INTERACTION DESIGN AND REDUNDANCY STRATEGY IN

CRITICAL SYSTEMS

Marcos Salenko Guimarães, M. Cecilia C. Baranauskas and Eliane Martins

Instituto de Computação, Universidade Estadual de Campinas. Av. Albert Einstein, 1251, Campinas-SP, Brazil

Keywords: Semiotics, Organisational Semiotics, Human-Computer Interaction, Communication, Software Engineering.

Abstract: Hardware and software systems have grown to support the work on critical areas that used to be managed

mostly by human beings. Concepts and challenges regarding critical systems have long been discussed by

several authors, although communication-based aspects have not been explicitly considered. In this paper,

we propose a procedure for designing interaction in critical systems under the communication perspective;

the procedure results in a user interface wireframe as outcome. Semiotics is used as theoretical and

methodological background in the proposed design procedure. The Scientific Satellite Payload Operation

Support System (SAPOP) is used to illustrate the potentiality this perspective brings to safety-critical

systems.

1 INTRODUCTION

A growing demand on hardware and software

systems is also expanding into critical areas that

used to be managed mostly by human beings. The

concept of a critical system has been discussed by

several authors encompassing from conceptual to

technical issues. The safety-critical category of

system is defined as a system whose failure would

provoke catastrophic or unacceptable consequences

for human life (Paulson, 1997).

Literature on critical systems has long shown

dramatic cases of human-system failures that

resulted in people’s deaths. Therac-25 is a typical

case: an X-ray used to obtain bone images (through

x-ray emission) or to treat tumours (through

radiation emission). The message “Malfunction 54”

had no meanings for operators, who just ignored it

(Mackie and Sommerville, 2000), although, for the

software developer, the message intended to inform

that the radiation dosage was above normal values.

Due to this human-computer communication

problem reflected in the user interface (UI), the

consequence of this episode was disastrous leading

to several deaths because of the extreme radiation

injected to patients. More dramatically, as the effect

of over dosage was not instantaneous, it took several

years for the problem to be identified.

In aviation systems, many incidents (unexpected

events that may or may not lead to accidents that

may lead to deaths) have reasons originated from

failures occurring during user-system interaction.

Harrison shows some statistics: from 34 total

incidents (1979-1992); 4% of the deaths were due to

physical causes; 3% of the deaths were due to

software error; 92% of the deaths were due to

problems related to human-computer interaction

(Harrison, 2004). Moreover, according to ATC (Air

Traffic Control), 90% of the air traffic incidents

were due to faults attributed to pilots or controllers.

Nowadays, the flight decks (or cockpits) have

multifunction computer displays where huge

amounts of information are presented (Carver and

Turoff, 2007). This new concept of modern cockpit,

named “glass cockpit”, provides rich amount of

information presented as graphical elements through

diagrams and symbolic information. In parallel with

this evolution, sophisticated automation systems

may produce conflicting data from different sources

forcing decisions about which information to act

upon. The pilot needs to navigate through layers and

layers of information becoming more a system

engineer than a pilot.

The ReSIST project (ReSIST, 2008) created a

new field of study, Resilience Systems, which

includes safety-critical systems. Several gaps and

challenges regarding resilience-building technology

are discussed in terms of architecture, algorithms,

socio-technical factors, verification and evaluation

165

Salenko GuimarÃ

ces M., Martins E. and Baranauskas M.

INTERACTION DESIGN AND REDUNDANCY STRATEGY IN CRITICAL SYSTEMS.

DOI: 10.5220/0003267001650172

In Proceedings of the Twelfth International Conference on Informatics and Semiotics in Organisations (ICISO 2010), page

ISBN: 978-989-8425-26-3

aspects. The resilience needs encompass several

aspects including the usability of systems,

particularly the ubiquitous ones. Helping users

interaction with ubiquitous systems aims at

understanding the potential effects of their actions as

well as preventing them from taking actions with

unwanted and difficult to anticipate system-level

effects. Usability is considered one of the most

important aspects to consider in critical systems;

gaps and challenges are still being identified in the

ReSIST project.

The study of signs and rules operating upon them

and upon their use, form the core of the human

communication study. As there is no communication

without a system of signs, Semiotics, as a discipline

concerned with the analysis of signs or the study of

the functioning of sign systems, may offer an

appropriate foundation for this study. Organizational

Semiotics (OS) is one of the branches of Semiotics

particularly related to business and organizations

(Liu, 2000). The study in OS is based on the

fundamental observation that all organized

behaviour is made effective through the

communication and interpretation of signs by

people, individually or in groups. The aim of OS

studies is to find new and insightful ways of

analyzing, describing and explaining the structure

and behaviour of organizations, including their inner

workings, and the interactions with the environment

and with one another.

The goal of this work is to bring communication

to the discussion of safety-critical systems by

proposing an interaction design procedure in these

systems based on a semiotic-informed theoretical

and methodological background. This procedure

allows to obtain a UI structure (wireframe) using

semiotic artefacts. The proposed approach is

presented with a case study on the Scientific

Satellite Payload Support System (SAPOP), a

system to help research investigators, sub-system

operator and operation coordinator to program the

satellite for executing experiments during the flight

using Web services (Francisco and Sagukawa,

2006).

The paper is organized in the following way: the

next section presents the theoretical and technical

background of this work. The third section presents

the proposed design procedure with some semiotic

artefacts considered as income and a UI wireframe

as outcome. Section four presents the SAPOP case

study with this proposed interaction design. Section

five has the analysis of the produced UI wireframe.

This work finishes with the conclusion section

summarizing the contribution and pointing out to

new challenges.

2 THEORETICAL

BACKGROUND

Semiotics is a discipline concerned with the use of

signs, their function in communicating meanings and

intentions, and their social consequences.

Organizational Semiotics (OS), one of the

branches of Semiotics, understands that any

organized behaviour is governed by a system of

social norms which are communicated through

signs. OS methods and artefacts provide a better

understanding of the interested parties of a focal

problem, their requirements, as well as the

restrictions not only regarding the information

system, but the software system as well (Bonacin et.

al., 2006). Methods for Eliciting, Analyzing and

Specifying Users’ Requirements (MEASUR), which

resulted from Stamper’s research work in the late

70´s (Stamper, 1993), constitute a set of methods to

deal with all aspects of information system design.

The Semiotic Ladder (SL) is an artefact primarily

used to clarify some important Information System

notions such as information, meaning and

communication (Cordeiro and Filipe, 2004).

Stamper extended the traditional semiotic divisions

of syntactics, semantics and pragmatics by adding

three other layers: social world, physical world and

empirics as depicted in Figure 1, which, all together,

form the SL.

Figure 1: Semiotic Ladder (Stamper, 1973).

A communication is considered successful if all

these six levels of the SL are successfully

accomplished. The communication in the upper

levels depends on the result of the communication

on the lower levels. These levels provide different

ICISO 2010 - International Conference on Informatics and Semiotics in Organisations

166

views for analysis of different aspects of signs. The

Physical World deals with the physical aspects of

signs (Stamper, 1973). In telecommunication, for

example, there are some physical signs such as those

transported by cable or radio waves. The Empirics

deals with the statistical properties of signs such as

channel capacity, patterns, efficiency. In the

Syntactic level, the signs and their relations to other

signs form a structure, language, data and records.

The Semantics deals with signs and their relations to

meanings that users perceive. In the Pragmatic level,

the signs and their intention and effect on users are

identified. Finally, in the Social World, the signs and

their relation to social implications are considered.

Therefore, the SL links technology, human factors

and social issues.

The Fractal Model of Communication (FMC)

(Salles et al., 2001; Salles, 2000) is used to capture

the structure of the communication involved in the

application domain. FMC stresses the fact that, in

order to design the primary message (the system’s

interface), other fractionated messages must be

carefully designed and appropriate channels must be

chosen to convey them. The FMC models agents in

communication through channels. Figure 2

represents this concept of communication in which,

in one level, agents B and C communicate through

channel A. In another level, A assumes the role of an

agent in communication with C through channel AC.

Figure 2: The Fractal Model of Communication (Salles,

2000).

The FMC is appropriate for representing the

communication structure in critical systems as it

makes explicit information about the agents

(physical and human) and all the media used in their

communication. It allows capturing potential

communication failures and to provide redundancy

that would be extremely useful for designing the

interaction in critical systems. While the FMC

provides a structure for analysing agents in

communication, the SL allows a deeper analysis into

the channels they use to communicate.

3 COMMUNICATION-BASED

INTERACTION DESIGN

The use of Semiotics (Liu, 2000) to focus on the

communicational aspects involved in the

requirements elicitation for critical systems is

discussed in Guimarães et. al. (2007). In a critical

system design, the FMC with SL artefacts were

proposed in previous work for modelling

communication in critical systems (Guimarães and

Baranauskas, 2009; Guimarães et. al., 2008). This

work extends this modelling focusing exclusively on

the interaction design.

The first step is obtaining the FMC model in the

interaction design context through a filtering

procedure. Initially, the model has user(s) and

agent(s) which can also be interaction channels.

Interaction agents or interaction channels consist on

agents or channels which interact directly with the

user (direct connection to user). All agents and

channels which don’t have direct connection with

any user (called non-interactive agents and channels)

are just removed and, consequently, all connections

are propagated to an interaction channel or agent.

Figure 3 illustrates this filtering procedure with the

connection propagation where the grey

representations are interaction channels and the

white ones are non-interactive agents and channels

which are removed and the connections are

transported to a nearest interaction channel.

Figure 3: Designing User Interface Wireframe.

The next step is the definition of the UI structure. As

Figure 3 depicts, channels may use other channels

for communicating with user, if a channel A uses

channel B, then B is an interaction object inside A.

For example, the channel A could be a window that

uses a channel B that could be a button. In the UI

wireframe, the user will have a window with a

button as internal interaction object.

INTERACTION DESIGN AND REDUNDANCY STRATEGY IN CRITICAL SYSTEMS

167

By the SL definition, as the communication on the

upper layers depend on the lower layers, having a

physical fault means that all layers above this level

will fail and consequently, the overall

communication will fail. In critical systems, the

mechanism for handling this failure may use a

barrier approach that can be defined for the lower

layers. Barrier consists on any mechanism that reacts

handling the fault if a hazard is detected. This

approach can be applied to represent the diverse

physical and organisational decisions that are taken

to prevent a target from being affected by a potential

hazard (Basnyat et. al., 2007).

The characteristics of each interaction channel

are specified in the SL which consists of six

communication levels with respective hazards as

follows in Table 1.

Table 1: Semiotic Ladder.

Layer Description

Physical world Information about the positioning, size,

colours, label and description of the

object interaction appearance. For

example, the button OK is placed at (12,

56), size = 10 x 5 pixels.

hysical world

hazard

Hazard regarding physical world such as

invalid positioning, size, label o

interaction object. For example, these

roblems may happen when the

resolution display is changed or when

the screen is resized.

mpirics Information about limitations on the

channel capacity or information flow

(e.g. transmission rate decreasing, noise

rate increasing). For example, the button

OK can’t handle the double click.

mpirical

hazard

Hazards which may handle due to these

limitations and problems. For example,

what to do, if a button is double clicked.

Syntactic Information about the sequence o

interaction is needed for an interaction

object. It consists on interaction

ehaviour of the interaction channel

with the definition about the actions and

reactions. For example, when the object

is drop-down list, it should appear to

user that at first, a button should be

clicked and after an option can be listed

and then an option can be selected.

Syntactic

hazard

Information about the structure of the

interaction object and its behaviour. For

example, how to inform to user that the

drop-down list is empty dispensing with

the button click.

Semantics Information regarding the meaning of an

interaction channel for the user. For

example, the button should appear

clickable.

Semantic

hazard

Problems related to meanings or

misinterpretation of information,

interaction channel or error messages.

For example, the user can’t recognize

that an object is clickable.

ragmatics Information about the intention behind

the presence of an interaction channel.

For example, the button OK is placed at

the dialog Confirm Remove File for

obtaining the user confirmation before

removing the requested file.

ragmatic

hazard

Problems related to intentions of the

interaction object. For example,

usability problem when the user does

not understand the intention behind a

specific icon.

Social worl

Information about the user expectations,

contract, beliefs, and culture related to

interaction channels. For example, the

expectation of the UI designer must

correspond to the user expectation

following a specific “contract” (e. g.

conventions, culture).

Social world

hazard

Problems related to social and cultural

issues, beliefs, expectations, contracts,

commitments. For example, if the UI

ehaves differently from what the user

was expecting, what it should be done

according to the contract.

These SL layers are useful for specifying the

communication of each interaction channel and also

how to handle communication faults in the six

communicational contexts.

4 A CASE STUDY IN SPACE

SYSTEM

This section presents the interaction design

regarding communication for the Scientific Satellite

Payload Operation Support System (SAPOP),

developed by National Space Research Institute

(INPE) (Francisco and Sagukawa, 2006).

ICISO 2010 - International Conference on Informatics and Semiotics in Organisations

168

4.1 SAPOP Overview

Each satellite has specific missions (e.g.,

atmospheric phenomena analysis) and contains a

payload which consists on a set of instruments with

specific sensors. Each instrument collects and

processes specific data from sensors and sends them

to the satellite on-board computer. This computer,

by its turn, sends data to the ground system through

telemetry; these data are useful for investigators

(researchers who have the direct access to this

payload information) for a specific research purpose.

During the satellite - ground system

communication, some satellites receive sequences of

telecommands (TCs) and send sequences of

telemetry in over-the-air transmission as Figure 4

depicts. The telemetry has information about the

internal satellite system (internal temperature,

internal components status, battery power and so on)

and payload data (information collected by the

payload system which has specific purpose sensors

for scientific studies).

Figure 4: SAPOP system (Francisco and Sagukawa,

2006).

The Payload team (or investigator) uses SAPOP for

defining TCs of the payload system and the sub-

system operators, uses SAPOP for defining TCs of

internal satellite sub-system.. Figure 4 illustrates

SAPOP with the TCs as income, which are defined

by investigators (represented as Scientific

Community) and sub-system operators through

Internet network. The Operation Coordinator (OC) is

the user who authorizes or not the transmitting of

TCs sequences to the satellite through the flight plan

that is stored in a data base server.

The safety-critical aspect of the SAPOP is the

sequence of the TCs that may lead to total or partial

loss of mission (Francisco and Sagukawa, 2006). As

SAPOP is an interactive system, the human error

(e.g. Operation Coordinator mistake) may lead to

total loss of the mission with high cost for the

project. This critical aspect will be analysed under

the communication perspective focusing on the

interaction between the Operation Coordinator (OC)

and SAPOP.

SAPOP is an already existent and functional

system; its UI was already developed. In this work,

the existent UI will be analyzed under the

communication perspective for identifying

communication problems using one of the strategies

known in critical system design: redundancy.

4.2 Designing UI Wireframe

After executing the refining procedure resulting in a

detailed FMC model, the designer not only defines

agents and channels but also all new redundant

channels specifying how the communication is

accomplished in SL six communication levels

(Guimarães and Baranauskas, 2009). The UI

designer executes the filtering procedure to focus on

the interaction channels only, the resulting FMC

model (Figure 5 depicts only a part of this model)

will be useful for defining the UI wireframe. All

channels related to the Flight Plan Generation

Window agent are considered interaction objects and

are located inside the Flight Plan Generation

Window. The Passage Selection channel is an

interaction object inside the Table View interaction

object. The specification of interaction objects is

defined at SL for these channels. Therefore, the

outcome of this procedure is the wireframe as Figure

6 illustrates.

Figure 5: Fractal Model of Communication in Interaction

Design Domain.

Table View consists on visualising the TCs in a table

which is presented in the UI wireframe of SAPOP

original version. The proposed wireframe provides

INTERACTION DESIGN AND REDUNDANCY STRATEGY IN CRITICAL SYSTEMS

169

also a Time View and tabs (as Figure 5 depicts)

allowing changing the Table View to Time View,

which represents another channel for the same

information. If the user doesn’t feel safe editing TCs

in the Table View, the redundant channel Time

View becomes active replacing the first channel.

In the SL, there is information about how to

detect a hazard and also how to handle it in all six

levels. As the SL applies to a specific channel, a

hazard can be detected by a more generic channel.

For example, if the user makes a mistake inverting

the interaction order pressing button Up before

selecting a checkbox in the Telecommands table, the

SL for this button and for this checkbox don’t have

the information about how to detect this interaction

error because each interaction object can just handle

events in its region; events of other interaction

objects can’t be handled by this button. This

interaction error is only detectable by the channel

Flight Plan Generation Window because the scope

of this channel, encompasses these two interaction

objects (button Up and checkbox), allowing to detect

this interaction error in the syntactic level.

Figure 6 depicts the window Flight Plan

Generation with two views that the OC can switch

by clicking on tabs Table View and Time View. To

edit TCs in Table view, OC has a table with the TCs

list, the start time, the experiment name and the user

identification who added the TC. OC can use a

checkbox for selecting a TC and can just change the

order of selected TCs in the table (by clicking on the

buttons Up and Down) or remove selected TCs (by

clicking on button Remove).

In the Time View, which is a new view provided

by the proposed SAPOP UI, OC has the chronology

of TCs (a sequence of time is represented) with start

time and end time. The TCs are placed according to

the time that corresponds to Start Time column in

Table View. OC can change the order and remove

hazardous TC selecting a line and after it, clicking a

buttons Up, Down or Remove.

When OC finishes the work, to submit the edited

TC sequence, OC clicks on button OK or cancels it

by clicking on the Cancel button.

After developing the FMC model and the SL

artefacts, the UI designer should analyse all

interaction channels verifying all SL layers. . The

result is a verification whether a specific SL layer

may fail. For example, if the user can´t understand

the meaning of the Table View in the window Flight

Plan Generation, it means that the Semantic layer of

channel Telecommand Table failed. According to

the SL definition, all upper levels are compromised

by that failure.

Figure 6: Wireframe for the Flight Plan Generation

window.

In the FMC model as Figure 5 depicts, the channel

Telecommand Table considered as failed means all

paths which passes through this channel are

obstructed. Due to the redundancy strategy, there is

another path through channel Time View. Therefore,

in the case of Semantic layer failure of channel

Table View, the Time View can be used.

SL artefacts are useful for determining if more

redundancy is needed, verifying for all SL artefacts

of all interaction channels whether they cover all

possible user profiles defined for SAPOP. Although

this analysis is time consuming for UI designers, it

provides a complete analysis for the UI wireframes

covering from technical contexts (physical world,

empirical and syntactics) to human information

contexts (semantics, pragmatics and social world).

This broad view is necessary mainly for critical

systems that need to be meticulously analysed.

5 EVALUATING SAFETY WITH

THE PROPOSED WIREFRAME

Focusing on the scenario when OC is editing TC in

the window illustrated by Figure 6, the proposed

SAPOP UI has two representations (Time and Table

ICISO 2010 - International Conference on Informatics and Semiotics in Organisations

170

views), with tabs for switching these views while the

original UI has only the table view. This difference

can be analysed based on concepts of the FMC

model and the SL artefact. If the Table View fails by

any reason related to the communication aspect (any

SL layer, e.g. semantically, user cannot understand

the meaning of information), the original UI doesn’t

provide any alternative solution for users because

there is no other path to communicate from SAPOP

to user. The proposed UI provides another path of

communication for users through the channel Time

View as Figure 5 depicts. In the concepts of the SL,

the difference in the channels Table View and Time

View are located at Semantic and Social layers

because the signs were changed. The choice of other

type of view provided by the redundant strategy is

related to the user safety in choosing the

communication channel involving the SL six levels.

Moreover, this strategy doesn’t impact users who

prefer the table view (or any interaction objects of

the original version) because it remains present on

the proposed SAPOP UI. The redundancy allows the

minimum impact for expert users (users who are

already adapted to table view) or users with table

familiarity and extends UI to a new category of

users. The redundancy is not limited to the two

options; it can be extended to include more users

with different abilities.

The communication perspective with the

redundancy strategy contributes for inclusive design

underlying the FMC model. The UI designer can

define safety strategies for the channels which

involve critical information. The SL helps to define

how this critical information is communicated to the

users providing better situational awareness and

either avoiding hazardous consequences.

The drawback of this communication perspective

is the growing of the FMC model, which may be

huge and complex because of the high complexity of

the communicational structure. Developing all the

artefacts is considered hard work because the

number of agents and channels may be very

extensive and, consequently, developing all SLs is

also expensive. Visualization tools may allow the

presentation of the model with a configurable filter

to allow visualizing each fractal dimension

separately, zooming in and out to show only the

agents and channels needed for a specific

consideration.

6 CONCLUSIONS

Communication is a fundamental factor to be

addressed in critical systems. Semiotics provides a

good foundation for analysis and design regarding

communication. This paper proposed a procedure for

focusing on interaction design based on artefacts of

Organisational Semiotics combined with the Fractal

Model of Communication (FMC). The case study

involved the space system SAPOP, which provides

support for scientific satellite payload operation. If it

fails, satellite missions can be lost leading to high

financial loss. This work presented a

communication-based solution for interaction

design, which uses redundancy as strategy to cope

with the critical aspects of interaction with this

system.

The FMC represents agents and channels of

communication with unlimited fractal dimensions.

In this way, the communication model can be

presented in several granularity levels, including

detailed information for each channel, with the six

layers of communication analysis of the Semiotic

Ladder (SL). The FMC and the SL provide support

for designing the structure of communication

containing information regarding the physical world,

the empiric, syntactic, semantic, pragmatic and

social aspects with potential hazards and

correspondent actions. The procedure reaches the

goal leading the FMC to the interaction design and

to the identification of UI design problems of the

SAPOP system. Due to communication perspective,

the challenge for applying the redundancy strategy

for interaction design was accomplished.

Nevertheless, it may grow in complexity presenting

many agents and channels making the reading

difficult and demanding knowledge in several

domain contexts.

The communication perspective may provide

contributions to usability itself, because it is not only

related to "easy to use", but also to "easy to

communicate" providing users with better situational

awareness and, consequently, diminishing the hazard

possibilities related to “human (interaction) error”.

As further work, the UI proposed as a wireframe

needs to be evaluated qualitative and quantitatively

using other methodologies including those

specialized in the critical system field.

ACKNOWLEDGEMENTS

We thank Instituto Nacional de Pesquisas Espaciais

INTERACTION DESIGN AND REDUNDANCY STRATEGY IN CRITICAL SYSTEMS

171

(INPE) for allowing the use of the SAPOP project as

case study in this work.

REFERENCES

Basnyat, S., Palanque, P., Schupp, B., Wright, P., 2007.

Formal Socio-technical Barrier Modelling for Safety-

critical Interactive Systems Design. In Safety Science,

Vol 45, Issue 5, June 2007. ISSN: 0925-7535.

Bonacin, R., Simoni, C.A.C., Melo A.M., Baranauskas

M.C.C., 2006. Organisational Semiotics: Guiding a

Service-Oriented Architecture for e-Government. In

9th International Conference on Organisational

Semiotics, pp 47-58.

Carver, L., Turoff, M., 2007. Human-Computer

Interaction: The Human and Computer as a Team in

Emergency Management Information Systems. In

Communications of the ACM, Vol. 50. No. 3. ACM

Press.

Cordeiro J., and Filipe J., 2004. The Semiotic Pentagram

Framework - A perspective on the use of Semiotics

within Organisational Semiotics. In Proceedings of the

7th International Workshop on Organisational

Semiotics.

Francisco, M.F.M., Sagukawa, B.M., 2006. Safety in a

Web-based Satellite Flight Plan Supporting System. In

SpaceOps 2006 Conference. AIAA 2006-5773.

American Institute of Aeronautics and Astronautics

Inc.

Guimarães, M.S., Baranauskas, M.C.C., 2009. A Case

Study on Modelling the Communication Structure of

Critical Systems. In 11th International Conference on

Informatics and Semiotics in Organisations. IFIP WG

8.1.

Guimarães M. S., Baranauskas M. C. C., Martins E., 2008.

Communication-Based Modelling and Inspection in

Critical Systems. In 10th International Conference on

Enterprise Information Systems, INSTICC Press.

Guimarães, M.S., Baranauskas, M.C.C., Martins, E., 2007.

A Communication-based Approach to Requirements

Elicitation for Safety-Critical Systems. In Proceedings

of 10th International Conference on Organisational

Semiotics. ICOS.

Harrison, M., 2004. Aspects of Human Error: A brief

introduction. In Workshop on Human Computer

Interaction and Dependability. Retrieved October,

2004 from

http://www.laas.fr/IFIPWG/Workshops&Meetings/46/

03-Harrison.pdf, 2004.

Liu, K., 2000. Semiotics in Information Systems

Engineering. Cambridge University Press.

Mackie, J., Sommerville, I., 2000. Failures of Healthcare

Systems. In First Dependability IRC Workshop, 79-85.

Edinburg University Press.

Paulson, L.C., 1997. Software Engineering. University of

Cambridge Press. U.S.A.

ReSIST, 2008. European Network of Excellence ReSIST.

Deliverable D13: From Resilience-Building to

Resilience-Scaling Technologies: Directions.

Retrieved August, 2008 from

http://www.laas.fr/RESIST/index.html.

Salles, J.P., 2000. O Modelo Fractal de Comunicação:

Criando um Espaço de Análise para Inspeção do

Processo de Design de Software. In PhD dissertation,

Departamento de Ciência da Computação, Instituto de

Ciências Exatas. Universidade Federal de Minas

Gerais.

Salles, J.P., Baranauskas M.C.C., Bigonha, R.S., 2001.

Towards a communication model applied to the

interface design process. In Knowledge-Based

Systems, v. 18, n. 8, 2001, pp 455-459.

Sommerville, I., 2003. Engenharia de Software. Addison

Wesley.

Stamper, R.K., 1993. Social Norms in requirements

analysis – an outline of MEASUR. In Requirements

Engineering Technical and Social Aspects. Academic

Press.

Stamper, R.K., 1973. Information in Business and

Administrative Systems. John Wiley and Sons, NY.

ICISO 2010 - International Conference on Informatics and Semiotics in Organisations

172