Formal socio-technical barrier modelling for safety-critical interactive systems design

Basnyat, Sandra; Palanque, Philippe; Schupp, Bastiaan A.; Wright, Peter

doi:10.1016/j.ssci.2007.01.001

Cited by 36 publications

(19 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Some of this work utilized general formal modeling notations such as state charts [9], Interacting Communicating Objects (ICOs) [10], and Communicating Sequential Processes (CSP) [11], in which it is the job of the analyst to represent task analytic modeling concepts in the formal notation. While such notations are very expressive, and the analyses using them can be very powerful, human factors and human-automation interaction engineers do not generally use such notations to represent human behavior.…”

Section: Related Workmentioning

confidence: 99%

Toward a multi-method approach to formalizing human-automation interaction and human-human communications

Bass

Bolton

Feigh

et al. 2011

2011 IEEE International Conference on Systems, Man, and Cybernetics

View full text Add to dashboard Cite

Breakdowns in complex systems often occur as a result of system elements interacting in ways unanticipated by analysts or designers. The use of task behavior as part of a larger, formal system model is potentially useful for analyzing such problems because it allows the ramifications of different human behaviors to be verified in relation to other aspects of the system. A component of task behavior largely overlooked to date is the role of human-human interaction, particularly humanhuman communication in complex human-computer systems. We are developing a multi-method approach based on extending the Enhanced Operator Function Model language to address human agent communications (EOFMC). This approach includes analyses via theorem proving and future support for model checking linked through the EOFMC top level XML description.Herein, we consider an aviation scenario in which an air traffic controller needs a flight crew to change the heading for spacing. Although this example, at first glance, seems to be one simple task, on closer inspection we find that it involves local human-human communication, remote human-human communication, multi-party communications, communication protocols, and human-automation interaction. We show how all these varied communications can be handled within the context of EOFMC.

show abstract

Section: Related Workmentioning

confidence: 99%

Toward a multi-method approach to formalizing human-automation interaction and human-human communications

Bass

Bolton

Feigh

et al. 2011

2011 IEEE International Conference on Systems, Man, and Cybernetics

View full text Add to dashboard Cite

show abstract

“…Because they can be represented discretely, task analytic models can be used to include human behavior in formal system models along with other system elements including device automation, HDIs, and the operational environment [37]- [41], [43]- [50]. This allows system safety properties to be verified in light of the modeled human behavior which could include any erroneous behaviors incorporated into the model using the aforementioned techniques.…”

Section: B Erroneous Behavior Task Models and Formal Methodsmentioning

confidence: 99%

“…The vast majority of previous techniques have focussed on verifying system safety with normative human task behavior, and do not consider erroneous human behavior [37]- [41], [43]- [46], [48]- [50]. Those that do include erroneous behavior have typically focused on manually inserting them into task analytic models at locations the analysts think might cause problems [47], [58]- [62].…”

Section: A Comparison With Other Task-based Approachesmentioning

confidence: 99%

“…Formal system models can include a model of cognitively driven human behavior [24]- [27], and formal verification can be used to evaluate when the modeled cognitive factors could result in erroneous human behavior causing a problem [28]- [34]. Finally, task analytic behavior models (products of a cognitive task analysis [35], [36]) can be included in the formal system model and formal verification can be used to evaluate the impact of the modeled behavior (which can be normative or erroneous) on system safety [37]- [50]. While there are distinct tradeoffs between 1 Mode confusion is an HAI issue that occurs when the human operator is unable to keep track of the state or mode of the device automation [12], [13].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Generating Erroneous Human Behavior From Strategic Knowledge in Task Models and Evaluating Its Impact on System Safety With Model Checking

Bolton

Bass

2013

IEEE Trans. Syst. Man Cybern, Syst.

View full text Add to dashboard Cite

Human-automation interaction, including erroneous human behavior, is a factor in the failure of complex, safety-critical systems. This paper presents a method for automatically generating formal task analytic models encompassing both erroneous and normative human behavior from normative task models, where the misapplication of strategic knowledge is used to generate erroneous behavior. Resulting models can be automatically incorporated into larger formal system models so that safety properties can be formally verified with a model checker. This allows analysts to prove that a human-automation interactive system (as represented by the formal model) will or will not satisfy safety properties with both normative and generated erroneous human behavior. Benchmarks are reported that illustrate how this method scales. The method is then illustrated with a case study: the programming of a patientcontrolled analgesia pump. In this example, a problem resulting from a generated erroneous human behavior is discovered. The method is further employed to evaluate the effectiveness of different solutions to the discovered problem. The results and future research directions are discussed.Index Terms-Formal methods, human error, humanautomation interaction (HAI), model checking, system safety, task analysis.

show abstract

“…A number of researchers have incorporated task analytic models into formal system models of human-automation interactive systems by either modeling task behavior natively in the formal notation (Basnyat et al, 2007, 2008; Campos, 2003; Gunter et al, 2009) or translating task analytic models implemented in task analytic representations (such as CTT, EOFM, or UAN) into the formal notation (Aït-Ameur and Baron, 2006; Aït-Ameur et al, 2003; Bolton and Bass, 2009b, 2010a; Bolton et al, 2011; Fields, 2001; Palanque et al, 1996; Paternò and Santoro, 2001; Paternò et al, 1998). This allows system safety properties to be verified in light of the modeled, normative human behavior, thus giving researchers a means of proving that (assuming the representativeness of their system model) the system will always operate safely if the human operators adhere to the modeled behavior.…”

Section: Introductionmentioning

confidence: 99%

Generating phenotypical erroneous human behavior to evaluate human–automation interaction using model checking

Bolton¹,

Bass²,

Siminiceanu³

2012

International Journal of Human-Computer Studies

View full text Add to dashboard Cite

Breakdowns in complex systems often occur as a result of system elements interacting in unanticipated ways. In systems with human operators, human-automation interaction associated with both normative and erroneous human behavior can contribute to such failures. Model-driven design and analysis techniques provide engineers with formal methods tools and techniques capable of evaluating how human behavior can contribute to system failures. This paper presents a novel method for automatically generating task analytic models encompassing both normative and erroneous human behavior from normative task models. The generated erroneous behavior is capable of replicating Hollnagel’s zero-order phenotypes of erroneous action for omissions, jumps, repetitions, and intrusions. Multiple phenotypical acts can occur in sequence, thus allowing for the generation of higher order phenotypes. The task behavior model pattern capable of generating erroneous behavior can be integrated into a formal system model so that system safety properties can be formally verified with a model checker. This allows analysts to prove that a human-automation interactive system (as represented by the model) will or will not satisfy safety properties with both normative and generated erroneous human behavior. We present benchmarks related to the size of the statespace and verification time of models to show how the erroneous human behavior generation process scales. We demonstrate the method with a case study: the operation of a radiation therapy machine. A potential problem resulting from a generated erroneous human action is discovered. A design intervention is presented which prevents this problem from occurring. We discuss how our method could be used to evaluate larger applications and recommend future paths of development.

show abstract

Formal socio-technical barrier modelling for safety-critical interactive systems design

Cited by 36 publications

References 5 publications

Toward a multi-method approach to formalizing human-automation interaction and human-human communications

Toward a multi-method approach to formalizing human-automation interaction and human-human communications

Generating Erroneous Human Behavior From Strategic Knowledge in Task Models and Evaluating Its Impact on System Safety With Model Checking

Generating phenotypical erroneous human behavior to evaluate human–automation interaction using model checking

Contact Info

Product

Resources

About