Experiences with a Formal Method for Design and Automatic Checking of User Interfaces

This paper addresses our experience in using and developing the VEG (Visual Event Grammars) toolkit for the formal specification, verification, design and implementation of graphical user interfaces. In fact, VEG follows the traditional Seeheim’s model, decomposing a GUI in three parts. The Presentation Part takes into account how the different components of the GUI are depicted and laid out (e.g., colors, borders, sizes and locations); in VEG this is delegated to an external presentation design toolkit. The Dialog Control Part specifies all possible interactions among GUI components (their dynamic behavior, i.e., sequences of actions taken in response to a user-initiated event). The Application Interface Part specifies how the GUI gets linked to the application that effectively does the work requested by the user, e.g., by making the Dialog Control Part to invoke suitable application methods. The VEG notation of the toolkit is used only to describe the dialog control of GUIs, rather than their presentation: a VEG specification is completely independent of the actual layout of the GUI. Separation of presentation and behavior allows the reuse of the same logic with different presentations (e.g., in multiinterface systems such as banking systems allowing access through automatic tellers or web pages). Dialogs in VEG are specified by means of modular, communicating grammars, which have an intuitive visual notation, supported by a visual editor called Dialog Control Editor (DCE). The basic idea underlying the VEG framework is to consider sequences of user input events as sentences in a formal language. These sentences obey some syntactic rules described by grammars (or automata). For example, in some circumstances, opening a document that is already open should be forbidden. In this sense, the grammar describes all authorized sequences of input actions. The VEG notation is based on describing a set of rules, each one defining the behavior of a component in a different state. The typical structure of each rule is: