Creating and analyzing requirement specifications of joint human-computer controllers for safety-critical systems

The causes of many accidents in safety-critical systems, such as aircraft and nuclear pourer plants, can in part be found in the breakdown in communication between operators and computer(s) controlling the system. In this paper, we outline a method to model and analyze a controller in order to uncover potential requirement and design problems that can contribute to this communication breakdown. We illustrate the modeling and analysis techniques on a requirements specification for the guidance system of a high-speed civil transport being developed at NASA Ames. Our analysis revealed several system hazards, including potential sources of mode confusion, incomplete specification of computer response to operator input, as well as assumptions about the knowledge an operator must have in order to successfully control the aircraft.