accepted by all machines: Display Screens, Link
Display, Selection for Bachelor and Selection for
Master. If, for example, machine Link Display is in
the derived state No links, the event Show Link is
refused (not possible).
Local Reasoning in Protocol Models. An im-
portant property of CSP composition is that it
guarantees the ability to reason about the behavior
of the whole (the result of composition) based on
examination of the parts in isolation. This property
is known as local (or modular) reasoning and is
based on the fact that CSP composition ensures Ob-
servational Consistency (J. Ebert, G. Engels, 1994)
between a composite machine and its constituents.
Formally: If we take a sequence, S, of events that
is accepted by the composition (M
1
k M
2
), then the
subsequence, S
′
, of S obtained by removing all events
in S that are not in the alphabet of M
1
would be
accepted by the machine M
1
by itself. In other words,
composing another machine with M
1
cannot ”break
its trace behavior”. For our BaMaS example the local
reasoning means that, based on examination Selec-
tion for Bachelor alone, we can determine that the
sequence hOpenUI, SelectPB, SelectIM, SelectPMi
is not a possible sequence for Selection for Bache-
lorkSelection for Master, as hOpenUI, SelectPBi is
not a trace of Selection for Bachelor.
Local reasoning of this kind is an important in fa-
cilitating separate modeling of the parts of a software
system, and in retaining intellectual control overcom-
plexity as the model grows. This property of CSP
composition was established by Hoare in his work on
CSP (C. Hoare, 1985). However, Hoare did not con-
sider events with data or machines with derived states,
as are used by Protocol Machines. The full proof of
support for local reasoning for Protocol Machines can
be found in (A. McNeile, E. Roubtsova, 2008).
4 CONCLUSIONS
The Protocol Modeling approach makes it possible
make separate representations of parallel concerns
within an HCI model and use CSP for composition
of the parts. The use of CSP composition ensures
that the behavior of the PM component models is pre-
served in the result.
HCI models built using the PM approach are di-
rectly executable using a suitable tool. The key fea-
tures of such a tool are support for automatic com-
position of PMs, according to the CSP composition
rules. Protocol Modeling support is implemented in
the ModelScope tool (Metamaxim, 2006).
ACKNOWLEDGEMENTS
We thank Ad Slootmaker (Educational Technology
Expertise Center) and Evert van de Vrie (OU) for
sharing information about BaMaS.
REFERENCES
A. Dix, G. Abowd, R. Bealle, J. Finlaj (1998). Human-
computer interaction. Prentice Hall Europe.
A. McNeile, E. Roubtsova (2008). CSP parallel composi-
tion of aspect models. To appear in the Proceedings of
the 12th International Workshop on Aspect-Oriented
Modelling, AOM 2008, Brussels, ACM DL.
A. McNeile, N. Simons (2006). Protocol Modelling.
A modelling approach that supports reusable behav-
ioural abstractions. Software and System Modeling,
5(1):91–107.
BaMaS (2007). BaMaS. http://www.bamas.nl.
C. Hoare (1985). Communicating Sequential Processes.
Prentice-Hall International.
D. Hix, H. Hartson (1998). Developing User Interfaces:
Ensuring Usability Through Product & Process. John
Wiley & Sons Inc.
J. Ebert, G. Engels (1994). Dynamic models and Behav-
ioural Views. LNCS 858.
Metamaxim (2006). http://www.metamaxim.com/.
M.Tauber (1988). On Mental Models and the User Inter-
face. G. Van der Veer et al. ed. ”Working with Com-
puters: Theory Versus Outcome”.
P. Palanque, R. Bastide, L. Dourte, C. Sibertin-Blanc
(1993). Design of User-Driven Interfaces Using Petri
Nets and Objects. LNCS 685.
S. Payne, T. Green (2000). Usability Patterns for Applica-
tions on the World Wide Web. In D. Diaper ed. ”Task
Analysis for Human-Computer Interaction, Ellis Hor-
wood, Cambridge MA”.
ICEIS 2008 - International Conference on Enterprise Information Systems
370