## Combining Formal Techniques and Prototyping in User Interface Construction and Verification (1995)

Venue: | In 2nd Eurographics Workshop on Design, Specification, Verification of Interactive Systems (DSV-IS'95). Springer-Verlag Lecture Notes in Computer Science |

Citations: | 10 - 5 self |

### BibTeX

@INPROCEEDINGS{Bumbulis95combiningformal,

author = {Peter Bumbulis and P. S. C. Alencar and D. D. Cowan and C. J. P. Lucena},

title = {Combining Formal Techniques and Prototyping in User Interface Construction and Verification},

booktitle = {In 2nd Eurographics Workshop on Design, Specification, Verification of Interactive Systems (DSV-IS'95). Springer-Verlag Lecture Notes in Computer Science},

year = {1995},

pages = {7--9},

publisher = {Springer-Verlag}

}

### OpenURL

### Abstract

In this paper we investigate a component-based approach to combining formal techniques and prototyping for user interface construction in which a single specification is used for constructing both implementations (prototypes) for experimentation and models for formal reasoning. Using a component-based approach not only allows us to construct realistic prototypes, but also allows us to generate a variety of formal models. Rapid prototyping allows the designs to be tested with end users and modified based on their comments and performance, while formal modeling permits the designer to verify mechanically specific requirements imposed on the user interface such as those found in safety- or security-critical applications. 1 Introduction User interfaces can be difficult and costly to construct; one recent survey estimates that half the development effort for an interactive application is spent on constructing the user interface [MR92]. It is natural to attempt to apply software engineering...

### Citations

1208 | Tcl and the Tk Toolkit
- Ousterhout
- 1994
(Show Context)
Citation Context ... set of primitives which are functionally equivalent to a subset of the primitives provided by PARTS Workbench; while relatively simple, they are useful in practice. We (mechanically) generate Tk/Tcl =-=[Ous94]-=- code for implementations and HOL [GM93] terms for (mechanical) reasoning. 3.1 Constructing Prototypes To construct a working prototype from an IL description we require for each component a routine t... |

847 | A formulation of the simple theory of types - Church - 1940 |

534 | PVS: A Prototype Verification System
- Owre, Rushby, et al.
- 1992
(Show Context)
Citation Context ...tions (i.e. functions whose arguments and/or results are other functions.) One advantage of using higher-order logic is the existence of reliable and robust proof-assistants such as HOL[GM93] and PVS =-=[ORS92]-=-. The existence of such proof assistants is important for two reasons: 1) experience has shown that machine-assisted proofs are more trustworthy than those done by hand [Coh89], and 2) for some proofs... |

500 |
T.: Introduction to HOL: A Theorem Proving Environment for Higher Order Logic: Cambridge
- Melham
- 1993
(Show Context)
Citation Context ... equivalent to a subset of the primitives provided by PARTS Workbench; while relatively simple, they are useful in practice. We (mechanically) generate Tk/Tcl [Ous94] code for implementations and HOL =-=[GM93]-=- terms for (mechanical) reasoning. 3.1 Constructing Prototypes To construct a working prototype from an IL description we require for each component a routine to build instances of that component. The... |

304 | An Introduction To Mathematical Logic and Type Theory: To Truth Through Proof - Andrews - 1986 |

129 |
A generalization of Dijkstra's calculus
- Nelson
- 1989
(Show Context)
Citation Context ...till guaranteeing soundness. We model states as mappings from a variable to values. Rather than expressing behaviors directly in terms of state sequences, we express them in terms of guarded commands =-=[Nel89] and expre-=-ss commands, in turn, as predicates on state sequences using the mechanization of Tredoux [Tre93]. For example, the predicate " := " representing assignment commands is defined as: ` def 8x ... |

124 | Survey on user interface programming
- Myers, Rossen
- 1992
(Show Context)
Citation Context ...ction User interfaces can be difficult and costly to construct; one recent survey estimates that half the development effort for an interactive application is spent on constructing the user interface =-=[MR92]-=-. It is natural to attempt to apply software engineering techniques to reduce this effort. Formal techniques are difficult to apply directly since there is no mathematical characterization of human be... |

113 | User interface software tools
- Myers
- 1995
(Show Context)
Citation Context ...cing implementations that meet the resulting formal specifications can be difficult to address since, for economic reasons, virtually all user interface software today is implemented using toolkits 1 =-=[Mye94]-=-. These toolkits usually present the developer with a conceptual model that is substantially different from that presented by most userinterface specification languages. For example, while most user-i... |

88 |
Why higher-order logic is a good formalism for specifying and verifying hardware
- Gordon
- 1985
(Show Context)
Citation Context ...zation of this observation. 9 Caml Light [Ler93], not Standard ML. The formal system we use to express and reason about our models is a version of type theory [Chu40, And86] called higher-order logic =-=[Gor86]-=-. Higherorder logic extends first-order logic by allowing higher-order variables (i.e. variables whose values are functions) and higher-order functions (i.e. functions whose arguments and/or results a... |

84 | Mural: A Formal Development Support System
- Jones, Jones, et al.
- 1991
(Show Context)
Citation Context ...form'atica, Pontif'icia Universidade Cat'olica do Rio de Janeiro, Brazil. Email: lucena@csg.uwaterloo.ca. have noted that "Formal techniques were not much help to us in designing the user interfa=-=ce." [JJLM91]. Rap-=-id prototyping is usually the methodology of choice for developing user interfaces. Indeed, empirical evidence suggests that "the only reliable method for generating quality user interfaces is to... |

82 | Formal Methods for Interactive Systems
- Dix
- 1991
(Show Context)
Citation Context ...otypes are expressed directly as specifications in the formal notation; their behavior is observed by animating the specifications. While there have been various reports of success with this approach =-=[Dix91]-=-, there are number of issues which are difficult to address: 1. User interface designers must be fluent in the particular formalism being used. For many formalisms, achieving fluency can involve a sig... |

48 | The notion of proof in hardware verification
- Cohn
(Show Context)
Citation Context ...ch as HOL[GM93] and PVS [ORS92]. The existence of such proof assistants is important for two reasons: 1) experience has shown that machine-assisted proofs are more trustworthy than those done by hand =-=[Coh89]-=-, and 2) for some proofs, significant portions can be automated. The proof assistant that we use is HOL. HOL embeds a higherorder logic in the functional programming language ML [CGH + 86]. Axioms and... |

45 |
On the use of transition diagrams in the design of a user interface for an interactive computer system
- PARNAS
- 1969
(Show Context)
Citation Context ...that our models possess properties expressed in such formalisms. To this end, we are currently investigating the verification of properties expressed in one of these formalisms: finite state machines =-=[Par69]-=-. One problem that we immediately confront is that most of these formalisms express behaviour as sequence of actions, not states, and further these actions do not directly correspond to our notion of ... |

29 | Debugging Larch Shared Language Specifications - Garland, Guttag, et al. - 1990 |

24 |
On the Use of LOTOS to Describe Graphical Interaction
- PaternÃ², Faconti
- 1992
(Show Context)
Citation Context ...dvantage of tools and methodologies, these notations usually are based on an existing (concurrent) formal notation. Statecharts [Mar86], CSP [Ale87a], Petri nets [BP90], temporal logic [Joh91], LOTOS =-=[PF92]-=- and DisCo [Sys94] all have been used. Prototypes are expressed directly as specifications in the formal notation; their behavior is observed by animating the specifications. While there have been var... |

15 | Petri net objects for the design, validation and prototyping of user-driven interfaces
- BASTIDE, PALANQUE
- 1990
(Show Context)
Citation Context ...ress user interface designs. To take advantage of tools and methodologies, these notations usually are based on an existing (concurrent) formal notation. Statecharts [Mar86], CSP [Ale87a], Petri nets =-=[BP90]-=-, temporal logic [Joh91], LOTOS [PF92] and DisCo [Sys94] all have been used. Prototypes are expressed directly as specifications in the formal notation; their behavior is observed by animating the spe... |

14 |
The Caml Light system, release 0.6. Documentation and userâ€™s manual
- Leroy
- 1993
(Show Context)
Citation Context ...the user interface: the user can either set the dial or the slider to some value. The while loop models the behavior of the notifier. What follows is a formalization of this observation. 9 Caml Light =-=[Ler93]-=-, not Standard ML. The formal system we use to express and reason about our models is a version of type theory [Chu40, And86] called higher-order logic [Gor86]. Higherorder logic extends first-order l... |

11 | Using temporal logic to support the specification and prototyping of interactive control systems
- Johnson, Harrison
- 1992
(Show Context)
Citation Context ...igns. To take advantage of tools and methodologies, these notations usually are based on an existing (concurrent) formal notation. Statecharts [Mar86], CSP [Ale87a], Petri nets [BP90], temporal logic =-=[Joh91]-=-, LOTOS [PF92] and DisCo [Sys94] all have been used. Prototypes are expressed directly as specifications in the formal notation; their behavior is observed by animating the specifications. While there... |

11 |
A Formal Description Method for User Interfaces
- Marshall
- 1987
(Show Context)
Citation Context ... executable formal notation to express user interface designs. To take advantage of tools and methodologies, these notations usually are based on an existing (concurrent) formal notation. Statecharts =-=[Mar86]-=-, CSP [Ale87a], Petri nets [BP90], temporal logic [Joh91], LOTOS [PF92] and DisCo [Sys94] all have been used. Prototypes are expressed directly as specifications in the formal notation; their behavior... |

10 | User Interface Languages: A Survey Of Existing - Abowd, Bowen, et al. - 1989 |

8 |
Formally-based Tools and Techniques for Human-Computer Dialogues
- Alexander
- 1987
(Show Context)
Citation Context ...especially of concern in safety- and security-critical applications. In part, this has spurred research into drawing together formal specification and rapid prototyping for user interface development =-=[Ale87b]-=-. One common approach is to use a directly executable formal notation to express user interface designs. To take advantage of tools and methodologies, these notations usually are based on an existing ... |

5 |
22 tips for a happier, healthier prototype
- Rudd, Isensee
- 1994
(Show Context)
Citation Context ...ues surveyed in [Ale87b], [ABD + 89] and [HT90] provide more than rudimentary prototypes for experimentation. As the success of the experimental effort often depends on how realistic the prototype is =-=[RI94], this can-=- be a significant issue. With respect to safety- and security-critical systems this is important since one of the goals of HCI engineering is to reduce the incidence of "user error" [CH94]. ... |

4 |
State of the Art
- Myers
- 1992
(Show Context)
Citation Context ...evidence suggests that "the only reliable method for generating quality user interfaces is to test prototypes with actual end users and modify the design based on the users' comments and performa=-=nce" [Mye92]-=-. However, the prototyping approach to user interface development is not without drawbacks. One criticism is that it does not provide the same assurance as formal approaches that requirements are bein... |

3 |
Workbench User's Guide
- PARTS
- 1992
(Show Context)
Citation Context ...f an existing user interface and then use this prototype as a basis for reasoning. This possibility is indicated by the dotted part of Figure 1. A growing number of commercial UIMSes (PARTS Workbench =-=[Dig92]-=-, Visual Age [IBM94] and Visual AppBuilder [Pla94], for example) use a restricted dataflow formalism for specifying user interfaces: restricted in that the topology is (mostly) static, the primitives ... |

3 |
Specifying user interfaces in DisCo
- Systa
- 1994
(Show Context)
Citation Context ... and methodologies, these notations usually are based on an existing (concurrent) formal notation. Statecharts [Mar86], CSP [Ale87a], Petri nets [BP90], temporal logic [Joh91], LOTOS [PF92] and DisCo =-=[Sys94]-=- all have been used. Prototypes are expressed directly as specifications in the formal notation; their behavior is observed by animating the specifications. While there have been various reports of su... |

2 |
A WIMP no more
- Curtis, Hefley
- 1994
(Show Context)
Citation Context ...s [RI94], this can be a significant issue. With respect to safety- and security-critical systems this is important since one of the goals of HCI engineering is to reduce the incidence of "user er=-=ror" [CH94]-=-. 3. Formal reasoning is limited to what can easily be expressed in the chosen notation. For example, when using the previously mentioned formal description techniques (FDTs), reasoning is usually lim... |

2 | An effective test strategy - Sturgis - 1985 |

2 |
Mechanizing nondeterministic programming logics in higher-order logic
- Tredoux
- 1993
(Show Context)
Citation Context ...behaviors directly in terms of state sequences, we express them in terms of guarded commands [Nel89] and express commands, in turn, as predicates on state sequences using the mechanization of Tredoux =-=[Tre93]. For exam-=-ple, the predicate " := " representing assignment commands is defined as: ` def 8x exp: x := exp = (e: 9s s': (e = pair (s; s'))s(s' = bnd (exp s) x s)) e is a state sequence representing th... |

2 |
The challenges facing formal description techniques
- West
- 1993
(Show Context)
Citation Context ...justify in situations where the most effective way to develop the next release of an implementation includes rapid prototyping of new functionality within the framework of the existing implementation =-=[Wes93]-=-. In this paper we propose an alternative approach to combining formal techniques and prototyping in user interface construction that addresses these issues. The framework that we propose is component... |

1 |
Formally-based techniques for dialogue design
- Alexander
- 1987
(Show Context)
Citation Context ...ormal notation to express user interface designs. To take advantage of tools and methodologies, these notations usually are based on an existing (concurrent) formal notation. Statecharts [Mar86], CSP =-=[Ale87a]-=-, Petri nets [BP90], temporal logic [Joh91], LOTOS [PF92] and DisCo [Sys94] all have been used. Prototypes are expressed directly as specifications in the formal notation; their behavior is observed b... |

1 |
Novell's visual appbuilder (sidebar to: "radical development
- Plain
- 1994
(Show Context)
Citation Context ...totype as a basis for reasoning. This possibility is indicated by the dotted part of Figure 1. A growing number of commercial UIMSes (PARTS Workbench [Dig92], Visual Age [IBM94] and Visual AppBuilder =-=[Pla94]-=-, for example) use a restricted dataflow formalism for specifying user interfaces: restricted in that the topology is (mostly) static, the primitives are objects (widgets) and functions not processes,... |