Literate specification: using design rationale to support formal methods in the development of human-machine interfaces

• Authors: Christopher W. Johnson
• Venue: Human-Computer Interaction
• Year: 1996

The design of safety-critical user interfaces is typically very different from that of many other applications. Reactor control systems and aircraft cockpits are complex and dynamic, open to input from many different users and devices. A number of formal notations, including Z and temporal logic, have been developed to address these problems. They provide precise and concise means of representing a potential design before designers incur the expense of implementation. Consequently, government bodies and commercial organizations have recommended that these techniques be used when tendering for their contracts. However, there are a number of limitations that restrict the use of mathematical specifications for interface development in large scale projects. In particular, formal notations cannot easily be used to coordinate the activities of human factors and systems engineering teams. This creates particular difficulties if some group members have only a limited understanding of discrete mathematics. A further problem is that the development of a safety-critical application may take many months, or even years, to complete. This creates difficulties because abstract mathematical specifications cannot be used easily by new members of a development team to understand past design decisions. To avoid these limitations I have developed a literate approach to interface specification. This technique uses a formal development language and a semiformal design rationale to support the design of safety-critical user interfaces.