Eric Barboni

ICOs: A model-based user interface description technique dedicated to interactive systems addressing usability, reliability and scalability

The design of real-life complex systems calls for advanced software engineering models, methods, and tools in order to meet critical requirements such as reliability, dependability, safety, or resilience that will avoid putting the company, the mission, or even human life at stake. When such systems encompass a substantial interactive component, the same level of confidence is required towards the human-computer interface. Conventional empirical or semiformal techniques, although very fruitful, do not provide sufficient insight on the reliability of the human-system cooperation, and offer no easy way to, for example, quantitatively and qualitatively compare two design options with respect to that reliability. The aim of this article is to present a user interface description language (called ICOs) for the engineering and development of usable and reliable user interfaces. The CASE tool supporting the ICOs notation (called Petshop) is a Petri nets-based-tool for the design, specification, prototyping, and validation of interactive software. In that environment models (built with the formal description technique ICOs) of the interactive application can be interactively modified and executed. This is used to support prototyping phases (when the models and the interactive application evolve significantly to meet late user requirements, for instance) as well as the operation phase (after the system is deployed). The use of ICOs and PetShop is presented on several large-scale systems such as a multimodal ground segment application for satellite control, an air traffic control interactive application, and an application for new generation of interactive cockpits in large civil aircraft such as Airbus A380 or Boeing 787. The article emphasizes the demonstration of the expressive power of the notation and how it can support the description of various aspects of user interfaces, namely interaction techniques (both WIMP and post-WIMP), interactive components (such as widgets), and the behavioral part of interactive applications such as the dialog and the functional core. It also demonstrates that PetShop provides dedicated support for prototyping activities of behavioral aspects at the various levels of the architecture of interactive systems. While the focus is on past work done on various large-scale applications, the article also highlights why and how ICOs and Petshop are able to address challenges raised by next-generation user interfaces.

Beyond modelling: an integrated environment supporting co-execution of tasks and systems models

This paper focuses on the articulations of task models and system models. Tasks models are meant to be used by human factor specialists whilst system models are supposed to be produced by software engineers. However, tasks models and systems models represent two different views on how users interacting with a computing system to reach a goal. This paper presents an integration framework aiming to take full advantage of task models and system models that have been developed initially in a separated manner and how these two views can be integrated at the model level and additionally at the tool level. The main contribution of the paper lies in the definition of such integration at the tool level to be used at runtime (while the user is operating the system). Indeed, thanks to this integration contextual help can be offered to the users supporting the construction of the mental bridge between what they have to do (defined in the tasks model) and what the interactive system allows (defined in the system model). The approach, the tools and the integration are presented on a case study of a Weather Radar System (WXR) embedded in aircraft cockpits.

Task-model based assessment of automation levels: Application to space ground segments

Designing systems in such a way that as much functions as possible are automated has been the driving direction of research and engineering in aviation, space and more generally in computer science for many years. In the 90s many studies (e.g. [12] related to the notion of mode confusion) have demonstrated that fully automated systems are out of the grasp of current technologies and that additionally migrating functions [2] from the operator to the system might have disastrous impact on operations both in terms of safety and usability. In order to be able to design automation with a hedonic view of the involved factors (safety, usability, reliability, …) a complete understanding of operators tasks is required prior to considering migrating them to the system side. This paper proposes a contribution for reasoning about automation designs using a model-based approach exploiting refined task models. These models describe operations with enough details in order to reason about automation and to rationalize automation designs. In this paper we present how such representations can support the assessment of alternative design options for automation. The proposed approach is applied to satellite ground segments.

A model-based approach for supporting engineering usability evaluation of interaction techniques

This paper offers a contribution for engineering interaction techniques by proposing a model-based approach for supporting usability evaluation. This approach combines different techniques including formal analysis of models, simulation and, in particular, analysis of log data in a model-based environment. This approach is integrated in a process and is supported by a model-based CASE tool for modeling, simulation and evaluation of interactive systems. A case study illustrates the approach and operation of the tool. The results demonstrate that the log data at model level can be used not only to identify usability problems but also to identify where to operate changes to these models in order to fix usability problems. Finally we show how the analysis of log data allows the designer to easily shape up the interaction technique (as the results of log analysis are presented at the same abstraction level of models). Such as an approach offers an alternative to user testing that are very difficult to configure and to interpret especially when advanced interaction techniques are concerned

Formal description of multi-touch interactions

The widespread use of multi-touch devices and the large amount of research that has been carried out around them has made this technology mature in a very short amount of time. This makes it possible to consider multi-touch interactions in the context of safety critical systems. Indeed, beyond this technical aspect, multi-touch interactions present significant benefits such as input-output integration, reduction of physical space, sophisticated multi-modal interaction? However, interactive cockpits belonging to the class of safety critical systems, development processes and methods used in the mass market industry are not suitable as they usually focus on usability and user experience factors upstaging dependability. This paper presents a tool-supported model-based approach suitable for the development of interactive systems featuring multi-touch interactions techniques. We demonstrate the possibility to describe touch interaction techniques in a complete and unambiguous way and that the formal description technique is amenable to verification. The capabilities of the notation is demonstrated over two different interaction techniques (namely Pitch and Tap and Hold) together with a software architecture explaining how these interaction techniques can be embedded in an interactive application.

Software Components: a Formal Semantics Based on Coloured Petri Nets

Abstract This paper proposes a component model compliant with the current practice of Software Engineering, yet provided with a sound formal semantics based on Coloured Petri nets. Our proposal is structured as follows: 1) Define a component model. We have chosen a component model inspired by the CORBA Component Model (CCM), yet simpler and more precise. 2) Propose a notation to formally specify the internal behaviour of a software component. Our formal approach is based on Coloured Petri nets which makes it well suited to the modelling of concurrent, distributed or event-driven systems, and amenable to formal verification. 3) Define a mapping from the constructs of the component model (facets, receptacles, event sources and sinks) to the constructs of the Petri-net based behavioural specification (e.g. places, transitions, etc.). 4) Provide a formal definition of inter-components communication primitives, (invocation of methods, event-based communication). This definition is also given in terms of Petri nets. 5) Provide a denotational semantics of an assembly of components, in order to define the behaviour of such a system in terms of the individual behaviour of each component and of the formal definition of inter-component communication primitives. The expected benefits of such an approach are threefold: 1) Offer a convenient notation for describing the internal behaviour of concurrent and distributed software components, 2) Provide a formal, unambiguous semantics of component features such as event multicast or service invocation, 3) And, with the previous two being necessary conditions, offer some means to reason about assemblies of components designed with this approach, in particular to mathematically verify properties on them.

A development process for usable large scale interactive critical systems: application to satellite ground segments

While a significant effort is being undertaken by the Human-Computer Interaction community in order to extend current knowledge about how users interact with computing devices and how to design and evaluate new interaction techniques, very little has been done to improve the reliability of software offering such interaction techniques. However, malfunctions and failures occur in interactive systems leading to incidents or accidents that, in aviation for instance, are [22] 80% of the time attributed to human error demonstrating the inadequacy between the system and its operators. As an error may have a huge impact on human life, strong requirements are usually set both on the final system and on the development process itself. Interactive safety-critical systems have to be designed taking into account on an equal basis several properties including usability, reliability and operability while their associated design process is required to handle issues such as scalability, verification, testing and traceability. However, software development solutions in the area of critical systems are not adequate leading to defects especially when the interactive aspects are considered. Additionally, the training program development is always designed independently from the system development leading to operators trained with inadequate material. In this paper we propose a new iterative design process embedding multiple design and modeling techniques (both formal and informal) advocated by HCI and dependable computing domains. These techniques have been adapted and tuned for interactive systems and are used in a synergistic way in order to support the integration of factors such as usability, dependability and operability and at the same time in order to deal with scalability, verification and traceability.

Analysis of WIMP and Post WIMP Interactive Systems based on Formal Specification

While designing interactive software, the use of a formal specification technique is of great help by providing non-ambiguous, complete and concise descriptions. The advantages of using such a formalism is widened if it is provided by formal analysis techniques that allow to prove properties about the design, thus giving an early verification to the designer before the application is actually implemented. This paper presents how models built using the Interactive Cooperative Objects formalism (ICOs) are amenable to formal verification. The emphasis is on the behavioral part of the description of the interactive systems and more precisely on the properties at the interaction technique level. However, the process and the associated tools can be generalized to the other parts of the interactive systems (including the non-interactive parts).

A Formal Description Technique for Interactive Cockpit Applications Compliant with ARINC Specification 661

The purpose of the ARINC specification 661 is to define interfaces to a cockpit display system (CDS) targeting new aircraft installations. ARINC 661 provides precise information for communication protocols between application and user interface components (called widgets) as well as precise information about the widgets themselves. However, no information is given on the behavior of these widgets and on the behavior of an application made up of a set of such widgets. This paper presents a formal description technique called interactive cooperative objects to define in a precise and non-ambiguous way such behaviors. This description technique also defines the relationships between the behavioral description and the user interface. We show the benefits of such a notation for the specification of interactive cockpit applications and we introduce each modeling concept on a small example.

Interactive cockpits as critical applications: a model-based and a fault-tolerant approach

The deployment of higher interactivity in avionic digital cockpits for critical applications is a challenge today both in terms of software engineering and fault-tolerance. The dependability of the user interface and its related supporting software must be consistent with the criticality of the functions to be controlled. The approach proposed in this paper combines fault prevention and fault-tolerance techniques to address this challenge. Following the ARINC 661 standard, a model-based development of interactive objects namely widgets and layers aims at providing zero-defect software. Regarding remaining software faults in the underlying runtime support and also physical faults, the approach is based on fault tolerance design patterns, like self-checking components and replication techniques. The proposed solution relies on the space and time partitioning provided by the executive support following the ARINC 653 standard. Defining and designing resilient interactive cockpits is a necessity in the near future as these command and control systems provide a great opportunity to improve maintenance, evolvability and usability of avionic systems.