Mathematics for interaction

Every serious claim about an interface is a mathematical claim in disguise. "The user can always get back" is a claim about a set of states and a relation on it. "This button is quick to hit" is a claim about a function from size and distance to time. "The form is too complex to test" is a claim about how many combinations exist. The mathematics lets you say exactly what you mean, then discover it is false.

The mathematics reaches the specification, not the person, and two of its models are disputed. Sets, relations and graphs describe the states; counting describes the choices; probability and information theory describe the uncertainty.

A universal claim dies on one counterexample

Design reviews produce statements such as "every action can be undone" or "no screen is more than four taps from home". Each is a claim about a set, and one instance is enough to refute it.

The Therac-25, a medical linear accelerator, is the case. After a 1985 overdose the manufacturer modified the machine and claimed safety had improved "by at least five orders of magnitude". In December 1985 a patient at Yakima suffered a striped skin burn, and the manufacturer did not treat it as a counterexample. In February 1986 it wrote that the damage "could not have been produced by any malfunction of the Therac-25" (Leveson and Turner, 1993). Six overdoses occurred between 1985 and 1987, and the machine was recalled.

A counterexample proves a claim false. It does not name the cause. Turning an injury into a mechanism took a physicist and an operator's account. The physicist then searched for a keystroke sequence he could not at first repeat (Leveson and Turner, 1993). The exact doses cannot now be determined, so the case is a study, not a comparison.

"The undo stack never exceeds twenty entries" needs an invariant and an induction. The interesting case is the one after the twentieth push (Rosen, 2025).

Interaction needs a relation, not a function

A function gives exactly one output for each input, and that is where interaction models break. Describe the interface as a relation from a state and an input to the next state.

In the editor vi, x deletes the character under the cursor in normal mode and types the letter x in insert mode. The transition is a function of the pair (mode, keystroke). A model that takes the keystroke alone is wrong.

The Therac-25 exposes the other half. The operator corrected the mode, and the console displayed "beam ready". The beam then ran with the parameters set for the value she had typed first (Leveson and Turner, 1993). The bending magnets took eight seconds to set. An edit made inside that window appeared on the screen, but the machine never re-read it. The screen was not a function of the machine state.

A relation shows what is missing. If the map from gestures to commands is not total, some gesture does nothing. If it is not injective, two gestures carry the same command.

Navigation is reachability, and depth is not findability

Draw those states as vertices and the links as edges, and design questions become graph questions. Reachability asks whether a path exists. Breadth-first search answers it with the shortest path in steps, the depth a person feels. A tree gives exactly one path to each setting, so "back" has one meaning.

The label at the end decides whether the route is taken, and depth counts steps rather than findability. Someone who reads slowly, or in a language the labels do not use, pays for every level.

Constructed case. A settings area holds 90 settings in three levels: three categories, five subcategories, six settings each. The deepest setting is three taps from the root. Add a search field, and the same setting gains a second path, one query long. Now "back" depends on how the user arrived, and the state is the path, not the screen.

Dependency structures are graphs too, not trees. A build order with shared prerequisites is directed, and a cycle in it is a specification defect. One Therac-25 repair changed reachability. Malfunction codes 1 to 64 were made to suspend treatment rather than pause it, removing the edge from a fault back into treatment (Leveson and Turner, 1993).

Counting sizes the state space, and a covering array samples it

The product rule is the first step from reachability to size. Three settings with four options each give 64 combinations, and exhaustive testing is 64 runs (Rosen, 2025).

NIST's tutorial counts a word processor the same way. Ten binary settings combine into 2 to the tenth power, or 1,024, configurations. A covering array of 13 tests covers every three-way combination, because any three columns contain all eight combinations of their values. The report estimates that pairwise coverage may miss 10 to 40 per cent of faults, and that three-way coverage may detect 90 per cent or more. In one NASA application, 67 per cent of failures came from one parameter value and 98 per cent from three (Kuhn, Kacker and Lei, 2010).

Those figures are the authors' own, from the systems in that report and not from replication, so they favour strength three without guaranteeing it.

The claim a plan supports must be exact. Thirteen runs show that every three-way combination was exercised. They cannot show the absence of a fault that needs four settings at once. Device, connection and text size are parameters too, and a plan without them tests one well-resourced configuration. Judging which interactions are plausible is the design work.

Adding failure rates double-counts, unless the steps are independent

A probability over that space is a long-run frequency, and an expected value is a weighted average over outcomes (Grinstead and Snell, 2003). In Fitts's tapping task the error rate ran from zero to 3.65 per cent. The effective width is the band holding 96 per cent of the endpoints, or 4.133 standard deviations (MacKenzie, 1992). An error rate in a pointing study is fixed by the experimenter, not predicted by the law.

Constructed case. Two checkout steps each fail independently with probability 0.02. The chance of at least one failure is 1 minus 0.98 squared, or 0.0396. Adding the rates gives 0.04, and the difference is the case in which both steps fail, which the sum counts twice. The expected number of attempts to one clean pass is 1 divided by 0.98 squared, or 1.041, the mean of the geometric distribution, 1/p (Grinstead and Snell, 2003).

Independence is an assumption. A poor connection that fails the first step will probably fail the second, so multiplying the rates understates how often both fail. A shared phone on a weak signal is the ordinary case. An expected value is not a typical outcome either.

Fitts's law is log-linear, and the logarithm is the lesson

Timing has a model of its own. Fitts's law predicts the time to move to a target from its distance and its size (Fitts, 1954). His index of difficulty is ID = log2(2D/W), with D the distance and W the width. Movement time is MT = a + b ID, so time is linear in a logarithm. MacKenzie (1992) notes that the 2 only kept the index positive, and proposes log2(D/W + 1) instead.

Worked case. A toolbar button 24 pixels wide, 400 pixels from the pointer, has ID = log2(2 x 400 / 24), or 5.06 bits. Halving the width to 12 pixels raises the index to 6.06 bits: exactly one bit, not a doubling. MacKenzie fitted Fitts's one-ounce stylus data to that index, and reports MT = 12.8 + 94.7 ID in milliseconds with r = 0.98 (MacKenzie, 1992). Because the gain is logarithmic, enlarge a target rather than shorten its label.

The contested question is whether this is a law of information processing or a good fit with no theory underneath. The case for a law is the close fit. Card, English and Burr (1978) fitted the mouse data, and it has held since (Soukoreff and MacKenzie, 2004). That holds in two dimensions; in three dimensions and virtual reality no index is agreed (Xiao et al., 2024). The fits come from people using a pointer or a stylus. The same review reports that the law loses accuracy for small touch targets, and finds the studies of older and blind users underpowered. Fitts argued that throughput, the rate in bits per second, is constant: the mean over his sixteen conditions is 10.10 (MacKenzie, 1992). The case against is the derivation. The index borrows Shannon's channel capacity, and the borrowing holds only at high signal-to-noise ratios. Fitts's own conditions went as low as one to one. Throughput is not constant at low difficulty either. At ID = 1 bit the rate falls to 5.56 bits per second, 3.4 standard deviations below the mean. MacKenzie finds no competing account established and calls the model an analogy waiting for a theory (MacKenzie, 1992). Use it to rank similar designs, and not to predict an absolute time.

Entropy measures uncertainty, and a person is not a fixed-rate channel

Shannon (1948) defined the entropy of a set of probabilities as H = -(p1 log2 p1 + p2 log2 p2 + ...). Entropy is the average number of bits needed to report which outcome occurred. It is zero when the outcome is certain. It is greatest at log2 n when the outcomes are equally likely.

Worked case: eight commands in a palette. If all eight are equally likely, a selection carries log2 8, or 3 bits. If two commands absorb eighty per cent of the traffic, entropy falls to 2.04 bits. Shannon measured the same effect on English: the redundancy of ordinary English, over no more than about eight letters, is roughly 50 per cent (Shannon, 1948). That is the case for predictive text.

A machine channel has an exact capacity. For signal power S, noise power N and bandwidth B, it is C = B log2((S + N)/N) (Shannon, 1948, as presented by MacKenzie, 1992). Whether a person is a channel in that sense is disputed. Hick (1952) put the rate of gain of information in a choice reaction task at about five bits per second. Fitts's tapping data gives about ten, twice as high (MacKenzie, 1992).

The case for the channel is that it predicts. A menu forces a sequence of decisions, and each decision costs time in proportion to its uncertainty. The case against is that nothing derives the person from the channel. Human coding is ill-defined, the two canonical rates disagree, and each comes from one narrow laboratory task (MacKenzie, 1992). Compare two designs of one command set with entropy, and do not claim a fixed human bit rate.

Transformations compose, and the order changes where a point lands

A transformation is a matrix acting on a point read as a vector. Translation is not linear on its own, so a third coordinate carries it. The CSS transforms specification describes the matrix computed from translate, rotate and scale. It is held as a 4 by 4 matrix, or a compact 3 by 2 matrix (W3C, 2019).

Composition is multiplication, and multiplication does not commute. Take the point (10, 0). Rotate it 90 degrees, then translate by (5, 0), and it lands at (5, 10). Translate first, then rotate, and it lands at (0, 15).

A rotation has determinant 1, so it is invertible and loses nothing. A projection that flattens one axis has determinant zero and no inverse, and its information is gone. Hit testing a rotated marker maps the tap back into the object's own coordinates with the inverse of the transform. Testing in screen coordinates fails.

Sampling bounds the claim, and the web is next

Those fits came from measurements, and a measurement is a random variable. The standard error of a mean is the standard deviation divided by the square root of the number of observations. Twenty observations give 0.22 times the spread and eighty give 0.11 times, so halving the error costs four times the data. The mean of many independent measurements is approximately normal whatever the shape of the individual ones. That is the central limit theorem (Grinstead and Snell, 2003).

The fit carries its own precision: the slope is 94.7 milliseconds per bit, with a standard error of 4.7 (MacKenzie, 1992).

Report the spread and the sample size with every mean, and treat any smaller difference as unevidenced. The next stage takes these tools to the web, where layout, accessibility and performance are measured rather than asserted.