Abstract
Organizational context is now accepted as a central concept in attempts to understand error in human-machine systems. However, accounts which emphasize the processes of everyday organizing, such as accountability and work activity, are needed in order to establish organizational requirements for design. In this article, we provide a framework for the consideration of organizational contexts of human error in high-consequence work systems, with a view to integrating empirical insights and supporting practical design work. We draw on computer-supported cooperative work conceptualizations of the process of everyday organizing, particularly the notion of "accountability for work activity" which is pivotal to our organizational account of error. The conceptual framework is characterized here as a set of dimensions which are expressive concerning the relationship between accountability and work activity in different contexts: (1) explicit-implicit; (2) global-local; (3) stable-transient and (4) dependent-independent. The framework is demonstrated with respect to everyday work practices in a radiology department and its analytical utility validated with respect to two documented aviation system failures. Applying the framework has enabled us to identify and define, in terms of the dimensions, a number of contexts for vulnerability in high-consequence systems: contexts for collusion, violation, deference, loss of control, buck passing and complacency. These are discussed in terms of requirements for error-tolerant design. In the final section of the article, links between the various contexts for vulnerability and the design process are explored. © 1997 Academic Press Limited.

Abstract
This paper investigates the use of formal mathematical models in the design of interactive systems and argues for the development of generic models that describe the behaviour of a class of interactive systems. In recent years a number of authors have suggested methods for modelling interactive systems using notations and frameworks drawn from software engineering mathematics. We argue that these models tend to be either: so abstract as to limit their ability to express important interaction concerns for specific systems, and limited in the degree to which they support the construction of software that conforms to the designer's intention; or so specific to an individual system that they provide only limited re-use across development projects and are therefore likely to be too expensive to develop except in a few special applications such as safety-critical systems. We argue that it is possible to construct a generic model of a class of interactive systems at an intermediate level of abstraction. Such a model would offer wider reusability than detailed specifications of a single system, but greater expressiveness and support for software development than fully general abstract models. To support our argument we review a number of existing models in the literature and present a generic model of interactive case memories, a class of systems used in case-based reasoning. © 1997 Academic Press Limited.

Abstract
In this article we present a new approach to interaction modeling based on the concept of information resources. The approach is inspired by recent distributed cognition (DC) literature but develops a model that applies specifically to human-computer interaction (HCI) modeling. Of course, there are many approaches to modeling HCI, and the motivation of this article is not to offer yet another approach. Rather, our motivation is that the recent developments in DC are so obviously relevant to HCI modeling and design, yet the ideas have lacked visibility in the HCI community. By providing a model whose concepts are rooted in DC concepts, we hope to achieve this visibility. DC research identifies resources for action as central to the interaction between people and technologies, but it stops short of providing a definition of such resources at a level that could be used to analyze interaction. The resources model described in this article defines a limited number of resource types as abstract information structures that can be used to analyze interaction. We demonstrate how these abstract types can be represented differently in an interface. The resources model uses the concept of interaction strategy to describe the way in which different configurations of resources can differently shape users' actions. These 2 components of the resources model (information structures and interaction strategies), through the process of coordination and integration, provide a link among devices, representations, and actions that is not well articulated in the DC literature.

Abstract
Two function allocation methods developed from differing perspectives are contrasted. One takes as its scope the organizational structure of a system and models the allocation of function from the perspective of this structure. The other takes the individual partnership between a human and machine as its scope and models the allocation of function from the perspective of the situational context within which this partnership operates. In the process of contrasting these methods, the essence of a new function allocation process that combines the best features of both is introduced. The new method is intended to support the design of complex dynamic control systems consisting of multiple agents.

Abstract
Formal approaches to the design of interactive systems rely on reasoning about properties of the system at a very high level of abstraction. Specifications to support such an approach typically provide little scope for reasoning about presentations and the representation of information in the presentation. In contrast, psychological theories such as distributed cognition place a strong emphasis on the role of representations, and their perception by the user, in the cognitive process. However, the post-hoc techniques for the observation and analysis of existing systems which have developed out of the theory do not help us in addressing such issues at the design stage. Mn this paper we show how a formalisation can be used to investigate the representational aspects of an interface. Our goal is to provide a framework to help identify and resolve potential problems with the representation of information, and to support understanding of representational issues in design. We present a model for linking properties at the abstract and perceptual levels, and illustrate its use in a case study of a flight deck instrument. There is a widespread consensus that proper tool support is a prerequisite for the adoption of formal techniques, but the use of such tools can have a profound effect on the process itself. In order to explore this issue, we apply a higher-order logic theorem prover to the analysis.

Abstract
Recent accounts of accidents draw attention to "automation surprises" that arise in safety critical systems. An automation surprise can occur when a system behaves differently from the expectations of the operator. Interface mode changes are one class of such surprises that have significant impact on the safety of a dynamic interactive system. They may take place implicitly as a result of other system action. Formal specifications of interactive systems provide an opportunity to analyse problems that arise in such systems. In this paper we consider the role that an interactor based specification has as a partial model of an interactive system so that mode consequences can be checked early in the design process. We show how interactor specifications can be translated into the SMV model checker input language and how we can use such specifications in conjunction with the model checker to analyse potential for mode confusion in a realistic case. Our final aim is to develop a general purpose methodology for the automated analysis of interactive systems. This verification process can be useful in raising questions that have to be addressed in a broader context of analysis.