Using Model Checking to Explore Checklist-Guided Pilot Behavior

Bolton, Matthew L.; Bass, Ellen J.

doi:10.1080/10508414.2012.718240

Cited by 20 publications

(12 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this application, several problems with HAI were discovered and the results of the analysis were used to investigate the source of the failures. Impressively, the method discovered the problems associated with the pilot not adjusting the aircraft's flaps in time, something not discovered in previous analyses [49].…”

Section: Discussionmentioning

confidence: 88%

“…To illustrate how this method can be used to find problems in an HAI-dependent aerospace system, we present an application: a pilot attempting to perform the before landing checklist (a slightly modified version of a model previously discussed in [49]). In this application, a pilot is performing an instrument approach where he or she is navigating the aircraft to the runway using vertical guidance (the glide slope).…”

Section: Applicationmentioning

confidence: 99%

See 1 more Smart Citation

Automatically Generating Specification Properties From Task Models for the Formal Verification of Human–Automation Interaction

Bolton

Jimenez

Paassen

et al. 2014

IEEE Trans. Human-Mach. Syst.

Self Cite

View full text Add to dashboard Cite

Human-automation interaction (HAI) is often a contributor to failures in complex systems. This is frequently due to system interactions that were not anticipated by designers and analysts. Model checking is a method of formal verification analysis that automatically proves whether or not a formal system model adheres to desirable specification properties. Task analytic models can be included in formal system models to allow HAI to be evaluated with model checking. However, previous work in this area has required analysts to manually formulate the properties to check. Such a practice can be prone to analyst error and oversight which can result in unexpected dangerous HAI conditions not being discovered. To address this, this paper presents a method for automatically generating specification properties from task models that enables analysts to use formal verification to check for system HAI problems they may not have anticipated. This paper describes the design and implementation of the method. An example (a pilot performing a before landing checklist) is presented to illustrate its utility. Limitations of this approach and future research directions are discussed.Index Terms-Formal methods, human-automation interaction (HAI), model checking, system safety, task analysis.

show abstract

Section: Discussionmentioning

confidence: 88%

Section: Applicationmentioning

confidence: 99%

Automatically Generating Specification Properties From Task Models for the Formal Verification of Human–Automation Interaction

Bolton

Jimenez

Paassen

et al. 2014

IEEE Trans. Human-Mach. Syst.

Self Cite

View full text Add to dashboard Cite

show abstract

“…To compare with those needs, we developed a formal framework for the analysis of human-computer interaction systems modelling based on time automaton. Compared with other models [36], our novel approach describes the formal models of user and supervisor activities with their machine behavior by adopting the modelling techniques of time automaton with full control and mode preserving. Also, we propose a technique to generate the supervisor interface based on multiple users with a machine and user interface through weak bi-simulation.…”

Section: Discussionmentioning

confidence: 99%

Formal Analysis and Design of Supervisor and User Interface Allowing for Non-Deterministic Choices Using Weak Bi-Simulation

Khan

Wenlong

2018

Applied Sciences

View full text Add to dashboard Cite

Abstract:In human machine systems, a user display should contain sufficient information to encapsulate expressive and normative human operator behavior. Failure in such system that is commanded by supervisor can be difficult to anticipate because of unexpected interactions between the different users and machines. Currently, most interfaces have non-deterministic choices at state of machine. Inspired by the theories of single user of an interface established on discrete event system, we present a formal model of multiple users, multiple machines, a supervisor and a supervisor machine. The syntax and semantics of these models are based on the system specification using timed automata that adheres to desirable specification properties conducive to solving the non-deterministic choices for usability properties of the supervisor and user interface. Further, the succinct interface developed by applying the weak bi-simulation relation, where large classes of potentially equivalent states are refined into a smaller one, enables the supervisor and user to perform specified task correctly. Finally, the proposed approach is applied to a model of a manufacturing system with several users interacting with their machines, a supervisor with several users and a supervisor with a supervisor machine to illustrate the design procedure of human-machine systems. The formal specification is validated by z-eves toolset.

show abstract

“…It is not clear how often the less scalable decompositions will be used. However, every decomposition operator has been used in some application (Bolton, 2010, 2011; Bolton and Bass, 2009a,b, 2010a,b, in press; Bolton et al, 2011). Future work should investigate how the frequency with which different decomposition operators are used will impact the scalability of the method.…”

Section: Discussionmentioning

confidence: 99%

Generating phenotypical erroneous human behavior to evaluate human–automation interaction using model checking

Bolton¹,

Bass²,

Siminiceanu³

2012

International Journal of Human-Computer Studies

Self Cite

View full text Add to dashboard Cite

Breakdowns in complex systems often occur as a result of system elements interacting in unanticipated ways. In systems with human operators, human-automation interaction associated with both normative and erroneous human behavior can contribute to such failures. Model-driven design and analysis techniques provide engineers with formal methods tools and techniques capable of evaluating how human behavior can contribute to system failures. This paper presents a novel method for automatically generating task analytic models encompassing both normative and erroneous human behavior from normative task models. The generated erroneous behavior is capable of replicating Hollnagel’s zero-order phenotypes of erroneous action for omissions, jumps, repetitions, and intrusions. Multiple phenotypical acts can occur in sequence, thus allowing for the generation of higher order phenotypes. The task behavior model pattern capable of generating erroneous behavior can be integrated into a formal system model so that system safety properties can be formally verified with a model checker. This allows analysts to prove that a human-automation interactive system (as represented by the model) will or will not satisfy safety properties with both normative and generated erroneous human behavior. We present benchmarks related to the size of the statespace and verification time of models to show how the erroneous human behavior generation process scales. We demonstrate the method with a case study: the operation of a radiation therapy machine. A potential problem resulting from a generated erroneous human action is discovered. A design intervention is presented which prevents this problem from occurring. We discuss how our method could be used to evaluate larger applications and recommend future paths of development.

show abstract

Using Model Checking to Explore Checklist-Guided Pilot Behavior

Cited by 20 publications

References 15 publications

Automatically Generating Specification Properties From Task Models for the Formal Verification of Human–Automation Interaction

Automatically Generating Specification Properties From Task Models for the Formal Verification of Human–Automation Interaction

Formal Analysis and Design of Supervisor and User Interface Allowing for Non-Deterministic Choices Using Weak Bi-Simulation

Generating phenotypical erroneous human behavior to evaluate human–automation interaction using model checking

Contact Info

Product

Resources

About