Decision theory and safety-critical interfaces

Risk assessment techniques are being used to support the engineering of complex, safety-critical systems. They help to identify those situations that pose the greatest threat to an application. They can also be used to inform interface development. For example, operators must be presented with additional contextual information during infrequent, high-cost failures. Many risk assessment techniques cannot represent the temporal properties that aaect usability. Few techniques provide means of reasoning about user input or output. This paper presents means of overcoming these limitations. It is argued that temporal logic can be used to represent sequential and concurrent properties of interaction. The same notation can also be used to specify presentation requirements. Temporal logic does not, however, provide means of representing risk. Decision theory is recruited to introduce probability and cost into the notation. The logic is then applied to reason about the diierent eeects that low frequency, high cost failures have upon a user interface. A limitation of this approach is that the extended logic provides little impression of what it would be like to interact with a stochastic application. Simulation tools have been developed to avoid this limitation.