Abstract
Alloy is a lightweight formal specification language, supported by an IDE, which has proven well-suited for reasoning about software design in early development stages. The IDE provides a visualizer that produces graphical representations of analysis results, which is essential for the proper validation of the model. Alloy is a rich language but inherently static, so behavior needs to be explicitly encoded and reasoned about. Even though this is a common scenario, the visualizer presents limitations when dealing with such models. The main contribution of this paper is a principled approach to generate instance visualizations, which improves the current Alloy Visualizer, focusing on the representation of behavior.

Abstract
Alloy supports reasoning about software designs in early development stages. It is composed of a modelling language and a tool that is able to find valid instances of the model. Alloy is able to produce graphical representations of analysis results, which is essential for their interpretation. In previous work we have improved the representations with the usage of layout managers. Here, we further extend that work by presenting the improvements on the approach, and by introducing a new case study to analyse the contribution of layout managers, and to support validation trough a user study.

Abstract
Interface design flaws are often at the root cause of use errors in medical devices. Medical incidents are seldom reported, thus hindering the understanding of the incident contributing factors. Moreover, when dealing with a use error, both novices and expert users often blame themselves for insufficient knowledge rather than acknowledge deficiencies in the device. Simulation-Based Medical Education (SBME) platforms can provide appropriate training to professionals, especially if the right incentives to keep training are in place. In this paper, we present a new SBME, particularly targeted at training interaction with medical devices such as ventilators and infusion pumps. Our SBME functions as a game mode of the PVSio-web, a graphical environment for design, evaluation, and simulation of interactive (human-computer) systems. An analytical evaluation of our current implementation is provided, by comparing the features on our SBME with a set of requirements for game-based medical simulators retrieved from the literature. By being developed in a free, open source platform, our SBME is highly accessible and can be easily adapted to specific use cases, such a specific hospital with a defined set of medical devices.

Abstract
The paper is concerned with the practical use of formal techniques to contribute to the risk analysis of a new neonatal dialysis machine. The described formal analysis focuses on the controller component of the software implementation. The controller drives the dialysis cycle and deals with error management. The logic was analysed using model checking techniques and the source code was analysed formally, checking type correctness conditions, use of pointers and shared memory. The analysis provided evidence of the verification of risk control measures relating to the software component. The productive dialogue between the developers of the device, who had no experience or knowledge of formal methods, and the analyst using the formal analysis tools, provided a basis for the development of rationale for the effectiveness of the evidence.

Abstract
The IVY workbench is a model checking based tool for the analysis of interactive system designs. Experience shows that there is a need to complement the analytic power of model checking with support for model validation and analysis of verification results. Animation of the model provides this support by allowing iterative exploration of its behaviour. This paper introduces a new model animation plugin for the IVY workbench. The plugin (AniMAL) complements the modelling and verification capabilities of IVY by providing users with the possibility to interact directly with the model.

Abstract
The paper describes templates for model-based analysis of usability and safety aspects of user interface software design. The templates crystallize general usability principles commonly addressed in user-centred safety requirements, such as the ability to undo user actions, the visibility of operational modes, and the predictability of user interface behavior. These requirements have standard forms across different application domains, and can be instantiated as properties of specific devices. The modeling and analysis process is carried out using the Prototype Verification System (PVS), and is further facilitated by structuring the specification of the device using a format that is designed to be generic across interactive systems. A concrete case study based on a commercial infusion pump is used to illustrate the approach. A detailed presentation of the automated verification process using PVS shows how failed proof attempts provide precise information about problematic user interface software features.