Verification-guided modelling of salience and cognitive load

Well-designed interfaces use procedural and sensory cues to increase the cognitive salience of appropriate actions. However, empirical studies suggest that cognitive load can influence the strength of those cues. We formalise the relationship between salience and cognitive load revealed by empirical data. We add these rules to our abstract cognitive architecture, based on higher-order logic and developed for the formal verification of usability properties. The interface of a fire engine dispatch task from the empirical studies is then formally modelled and verified. The outcomes of this verification and their comparison with the empirical data provide a way of assessing our salience and load rules. They also guide further iterative refinements of these rules. Furthermore, the juxtaposition of the outcomes of formal analysis and empirical studies suggests new experimental hypotheses, thus providing input to researchers in cognitive science

A hazard analysis method for systematic identification of safety requirements for user interface software in medical devices

© Springer International Publishing AG (outside the US) 2017. Formal methods technologies have the potential to verify the usability and safety of user interface (UI) software design in medical devices, enabling significant reductions in use errors and consequential safety incidents with such devices. This however depends on comprehensive and verifiable safety requirements to leverage these techniques for detecting and preventing flaws in UI software that can induce use errors. This paper presents a hazard analysis method that extends Leveson’s System Theoretic Process Analysis (STPA) with a comprehensive set of causal factor categories, so as to provide developers with clear guidelines for systematic identification of use-related hazards associated with medical devices, their causes embedded in UI software design, and safety requirements for mitigating such hazards. The method is evaluated with a case study on the Gantry-2 radiation therapy system, which demonstrates that (1) as compared to standard STPA, our method allowed us to identify more UI software design issues likely to cause use-related hazards; and (2) the identified UI software design issues facilitated the definition of precise, verifiable safety requirements for UI software, which could be readily formalized in verification tools such as Prototype Verification System (PVS).- U.S. Food and Drug Administration(NORTE-01-0145-FEDER-000016)Sandy Weininger (FDA), Scott Thiel (Navigant Consulting, Inc.), Michelle Jump (Stryker), Stefania Gnesi (ISTI/CNR) and the CHI+MED team (www.chi-med.ac.uk) provided useful feedback and inputs. Paolo Masci’s work is supported by the North Portugal Regional Operational Programme (NORTE 2020) under the PORTUGAL 2020 Partnership Agreement, and by the European Regional Development Fund (ERDF) within Project “NORTE-01-0145-FEDER-000016”.info:eu-repo/semantics/publishedVersio

Po suvokimo vykstančių procesų įtaka reakcijos laiko į stimulo įjungimą ir išjungimą skirtumams

Reaction time to stimuli offset is usually longer than to stimuli onset (offset disadvantage). According to V. Di Lollo et al. (2000), such disadvantage arises from the need to suppress the automatically arisen response to stimulus onset that necessarily precedes the offset. If such is the case, one expects the onset–offset difference to decrease as the delay between stimulus onset and offset (i.e. foreperiod) increases. Results of the first experiment confirmed this hypothesis. A potential confounding factor was identified, however, related to different sensory consequences after the response (i.e. light offset vs. light onset in the reaction time to stimulus onset and offset tasks, respectively). We thus reasoned that, besides suppression, the action effect could influence the results. Results of the second experiment in which the sensory consequences were equalized confirmed the role of the action effect and suggest that, when such an effect is removed, suppression plays a little role in offset disadvantage.Reakcijos į stimulo išjungimą laikas nustatomas ilgesnis nei į stimulo įjungimą. Pasak V. Di Lollo ir bendraautorių (2000), reaguojant į stimulo išjungimą, pirmiausia automatiškai aktyvinamas atsakas į stimulo įjungimą, kuris turi būti nuslopintas. Tai lemia ilgesnį reakcijos į stimulo išjungimą nei į stimulo įjungimą laiką. Jeigu ši reakcijos laiko į stimulo išjungimą delsa iš tikrųjų priklauso nuo atsako į stimulo įjungimą slopinimo, tuomet galima tikėtis, kad šis slopinimas ilgėjant priešstimuliniam intervalui silpnės, taigi reakcijos laiko į stimulo atsiradimą ir išnykimą skirtumas – mažės. Pirmojo eksperimento rezultatai šią hipotezę patvirtino, tačiau, be atsako slopinimo, gautus reakcijos laiko skirtumus galėjo veikti ir skirtingi sensoriniai atsako padariniai skirtingose užduotyse (t. y. šviesos išjungimas reakcijos laiko į stimulo įjungimą užduotyje ir šviesos įjungimas reakcijos laiko į stimulo išjungimą užduotyje), taigi skirtingas veiksmo efektas. Šiai hipotezei patikrinti atlikome antrąjį eksperimentą, kuriame sulyginome sensorinius atsako padarinius abiejose užduotyse. Rezultatai patvirtino veiksmo efekto svarbą ir parodė, kad, sulyginus veiksmo efektą, atsako slopinimas turi mažai įtakos reakcijos laiko į stimulo išjungimą delsai

Su atsaku susiję veiksniai reakcijos laiko į stimulo įjungimą ir išjungimą užduotyse

According to V. Di Lollo et al. (2000), the difference in reaction time to stimulus onset and offset is related to response suppression. By using electromyographic activity recording, in the first experiment, we investigated whether both premotor and motor parts are affected by the task. Furthermore, in the second experiment, we investigated how other response-related factors, such as response type, could contribute to the difference between reaction time to stimulus onset and offset. In the first experiment, eleven subjects 29 ± 4.6 years old (six women and five men) performed reaction time tasks to stimulus onset and offset, and their response-related muscular activity was recorded. Sixteen 21.6 ± 1.5 years old subjects (eight women, eight men) participated in the second experiment, in which two types of responses were required. The results have revealed that differences in the reaction time to stimulus onset and offset are independent of response type and are related to the premotor part of reaction time only.Pasak V. Di Lollo ir bendraautorių (2000), reakcijos laiko į stimulo įjungimą ir išjungimą skirtumai yra susiję su atsako slopinimu. Pirmajame eksperimente elektromiografijos metodu tyrėme, ar abi reakcijos laiko dalys – priešmotorinė ir motorinė – yra veikiamos užduoties. Antrajame eksperimente siekėme išsiaiškinti, kaip kiti su atsaku susiję veiksniai, pavyzdžiui, atsako tipas, galėtų veikti šiuos reakcijos laiko skirtumus. Pirmajame eksperimente dalyvavo vienuolika 29 ± 4,6 metų asmenų (šešios moterys ir penki vyrai), kurie atliko reakcijos laiko į stimulo įjungimą ir išjungimą užduotis, tuo pačiu metu buvo registruojamas atsake dalyvaujančio raumens aktyvumas. Antrajame eksperimente, kuriame naudojome du atsako tipus, dalyvavo šešiolika 21,6 ± 1,5 metų žmonių (aštuonios moterys ir aštuoni vyrai). Rezultatai parodė, kad reakcijos laiko į stimulo įjungimą ir išjungimą skirtumai nepriklauso nuo atsako tipo, be to, šie skirtumai buvo susiję tik su priešmotorine reakcijos laiko dalimi

Combining Human Error Verification and Timing Analysis

Designs can often be unacceptable on performance grounds. In this work, we integrate a GOMS-like ability to predict execution times into the generic cognitive architecture developed for the formal verification of human error related correctness properties. As a result, formal verification and GOMS-like timing analysis are combined within a unified framework. This allows one to judge whether a formally correct design is also acceptable on performance grounds, and vice versa. We illustrate our approach with an example based on a KLM style timing analysis