Recent accounts of accidents have drawn attention to problems that arise in safety critical systems through "automation surprises". A particular class of such surprises, interface mode changes, may have significant impact on the safety of a dynamic interactive system and may take place implicitly as a result of other system action. Formal specifications of interactive systems may provide an opportunity to analyse problems that arise in such systems. In this paper we consider the role that an interactor based specification may have as a partial model of an interactive system, so that mode consequences might be checked early in the design process. We show how interactor specifications can be translated into the SMV model checker input language, and how we can use such specifications in conjunction with the model checker to analyse potential for mode confusion in a realistic case. Our final aim is to develop a general purpose methodology for the automated analysis of interactive systems,...

There is considerable interest within the Human Computer Interaction (HCI) community in the use of media spaces to enhance awareness and interaction between workers in offices or other spatially distributed environments. In addition to the technical challenges of providing reliable and efficient audio-visual communication, there are important social questions, in particular how users are able to control access to their personal environments, and how to advise other users about their level of availability. Within AMODEUS-2, an ESPRIT Basic Research Action concerned with the development, transfer and assessment of techniques for modelling human-computer interaction, a prototype media space has been analysed by various user and system oriented modelling techniques. This paper describes how formal specification can be used to express requirements on the interfaces needed to control access and availability in a media space. Beyond its obvious use in clarifying the subtle relationship between these concerns, the paper describes how the specification assists in assessing design options originating from other modelling disciplines.

In this paper we describe initial ideas about modeling and analyzing fault tolerance mechanisms in self managed/self healing systems. Specifications are component based, with coordination mechanisms for building systems from components. A modal action logic is augmented with deontic operators to describe normal vs abnormal behaviours. Fault tolerance mechanisms can be specified in terms of the kind of abnormality encountered and the desired recovery route. Abstract programming models can be systematically constructed from the specifications in LTSA, a finite state, process algebra based modeling tool. LTSA then enables us to check that various properties do or do not hold for the specified fault tolerance mechanisms.

This papers looks in detail at the Programmable User Modelling (PUM) approach to interactive system design. The theoretical background of PUM is discussed and a history of PUM work is outlined. Other related issues such as formal notations, other user modelling techniques used in HCI,and integration are also discussed. An agenda for further work is then proposed.

In this paper we investigate preferential semantics for declarative specifications in a First Order Modal Action Logic. We address some well known problems: the frame problem, the qualification problem and the ramification problem. We incorporate the assumptions that are inherent to both the frame and qualification problem into the semantics of the modal Action Logic by defining orderings over Dynamic Logic models. These orderings allow us to identify for each declarative Dynamic Logic action specification a unique intended model.

This work is part of a syndetic approach to the evaluation of the usabilityofinteraction devices that takes into account the cognitive resources needed to use a device to perform particular tasks. In the syndetic approach both a cognitive model and a model of system behaviour are speci#ed and brought together within a single framework in order to investigate their relations. The ICS model is such a cognitive model of human information processing. In this model the human information processing is depicted as a number of independent cognitive processes that cooperate by means of exchanging mental representations of the observed environment. The style in which the model is described is close to a data #owstyle, which is also one of the formal approaches used within Computer Science for the speci#cation of systems behaviour. In this paper we present a data #ow oriented representation of a simpli#ed version of the ICS model in whichwe study the synchronisation and delay of the str...

In this paper we focus our discussions on The Multiview Tool, which addresses the problem of requirements capture in the context of formal specification. Multiview enables multiple stakeholders to express their viewpoints based on a number of interrelated models, written in multiple different notations. As an example, we show how the VSCS Method, for eliciting requirements and formalising them in Structured Modal Action logic, will be supported by the Multiview tool. 1 Introduction Requirements analysis is the first technical activity in software development. It is concerned with eliciting, clarifying and documenting the desired functionality of some system. A number of formal languages for capturing requirements have been proposed in the literature [15]. A formal language is a mathematically based language for describing a system. Using formal languages people can systematically specify, develop, and verify a system. The expressibility power has greatly improved. Early work (ex. Z,...

Abstract. A large proportion of problems found in deployed systems relate to the user interface. This paper presents an approach to the verification of user interface models based on model checking. The approach is intended to be used early in design. The verification is concerned with behavioural aspects of the user interface and requires models that represent both the interactive aspects and also capture important features of the context to allow restrictions of behaviour to those that conform to appropriate human and environmental constraints. A tool suite to support the approach is under development and is described. Future work directions are put forward. 1

... this paper, we present and discuss two alternative agent architectures than have been implemented for different purposes --- one as a tool to help designers to think about systems from a user's perspective, and the other as an argumentative agent to work in an educational setting. Both architectures embody simple principles of rationality, but the different requirements on the design of the systems resulted in the specification and implementation of subtly but substantively different architectures. We discuss some of the reasons for this and draw out some common themes for future work on the design of rational agents.

"The difference between Western crazes and Japanese ones is that theirs are more likely to require batteries and later stamping on. Tamagotchis were 'virtual pets ' (i.e. not pets): miniscule LCD keyfobs with buttons you needed a cocktail stick to press, housing a rudimentary, bleeping lifeform that would 'die ' if you let it sleep in its own faeces- by which time you'd have put it in a weighted plastic bag and thrown it in a river anyway. Instilled nurturing instinct in kids born without hormones- or instincts."- 20 crazes that came in and went out again, Q, no.153: 40. Advances in battery, display, microprocessor, and robot technologies now allow the designers of computing systems to devise machines that are no longer tied to the desktop, neither physically nor in the interaction styles they permit. One class of the new devices possible are virtual pets, electronic lifeforms that implement algorithmic analogues and simulations of biological processes and which rely on human care for their continued “wellbeing” and development. While sold as toys, some of these devices, particularly Microsoft’s