It is well-known that simple, accidental BGP configuration errors can disrupt Internet connectivity. Yet little is known about the frequency of misconfiguration or its causes, except for the few spectacular incidents of widespread outages. In this paper, we present the first quantitative study of BGP misconfiguration. Over a three week period, we analyzed routing table advertisements from 23 vantage points across the Internet backbone to detect incidents of misconfiguration. For each incident we polled the ISP operators involved to verify whether it was a misconfiguration, and to learn the cause of the incident. We also actively probed the Internet to determine the impact of misconfiguration on connectivity.

All rights reserved.

We present data and argument to show that in Tetris-a real-time, interactive video game-certain cognitive and perceptual problems ore more quicktv, easily, and reliably solved by performing actions in the world than by performing com-putational actions in the head atone. We have found that some of the translations and rotations made by players of this video game are best understood as actions that use the world to improve cognition. These actions are not used to implement a plan, or to implement a reaction; they are used to change the world in order to simplify the problem-solving task. Thus, we distinguish pragmatic octions--actions performed to bring one physically closer to a goal-from epistemic actions-actions performed to uncover informatioan that is hidden or hard to compute mentally. To illustrate the need for epistemic actions, we first develop a standard information-processing model of Tetris cognition and show that it cannot explain performance data from human players of the game-even when we relax the assumption of fully sequential processing. Standard models disregard many actions taken by players because they appear unmotivated or superfluous. How-ever, we show that such actions are actually far from superfluous; they play a valuable role in improving human performance. We argue that traditional accounts are limited because they regard action as having o single function: to change the world. By recognizing a second function of action-an epistemic func-tion-we can explain many of the actions that a traditional model cannot. Al-though our argument is supported by numerous examples specifically from Tetris, we outline how the new category of epistemic action can be incorporated into theories of action more generally. In this article, we introduce the general idea of an epistemic action and discuss its role in Tetris, a real-time, interactive video game. Epistemic actions-physical actions that make mental computation easier, faster, or more We thank Steve Haehnichen for his work on the initial implementations of Tetris and

ing with credit is permitted. To copy otherwise, to republish, to post on servers, or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from Publications Dept, ACM Inc., fax +1 (212) 869-0481, or permissions@acm.org. Which GOMS? p. 2 2 Keywords: GOMS, cognitive modeling, usability engineering ABSTRACT Since the seminal Card, Moran, & Newell (1983) book, The psychology of human-computer interaction, the GOMS model has been one of the few widely known theoretical concepts in human-computer interaction. This concept has spawned much research to verify and extend the original work and has been used in real-world design and evaluation situations. This paper synthesizes the previous work on GOMS to provide an integrated view of GOMS models and how they can be used in design. We briefly describe the major variants of GOMS that have matured sufficiently to be used in actual design. We then provide guidance to practitioners about which GOMS var...

A briefer version of this paper with the same name has been published in

Scenarios have been advocated as a means of improving requirements engineering yet few methods or tools exist to support scenario based RE. The paper reports a method and software assistant tool for scenario-based RE that integrates with use case approaches to object oriented development. The method and operation of the tool are illustrated with a financial system case study. Scenarios are used to represent paths of possible behaviour through a use case and these are investigated to elaborate requirements. The method commences by acquisition and modelling of a use case. The use case is then compared with a library of abstract models that represent different application classes. Each model is associated with a set of generic requirements for its class, hence, by identifying the class(es) to which the use case belongs, generic requirements can be reused. Scenario paths are automatically generated from use cases, then exception types are applied to normal event sequences to suggest possib...

AbstractÐThis paper examines and proposes an approach to writing software specifications, based on research in systems theory, cognitive psychology, and human-machine interaction. The goal is to provide specifications that support human problem solving and the tasks that humans must perform in software development and evolution. A type of specification, called intent specifications, is constructed upon this underlying foundation. Index TermsÐRequirements, requirements specification, safety-critical software, software evolution, human-centered specifications, means-ends hierarchy, cognitive engineering.

Systematic errors in performance are an important aspect of human behavior that have not received adequate explanation. One such systematic error is termed post-completion error; a typical example is leaving one’s card in the automatic teller after withdrawing cash. This type of error seems to occur when people have an extra step to perform in a procedure after the main goal has been satisfied. The fact that people frequently make this type of error, but do not make this error every time, may best be explained by considering the working memory load at the time the step is to be performed: the error is made when the load on working memory is high, but will not be made when the load is low. A model of performance in the task was constructed using Just and Carpenter’s (1992) CAPS that predicted that high working memory load should be associated with post-completion errors. Two experiments confirmed that such errors can be produced in a laboratory as well as a naturalistic setting, and that the conditions under which the CAPS model makes the error are consistent with the conditions under which the errors occur in

System operators play a critical role in maintaining server dependability yet lack powerful tools to help them do so. To help address this unfulfilled need, we describe Operator Undo, a tool that provides a forgiving operations environment by allowing operators to recover from their own mistakes, from unanticipated software problems, and from intentional or accidental data corruption. Operator Undo starts by intercepting and logging user interactions with a network service before they enter the system, creating a record of user intent. During an undo cycle, all system hard state is physically rewound, allowing the operator to perform arbitrary repairs; after repairs are complete, lost user data is reintegrated into the repaired system by replaying the logged user interactions while tracking and compensating for any resulting externally-visible inconsistencies. We describe the design and implementation of an application-neutral framework for Operator Undo, and detail the process by which we instantiated the framework in the form of an undo-capable e-mail store supporting SMTP mail delivery and IMAP mail retrieval. Our proof-of-concept e-mail implementation imposes only a small performance overhead, and can store days or weeks of recovery log on a single disk.

Standards concerned with the development of safety-critical systems, and the software in such systems in particular, abound today as the software crisis increasingly affects the world of embedded computer-based systems. The use of formal methods is often advocated as a way of increasing confidence in such systems. This paper examines the industrial use of these techniques, the recommendations concerning formal methods in a number of current and draft standards, and comments on the applicability and problems of using formal methods for the development of safety-critical systems of an industrial scale. Some possible future directions are suggested.