Safer “5–key” number entry user interfaces using Differential Formal Analysis

Abstract

Differential formal analysis is a new user interface analytic evaluation method based on stochastic user simulation. The method is particularly valuable for evaluating safety critical user interfaces, which often have subtle programming issues. The approach starts with the identification of operational design features that define the design space to be explored. Two or more analysts are required to analyse all combinations of design features by simulating keystroke sequences containing keying slip errors. Each simulation produces numerical values that rank the design combinations on the basis of their sensitivity to keying slip errors. A systematic discussion of the simulation results is performed for assessing the causes of any discrepancy, either in numerical values or rankings. The process is iterated until outcomes are agreed upon. In short, the approach combines rigorous simulation of user slip errors with diversity in modelling and analysis methods. Although the method can be applied to other types of user interface, it is demonstrated through a case study of 5-key number entry systems, which are a common safety critical user interface style found in many medical infusion pumps and elsewhere. The results uncover critical design issues, and are an important contribution of this paper since the results provide device manufacturers guidelines to update their device firmware to make their devices safer.

State of the Art on Formal Methods for Interactive Systems

“…Infusion pumps are medical devices used to deliver drugs to patients. Deep investigation has been done of the data entry systems of such devices (Cauchi et al 2012b;Cauchi et al 2014;Gimblett and Thimbleby 2013;Masci et al 2011;Oladimeji et al 2011;Oladimeji et al 2013;Thimbleby 2010;Thimbleby and Gimblett 2011;Tu et al 2014). If a nurse makes an error in setting up an infusion (for instance, a number ten times larger than the necessary for the patient's therapy), the patient may die.…”

Unreliable numbers: error and harm induced by bad design can be reduced by better design

“…Probabilistic methods have previously been used to find input that crashes programs [ 30 ], but, apart from our own work [ 5 , 31 ], building on methods to assess usability [ 6 , 7 , 19 ], they have not been used to assess safety or accuracy. The present paper is the first to consider operator error correction and the behaviour of delete and clear keys.…”

“…We note that some number entry user interfaces are defective in complex and subtle ways, and for them reverse engineering serves to help expose their design problems [ 31 ].…”

The benefits of formalising design guidelines: a case study on the predictability of drug infusion pumps

“…The B-Braun Infusomat Space's number entry system is an example of "5-keys" user interfaces [9]: four arrow keys and a confirmation button (see Fig. 1).…”