In human-machine systems, a user gets abstracted information of a machine via an interface and operates it referring to a manual. If a manual has an erroneous description leading to automation surprises, the user may be lost in his/her operations so that he/she may make a serious human error. In this paper, we propose an algorithm for generating a manual by which automation surprises never occur. We model the machine and the interface as a discrete event system and a mapping from machine's state to a display of the interface, respectively. First, we represent a manual as a finite language and model behavior of the system operated by the user with the manual as a tree called an operational tree. Next, we characterize three automation surprises using the tree. Finally, we propose an algorithm for generating an operational tree by which the machine reaches a target state.

This paper analyzes automation surprises in human-machine systems with time information. Automation surprises are phenomena such that the underlying machine's behavior diverges from user's intention and may lead to critical situations. Thus, designing human-machine systems without automation surprises is one of fundamental issues to achieve reliable user interaction with the machines. In this paper, we focus on timed human-machine interaction and address their formal aspects. The presented framework is essentially an extension of untimed human-machine interaction and will cover the previously proposed methodologies. We employ timed automata as a model of human-machine systems with time information. Modeling the human-machine systems as timed automata enables one to deal with not only discrete behavior but also time constraints. Then, by introducing the concept of timed simulation of the machine model and the user model, conditions which guarantee the nonexistence of automation surprises are derived. Finally, we construct a composite model in which a machine model and a user model evolve concurrently and show that automation surprises can be detected by solving a reachability problem in the composite model.

This paper presents two man-machine reliability models. A system consists of one machine unit, one operator, and one event detecting monitor. The machine unit has three states, normal, abnormal, and failed. The event detecting monitor may fail in two ways. If a machine unit becomes abnormal, the event detecting monitor sends a signal, and the operator takes necessary actions. If the operator fails in the action in the cause of human error, the machine unit goes down. The condition of the operator is classified into two types, good and bad. The time to repair, and the human error rate both depend on the condition of the operator. The MTTF is obtained by using a Markov model and numerical computation. Furthermore, the optimal operating period which minimizes the overall cost is decided by using computer methods. Some numerical examples are shown.