to detecting error-prone automation features early in the development process while significant changes can still be made to the conceptual design of the system. The information about such error-prone features can also be useful in the design of the operator interface, operational procedures, or operator training. Introduction Today's large, complex systems often incorporate both human and automated control and mon...

Because ever more powerful intelligent agents will interact with people in increasingly sophisticated and important ways, greater attention must be given to the technical and social aspects of how to make agents acceptable to people [87]. The technical challenge is to devise a computational structure that guarantees that from

Abstract not found

gence in circumscribed, cooperative roles to aid human observers in organizing, selecting, managing, and interpreting data. CHARACTERIZATIONS OF DATA OVERLOAD Data overload is the problem of our age -- generic yet surprisingly resistant to different avenues of attack. In order to make progress on innovating solutions to data overload in a particular setting, we need to identify the root issues that make data overload a challenging problem everywhere and to understand why proposed solutions have broken down or produced limited success in operational settings. There are three basic ways that the data overload problem has been characterized (Woods, Patterson, and Roth, 1998): 1. As a clutter problem where there is too much data: therefore, we can solve data overload by reducing the number of data units that are displayed. This has not proven to be a fruitful direction in solving data overload because it misrepresents the design problem, is based on erroneous assumptions a

Developers of autonomous capabilities underestimate the need for coordination with human team members when their automata are deployed into complex operational settings. Automata are brittle as literal minded agents and there is a basic asymmetry in coordinative competencies between people and automata. The new capabilities of robotic systems raise new questions about how to support coordination. This paper presents a series of issues that demand innovation to achieve human--robot coordination (HRC). These include supporting people in their roles as problem holder and as robotic handler, overcoming ambiguities in remote perception, avoiding coordination surprises by better tools to see into future robotic activities and contingencies, and responsibility in human--robot teams.

Abstract. Several research groups have grappled with the problem of characterizing and developing practical approaches for implementing adjustable autonomy and mixed-initiative interaction in deployed systems. However, each group takes a little different approach and uses variations of the same terminology in a somewhat different fashion. In this chapter, we will describe some common dimensions in order to better understand these important but ill-characterized topics. We will also sketch the approach to implementation we are developing in the context of our research on policygoverned autonomous systems. 1

This paper discusses a formal perspective to the analysis of user interaction with machines, in general, and pilot interaction with automated flight control systems, in particular. It addresses the issue of correct interaction between the user and the machine by asking whether the information provided to the user about the machine, and the display of this information, enables the user to perform his or her tasks reliably and successfully. We explain this perspective by looking at one example of pilots ' interaction with a modern autopilot. Theme: Design and evaluation- user-centered design methods

Modern commercial aircraft have extensive automation which helps the pilot by performing computations, obtaining data, and completing procedural tasks. The pilot display must contain enough information so that the pilot can correctly predict the aircraft's behavior, while not overloading the pilot with unnecessary information. Human-automation interaction is currently evaluated through extensive simulation. In this paper, using both hybrid and discrete-event system techniques, we show how one could mathematically verify that an interface contains enough information for the pilot to safely and unambiguously complete a desired maneuver. We first develop a nonlinear, hybrid model for the longitudinal dynamics of a large civil jet aircraft in an autoland/go-around maneuver. We find the largest controlled subset of the aircraft's flight envelope for which we can guarantee both safe landing and safe go-around. We abstract a discrete procedural model using this result, and verify a discrete formulation of the pilot display against it. An interface which fails this verification could result in nondeterministic or unpredictable behavior from the pilot's point of view.

This report details a complete, beginning-to-end Cognitive Systems Engineering (CSE) project tackling the challenges of conducting intelligence analysis under the condition of data overload. We first reviewed and synthesized the research base on data overload from multiple complex, high-consequence settings like nuclear power generation. The product of this activity was a diagnosis of the challenges of dealing with data overload in general. Then, leveraging this research base and previous experience in conducting Cognitive Task Analysis (CTA), we conducted a study to identify the aspects of this research base that applied to intelligence analysis as well as unique challenges. We observed expert intelligence analysts conducting an analysis on a selected unclassified scenario, the 1996 Ariane 501 rocket launch failure, with a baseline set of tools that supported keyword search, browsing, and word processing in an investigatorconstructed database. From this study, we identified challenging tasks in intelligence analysis that leave analysts vulnerable to making inaccurate statements in briefings when they are working in a new topic area and are under short deadline constraints. In parallel, we identified limitations of the baseline tools in addressing these vulnerabilities that pointed to ideas for new design directions. In addition, the study findings were translated into objective criteria for evaluating the usefulness of any effort aimed at reducing data overload. In the final phase of the project, we shifted from an emphasis on problem definition to an emphasis on developing modular design concepts, or "design seeds," that could be incorporated into both ongoing and future design efforts. The design seeds were instantiated as animated fly-through mockups, or "Animocks,"...