[PPT] - Formal Methods for Interactive Systems Part 1 Motivations and PowerPoint Presentation

SLIDE 1

Formal Methods for Interactive Systems

Part 1 — Motivations and History Antonio Cerone United Nations University International Institute for Software Technology Macau SAR China email: antonio@iist.unu.edu web: www.iist.unu.edu

A. Cerone, UNU-IIST – p.1/27

SLIDE 2

Motivation — Example

This is the authors’ second attempt at writing this introduction.

A. Cerone, UNU-IIST – p.2/27

SLIDE 3

Motivation — Example

This is the authors’ second attempt at writing this introduction. Our first attempt fell victim to a design quirk coupled with an innocent, though weary and less than attentive, user. [...]

A. Cerone, UNU-IIST – p.2/27

SLIDE 4

Motivation — Example

This is the authors’ second attempt at writing this introduction. Our first attempt fell victim to a design quirk coupled with an innocent, though weary and less than attentive, user. [...] The ‘save’ and ‘delete’ options, both of which are correctly classified as file-level operations, are consequently adjacent items in the menu.

A. Cerone, UNU-IIST – p.2/27

SLIDE 5

Motivation — Example

This is the authors’ second attempt at writing this introduction. Our first attempt fell victim to a design quirk coupled with an innocent, though weary and less than attentive, user. [...] The ‘save’ and ‘delete’ options, both of which are correctly classified as file-level operations, are consequently adjacent items in the menu. [...] it is all too easy for the hand to slip, inadvertently selecting delete instead of save.

A. Cerone, UNU-IIST – p.2/27

SLIDE 6

Motivation — Example

This is the authors’ second attempt at writing this introduction. Our first attempt fell victim to a design quirk coupled with an innocent, though weary and less than attentive, user. [...] The ‘save’ and ‘delete’ options, both of which are correctly classified as file-level operations, are consequently adjacent items in the menu. [...] it is all too easy for the hand to slip, inadvertently selecting delete instead of save. Of course, the delete option, being well thought out, pops up a confirmation box allowing the user to cancel a mistaken command.

A. Cerone, UNU-IIST – p.2/27

SLIDE 7

Motivation — Example

This is the authors’ second attempt at writing this introduction. Our first attempt fell victim to a design quirk coupled with an innocent, though weary and less than attentive, user. [...] The ‘save’ and ‘delete’ options, both of which are correctly classified as file-level operations, are consequently adjacent items in the menu. [...] it is all too easy for the hand to slip, inadvertently selecting delete instead of save. Of course, the delete option, being well thought out, pops up a confirmation box allowing the user to cancel a mistaken

command. Unfortunately, the save option produces a very similar

confirmation box [...]

A. Cerone, UNU-IIST – p.2/27

SLIDE 8

Example: good design?

This is the authors’ second attempt at writing this introduction. Our first attempt fell victim to a design quirk coupled with an innocent, though weary and less than attentive, user. [...] The ‘save’ and ‘delete’ options, both of which are correctly classified as file-level operations, are consequently adjacent items in the menu. [...] it is all too easy for the hand to slip, inadvertently selecting delete instead of save. Of course, the delete option, being well thought out, pops up a confirmation box allowing the user to cancel a mistaken

command. Unfortunately, the save option produces a very similar

confirmation box [...]

A. Cerone, UNU-IIST – p.3/27

SLIDE 9

Example: but ...

This is the authors’ second attempt at writing this introduction. Our first attempt fell victim to a design quirk coupled with an innocent, though weary and less than attentive, user. [...] The ‘save’ and ‘delete’ options, both of which are correctly classified as file-level operations, are consequently adjacent items in the menu. [...] it is all too easy for the hand to slip, inadvertently selecting delete instead of save. Of course, the delete option, being well thought out, pops up a confirmation box allowing the user to cancel a mistaken

command. Unfortunately, the save option produces a very similar

confirmation box [...]

A. Cerone, UNU-IIST – p.4/27

SLIDE 10

Example: catastrophe!

This is the authors’ second attempt at writing this introduction. Our first attempt fell victim to a design quirk coupled with an innocent, though weary and less than attentive, user. [...] The ‘save’ and ‘delete’ options, both of which are correctly classified as file-level operations, are consequently adjacent items in the menu. [...] it is all too easy for the hand to slip, inadvertently selecting delete instead of save. Of course, the delete option, being well thought out, pops up a confirmation box allowing the user to cancel a mistaken

command. Unfortunately, the save option produces a very similar

confirmation box — it was only as we hit the ‘Confirm’ button that we noticed the word ‘delete’ at the top...

A. Cerone, UNU-IIST – p.5/27

SLIDE 11

Example: catastrophe!

This is the authors’ second attempt at writing this introduction. Our first attempt fell victim to a design quirk coupled with an innocent, though weary and less than attentive, user. [...] The ‘save’ and ‘delete’ options, both of which are correctly classified as file-level operations, are consequently adjacent items in the menu. [...] it is all too easy for the hand to slip, inadvertently selecting delete instead of save. Of course, the delete option, being well thought out, pops up a confirmation box allowing the user to cancel a mistaken

command. Unfortunately, the save option produces a very similar

confirmation box — it was only as we hit the ‘Confirm’ button that we noticed the word ‘delete’ at the top... [Dix et al. 98] Alan Dix, Janet Finaly, Gregory Abowd, Russel Beale. Human-Computer Interaction. Prentice Hall, 2nd Edition, 1998.

A. Cerone, UNU-IIST – p.5/27

SLIDE 12

Example: design problems?

This is the authors’ second attempt at writing this introduction. Our first attempt fell victim to a design quirk coupled with an innocent, though weary and less than attentive, user. [...] The ‘save’ and ‘delete’ options, both of which are correctly classified as file-level operations, are consequently adjacent items in the menu. [...] it is all too easy for the hand to slip, inadvertently selecting delete instead of save. Of course, the delete option, being well thought out, pops up a confirmation box allowing the user to cancel a mistaken

command. Unfortunately, the save option produces a very similar

confirmation box — it was only as we hit the ‘Confirm’ button that we noticed the word ‘delete’ at the top...

A. Cerone, UNU-IIST – p.6/27

SLIDE 13

Example: design problems?

This is the authors’ second attempt at writing this introduction. Our first attempt fell victim to a design quirk coupled with an innocent, though weary and less than attentive, user. [...] The ‘save’ and ‘delete’ options, both of which are correctly classified as file-level operations, are consequently adjacent items in the menu. [...] it is all too easy for the hand to slip, inadvertently selecting delete instead of save. Of course, the delete option, being well thought out, pops up a confirmation box allowing the user to cancel a mistaken

command. Unfortunately, the save option produces a very similar

confirmation box — it was only as we hit the ‘Confirm’ button that we noticed the word ‘delete’ at the top...

Design logic does not take the user into account!

A. Cerone, UNU-IIST – p.6/27

SLIDE 14

Example: poor usability!

This is the authors’ second attempt at writing this introduction. Our first attempt fell victim to a design quirk coupled with an innocent, though weary and less than attentive, user. [...] The ‘save’ and ‘delete’ options, both of which are correctly classified as file-level operations, are consequently adjacent items in the menu. [...] it is all too easy for the hand to slip, inadvertently selecting delete instead of save. Of course, the delete option, being well thought out, pops up a confirmation box allowing the user to cancel a mistaken

command. Unfortunately, the save option produces a very similar

confirmation box — it was only as we hit the ‘Confirm’ button that we noticed the word ‘delete’ at the top...

Design logic does not address user’s capabilities and limitations

A. Cerone, UNU-IIST – p.7/27

SLIDE 15

Why Poor Usability

User friendly and easy to use
A. Cerone, UNU-IIST – p.8/27

SLIDE 16

Why Poor Usability

User friendly and easy to use from the point of

view of the designer

A. Cerone, UNU-IIST – p.8/27

SLIDE 17

Why Poor Usability

User friendly and easy to use from the point of

view of the designer

the designer is potentially a user
A. Cerone, UNU-IIST – p.8/27

SLIDE 18

Why Poor Usability

User friendly and easy to use from the point of

view of the designer

the designer is potentially a user =

⇒

implicit assumptions on the user’s

capabilities and behaviour

A. Cerone, UNU-IIST – p.8/27

SLIDE 19

Why Poor Usability

User friendly and easy to use from the point of

view of the designer

the designer is potentially a user =

⇒

implicit assumptions on the user’s

capabilities and behaviour

explicit assumptions on the user’s

knowledge of the system

A. Cerone, UNU-IIST – p.8/27

SLIDE 20

Why Poor Usability

User friendly and easy to use from the point of

view of the designer

the designer is potentially a user =

⇒

implicit assumptions on the user’s

capabilities and behaviour

explicit assumptions on the user’s

knowledge of the system — the user has entirely read and understood the manual

A. Cerone, UNU-IIST – p.8/27

SLIDE 21

Why Poor Usability

User friendly and easy to use from the point of

view of the designer

the designer is potentially a user =

⇒

implicit assumptions on the user’s

capabilities and behaviour

explicit assumptions on the user’s

knowledge of the system — the user has entirely read and understood the manual

interface viewed as plug-in separate from the

rest of the system

A. Cerone, UNU-IIST – p.8/27

SLIDE 22

User neglected = ⇒

User friendly and easy to use from the point of

view of the designer

the designer is potentially a user =

⇒

implicit assumptions on the user’s

capabilities and behaviour

explicit assumptions on the user’s

knowledge of the system — the user has entirely read and understood the manual

interface viewed as plug-in separate from the

rest of the system

A. Cerone, UNU-IIST – p.9/27

SLIDE 23

User-centered Design

USER = first priority in the requirements of

interactive systems (SE)

the designer is potentially a user =

⇒

implicit assumptions on the user’s

capabilities and behaviour

explicit assumptions on the user’s

knowledge of the system — the user has entirely read and understood the manual

interface viewed as plug-in separate from the

rest of the system

A. Cerone, UNU-IIST – p.10/27

SLIDE 24

Implicit Assumptions = ⇒

USER = first priority in the requirements of

interactive systems (SE)

the designer is potentially a user =

⇒

implicit assumptions on the user’s

capabilities and behaviour

explicit assumptions on the user’s

knowledge of the system — the user has entirely read and understood the manual

interface viewed as plug-in separate from the

rest of the system

A. Cerone, UNU-IIST – p.11/27

SLIDE 25

Study of Human Being

USER = first priority in the requirements of

interactive systems (SE)

study of the mind (perception, thinking and

learning) and behaviour of the human being (Psychology) and related experiments

explicit assumptions on the user’s

knowledge of the system — the user has entirely read and understood the manual

interface viewed as plug-in separate from the

rest of the system

A. Cerone, UNU-IIST – p.12/27

SLIDE 26

Positive Assumptions = ⇒

USER = first priority in the requirements of

interactive systems (SE)

study of the mind (perception, thinking and

learning) and behaviour of the human being (Psychology) and related experiments

explicit assumptions on the user’s

knowledge of the system — the user has entirely read and understood the manual

interface viewed as plug-in separate from the

rest of the system

A. Cerone, UNU-IIST – p.13/27

SLIDE 27

Negative Assumptions

USER = first priority in the requirements of

interactive systems (SE)

study of the mind (perception, thinking and

learning) and behaviour of the human being (Psychology) and related experiments

explicit assumptions on user’s physical and

cognitive limitations and environmental and social constraints (Ergonomics, Cognitive Science and Sociology)

interface viewed as plug-in separate from the

rest of the system

A. Cerone, UNU-IIST – p.14/27

SLIDE 28

Separate HCI Design = ⇒

USER = first priority in the requirements of

interactive systems (SE)

study of the mind (perception, thinking and

learning) and behaviour of the human being (Psychology) and related experiments

explicit assumptions on user’s physical and

cognitive limitations and environmental and social constraints (Ergonomics, Cognitive Science and Sociology)

interface viewed as plug-in separate from the

rest of the system

A. Cerone, UNU-IIST – p.15/27

SLIDE 29

Integrated HCI Design

USER = first priority in the requirements of

interactive systems (SE)

study of the mind (perception, thinking and

learning) and behaviour of the human being (Psychology) and related experiments

explicit assumptions on user’s physical and

cognitive limitations and environmental and social constraints (Ergonomics, Cognitive Science and Sociology)

interface developed integrally with the rest of

the system (SE) to support tasks people want to do and forgive careless mistakes

A. Cerone, UNU-IIST – p.16/27

SLIDE 30

Improving Usability

USER = first priority in the requirements of

interactive systems (SE)

study of the mind (perception, thinking and

learning) and behaviour of the human being (Psychology) and related experiments

explicit assumptions on user’s physical and

cognitive limitations and environmental and social constraints (Ergonomics, Cognitive Science and Sociology)

interface developed integrally with the rest of

the system (SE) to support tasks people want to do and forgive careless mistakes

A. Cerone, UNU-IIST – p.17/27

SLIDE 31

Multidisciplinary Approach

Contribution from many disciplines:

Software Engineering
Psychology (Social, Cognitive, Personality,

Industrial and Engineering Psychology)

Ergonomics
Cognitive Science
Sociology
A. Cerone, UNU-IIST – p.18/27

SLIDE 32

Wide Range of Expertise

Psychology and Cognitive Science to give knowledge of the user’s

perceptual, cognitive and problem-solving skills

Ergonomics for the user’s physical capabilities
Sociology to help understandig the wider context of the interaction
Computer Science and Software Engineering to be able to build the

necessary technology

Business to be able to market the built technology
Graphic Design to produce an effective interface presentation
Technical Writing to produce the manuals
A. Cerone, UNU-IIST – p.19/27

SLIDE 33

Wide Range of Expertise

Psychology and Cognitive Science to give knowledge of the user’s

perceptual, cognitive and problem-solving skills

Ergonomics for the user’s physical capabilities
Sociology to help understandig the wider context of the interaction
Computer Science and Software Engineering to be able to build the

necessary technology

Business to be able to market the built technology
Graphic Design to produce an effective interface presentation
Technical Writing to produce the manuals

Too much expertise to be included in a design team

A. Cerone, UNU-IIST – p.19/27

SLIDE 34

Wide Range of Expertise

Psychology and Cognitive Science to give knowledge of the user’s

perceptual, cognitive and problem-solving skills

Ergonomics for the user’s physical capabilities
Sociology to help understandig the wider context of the interaction
Computer Science and Software Engineering to be able to build the

necessary technology

Business to be able to market the built technology
Graphic Design to produce an effective interface presentation
Technical Writing to produce the manuals

Too much expertise to be included in a design team In practice people tend to take a strong stance on

ne side or another
A. Cerone, UNU-IIST – p.19/27

SLIDE 35

Interdisciplinary Research

Multidisciplinary Research Centres:

UCL Interaction Centre

(University College London, London, UK) http://www.uclic.ucl.ac.uk/

Key Centre for Human Factors and Applied Cognitive Psychology

(University of Queensland, Brisbane, Australia) http://www.humanfactors.uq.edu.au/

NASA Human Systems Integration Division

(NASA Ames Research Centre, USA) http://hsi.arc.nasa.gov/

HCI Group: http://hci.arc.nasa.gov/
A. Cerone, UNU-IIST – p.20/27

SLIDE 36

History of HCI

study of human performance

early 20th century in factories emphasis on manual tasks

A. Cerone, UNU-IIST – p.21/27

SLIDE 37

History of HCI

study of human performance

early 20th century in factories emphasis on manual tasks

2nd World War

urged study of interaction human-machine goal: produce more powerful weapons

A. Cerone, UNU-IIST – p.21/27

SLIDE 38

History of HCI

study of human performance

early 20th century in factories emphasis on manual tasks

2nd World War

urged study of interaction human-machine goal: produce more powerful weapons

1949

Ergonomic Research Society

A. Cerone, UNU-IIST – p.21/27

SLIDE 39

History of HCI

study of human performance

early 20th century in factories emphasis on manual tasks

2nd World War

urged study of interaction human-machine goal: produce more powerful weapons

1949

Ergonomic Research Society

1982

Conference on Human Factors in Computing, Gaithersburg HCI as a professional community

A. Cerone, UNU-IIST – p.21/27

SLIDE 40

Def of HCI (ACM)

the discipline concerned with the design, evaluation, and implementation of interactive computing systems for human use and with the study of major phenomena surrounding them

[ACM special interest Group on Computer-Human Interaction Curriculum De- velopment Group, 1992]

A. Cerone, UNU-IIST – p.22/27

SLIDE 41

Def of HCI (Dix et al.)

the study of people, computer technology and the ways these influence each other

[Dix et al. 98]

A. Cerone, UNU-IIST – p.23/27

SLIDE 42

Requirements and Goal of HCI

the study of people, computer technology and the ways these influence each other

[Dix et al. 98]

A. Cerone, UNU-IIST – p.24/27

SLIDE 43

Requirements and Goal of HCI

the study of people, computer technology and the ways these influence each other

[Dix et al. 98]

Requirements of HCI

computer technology
the people who interact with it
A. Cerone, UNU-IIST – p.24/27

SLIDE 44

Requirements and Goal of HCI

the study of people, computer technology and the ways these influence each other

[Dix et al. 98]

Requirements of HCI

computer technology
the people who interact with it

Goal of HCI

usability =

⇒ to prevent user errors

A. Cerone, UNU-IIST – p.24/27

SLIDE 45

Consequences of Human Errors

may just be temporary inconvenience or annoyance in interactive systems such as

word processors
VCR, DVD
radio, CD, AC
A. Cerone, UNU-IIST – p.25/27

SLIDE 46

Consequences of Human Errors

may just be temporary inconvenience or annoyance in interactive systems such as

word processors
VCR, DVD
radio, CD, AC in cars?
A. Cerone, UNU-IIST – p.25/27

SLIDE 47

Consequences of Human Errors

may just be temporary inconvenience or annoyance in interactive systems such as

word processors
VCR, DVD
radio, CD, AC in cars?

distract the driver = ⇒ may cause human errors in driving = ⇒ it’s unsafe!!!

A. Cerone, UNU-IIST – p.25/27

SLIDE 48

Catastrophic Effects

Human errors may cause

safety violations in domains such as chemical

and nuclear plants, air traffic control, trasporation systems, health systems

security violations in domains such as

e-commerce, e-voting, defence with catastrophic effects

A. Cerone, UNU-IIST – p.26/27

SLIDE 49

Catastrophic Effects

Human errors may cause

safety violations in domains such as chemical

and nuclear plants, air traffic control, trasporation systems, health systems

security violations in domains such as

e-commerce, e-voting, defence with catastrophic effects = ⇒ need to use formal methods

A. Cerone, UNU-IIST – p.26/27

SLIDE 50

National Standards

used to deal with safety and security issues without mentioning HCI aspects

A. Cerone, UNU-IIST – p.27/27

SLIDE 51

National Standards

used to deal with safety and security issues without mentioning HCI aspects = ⇒ human error appears in many accident reports as the main cause of the catastrophe

A. Cerone, UNU-IIST – p.27/27

SLIDE 52

National Standards

used to deal with safety and security issues without mentioning HCI aspects = ⇒ human error appears in many accident reports as the main cause of the catastrophe Recently national health and safety standards are starting to explicitly include usability

A. Cerone, UNU-IIST – p.27/27

SLIDE 53

National Standards

used to deal with safety and security issues without mentioning HCI aspects = ⇒ human error appears in many accident reports as the main cause of the catastrophe Recently national health and safety standards are starting to explicitly include usability Example EC directive 90/270/EEC

A. Cerone, UNU-IIST – p.27/27

SLIDE 54

Appendix

A. Cerone, UNU-IIST – p.28/27

SLIDE 55

Social Sciences

Study of people.

A. Cerone, UNU-IIST – p.29/27

SLIDE 56

Social Sciences

Study of people. Different kinds of Social Sciences are:

A. Cerone, UNU-IIST – p.29/27

SLIDE 57

Social Sciences

Study of people. Different kinds of Social Sciences are:

Political Science;
A. Cerone, UNU-IIST – p.29/27

SLIDE 58

Social Sciences

Study of people. Different kinds of Social Sciences are:

Political Science;
Economy;
A. Cerone, UNU-IIST – p.29/27

SLIDE 59

Social Sciences

Study of people. Different kinds of Social Sciences are:

Political Science;
Economy;
Sociology;
A. Cerone, UNU-IIST – p.29/27

SLIDE 60

Social Sciences

Study of people. Different kinds of Social Sciences are:

Political Science;
Economy;
Sociology;
Physical Anthropology;
A. Cerone, UNU-IIST – p.29/27

SLIDE 61

Social Sciences

Study of people. Different kinds of Social Sciences are:

Political Science;
Economy;
Sociology;
Physical Anthropology;
Cultural Anthropology;
A. Cerone, UNU-IIST – p.29/27

SLIDE 62

Social Sciences

Study of people. Different kinds of Social Sciences are:

Political Science;
Economy;
Sociology;
Physical Anthropology;
Cultural Anthropology;
Psychology;
A. Cerone, UNU-IIST – p.29/27

SLIDE 63

Social Sciences

Study of people. Different kinds of Social Sciences are:

Political Science;
Economy;
Sociology;
Physical Anthropology;
Cultural Anthropology;
Psychology;

have slightly different perspectives and emphases in their study of people.

A. Cerone, UNU-IIST – p.29/27

SLIDE 64

Psychology

Psychology is a Social Science that aims at studying

A. Cerone, UNU-IIST – p.30/27

SLIDE 65

Psychology

Psychology is a Social Science that aims at studying

mind — the means by which people
perceive,
think,
learn and
feel;
A. Cerone, UNU-IIST – p.30/27

SLIDE 66

Psychology

Psychology is a Social Science that aims at studying

mind — the means by which people
perceive,
think,
learn and
feel;
behaviour — how people
act,
interact with others and
understand themselves.
A. Cerone, UNU-IIST – p.30/27

SLIDE 67

Def. of Cognitive Psychology

Cognitive Psychology is the field of Psychology that aims at studying how people

perceive,
learn,
remember and
think

about information

A. Cerone, UNU-IIST – p.31/27

SLIDE 68

Def. of Cognitive Psychology

Cognitive Psychology is the field of Psychology that aims at studying how people

perceive,
learn,
remember and
think

about information

Examples

Why do people remember some facts but forget others?
How do people think when they play chess or solve everyday problems?
A. Cerone, UNU-IIST – p.31/27

SLIDE 69

Def. of Sociology

Sociology is a Social Science that aims at studying groups of individuals, such as groups of people

in various kinds of works or
having different incomes.
A. Cerone, UNU-IIST – p.32/27

SLIDE 70

Ergonomics

Ergonomics is a Multidisciplinary Science that aims at studying how a workplace and the equipment used there can be best designed for confort, efficiency, safety and productivity.

A. Cerone, UNU-IIST – p.33/27

SLIDE 71

Ergonomics

Ergonomics is a Multidisciplinary Science that aims at studying how a workplace and the equipment used there can be best designed for confort, efficiency, safety and productivity. We speak about Human Factors when we include cognitive issues.

A. Cerone, UNU-IIST – p.33/27

SLIDE 72

Def. of Social Psychology

Social Psychology is the field of Psychology that aims at studying how people interact with each

ther,
both as individuals
and in groups.
A. Cerone, UNU-IIST – p.34/27

SLIDE 73

Def. of Social Psychology

Social Psychology is the field of Psychology that aims at studying how people interact with each

ther,
both as individuals
and in groups.

Examples

Why are people attached to each other, and why do people like and even

love one another?

Why are people sometimes generous and helpful, and why are they

sometimes not?

A. Cerone, UNU-IIST – p.34/27

SLIDE 74

Def. of Personality Psychology

Personality Psychology is the field of Psychology that aims at studying personal dispositions that lead people to behave as they do.

A. Cerone, UNU-IIST – p.35/27

SLIDE 75

Def. of Personality Psychology

Personality Psychology is the field of Psychology that aims at studying personal dispositions that lead people to behave as they do.

Examples

Why are some people highly sociable, whereas others seem to prefer just

the company of very few other people?

What makes some people high conscientious and others less so?
A. Cerone, UNU-IIST – p.35/27

SLIDE 76

Def. of Industrial Psychology

Industrial Psychology is the field of Psychology applied to

decision making, and
hiring

in institutional settings, such as

workplaces, and
businesses.
A. Cerone, UNU-IIST – p.36/27

SLIDE 77

Def. of Engineering Psychology

Engineering Psychology is the field of Psychology that

deals with human-machine interaction, and
aim to make interactive systems more

user-friendly.

A. Cerone, UNU-IIST – p.37/27