Communication à un colloque (Conference Paper)

Transcription

1 Communiction à un colloque (Conference Pper) "Lerning system bstrctions for humn opertors" Combéfis, Sébstien ; Ginnkopoulou, Dimitr ; Pecheur, Chrles ; Fery, Michel Abstrct This pper is concerned with the use of forml techniques for the nlysis of humn-mchine interctions (HMI). The focus is on generting system bstrctions for humn opertors. Such bstrctions, once expressed in rigorous, forml nottions, cn be used for nlysis or for user trining. They should idelly be miniml in order to concisely cpture the system behviour. They should lso contin enough infor- mtion to llow full-control of the system. This work ddresses the problem of utomticlly generting bstrctions, bsed on forml descriptions of system behviour. Previous work presented bisimultion-bsed technique for constructing miniml full-control bstrctions. This pper proposes n lterntive pproch bsed on the use of the L lerning lgorithm. In prticulr, miniml bstrctions re generted from lerned three-vlued deterministic nite-stte utomt. The lerning-bsed pproch is pplied on number of exmples nd compred to the bisimultion-bsed pproch. The result of these comprisons is tht there is no cler winner. However, the proposed pproch h[...] Référence bibliogrphique Combéfis, Sébstien ; Ginnkopoulou, Dimitr ; Pecheur, Chrles ; Fery, Michel. Lerning system bstrctions for humn opertors. Interntionl Workshop on Mchine Lerning Technologies in Softwre Engineering (Lwrence, Knss, du 12/11/2011 u 12/11/2011). In: roceedings of the Interntionl Workshop on Mchine Lerning Technologies in Softwre Engineering, (2011), p.3-10 Avilbe t: [Downloded 2014/02/24 t 15:30:44 ]

2 Lerning System Abstrctions for Humn Opertors Sébstien Combéfis, Dimitr Ginnkopoulou, Chrles Pecheur, Michel Fery Computer Science nd Engineering Deprtment ICT, Electronics nd Applied Mthemtics Institute Université ctholique de Louvin, Belgium NASA Ames Reserch Center Moffett Field, CA 94035, USA ABSTRACT This pper is concerned with the use of forml techniques for the nlysis of humn-mchine interctions (HMI). The focus is on generting system bstrctions for humn opertors. Such bstrctions, once expressed in rigorous, forml nottions, cn be used for nlysis or for user trining. They should idelly be miniml in order to concisely cpture the system behviour. They should lso contin enough informtion to llow full-control of the system. This work ddresses the problem of utomticlly generting bstrctions, bsed on forml descriptions of system behviour. Previous work presented bisimultion-bsed technique for constructing miniml full-control bstrctions. This pper proposes n lterntive pproch bsed on the use of the L lerning lgorithm. In prticulr, miniml bstrctions re generted from lerned three-vlued deterministic finite-stte utomt. The lerning-bsed pproch is pplied on number of exmples nd compred to the bisimultionbsed pproch. The result of these comprisons is tht there is no cler winner. However, the proposed pproch hs wider pplicbility since it cn hndle more types of systems thn the bisimultion-bsed technique. Moreover, if no full-control bstrction cn be generted due to form of non-determinism in the system, the lerning-bsed pproch provides counterexmples tht llow to detect nd nlyze tht non-determinism. We lso discuss how the well-known HMI issue of mode confusion cn be nlyzed through this pproch. Ctegories nd Subject Descriptors D.2.4 [Softwre/Progrm Verifiction]: Forml methods; I.2.6 [Artificil Intelligence]: Lerning; H.1.2 [Models nd Principles]: User/Mchine Systems Humn fctors Generl Terms Verifiction, Humn Fctors, Algorithms Keywords Forml methods, Lerning, Humn-Mchine Interction (HMI), Verifiction, 3DFA, Model-checking 1. INTRODUCTION Most complex computer systems involve some mount of interction between humns nd mchines. Ensuring correct perception, understnding nd control of the mchine by its humn opertors is n importnt prt of the sfety requirements of system. There re numerous exmples of filures cused by n inpproprite interction between the opertor nd the mchine. A well-known clss of problems is known s utomtion surprises, tht occur when the system behves differently thn its opertor expects. For exmple, if cr driver unknowingly engges the cruise-control system, she could be surprised by the cr s behviour, leding into hzrdous situtions. Automtion surprises cn led to mode confusion [14, 21] nd sometimes to criticl filure, s testified by rel ccidents [6, 15, 17]. This pper reports on collbortive work between the Humn Fctors nd Robust Softwre Engineering (RSE) gros t the NASA Ames Reserch Center on the use of forml techniques for the nlysis of HMI systems. In prticulr, we ddress here the problem of utomtic genertion of system bstrctions for humn opertors. Such bstrctions, once expressed in rigorous, forml nottions, cn be used for nlysis or for user trining. System bstrctions should concisely cpture the behviour of the system from the point of view of n opertor. They should lso contin enough informtion to llow proper control of the system, tht is the opertor cn control the system by knowing wht he cn perform on the system nd wht he cn expect to observe. This problem hs lredy been stted nd studied in [5] using bisimultion-bsed reltions. A suitble similrity reltion is defined on the sttes of the system model. Provided tht some determincy restrictions re met, vrint of the Pige- Trjn refinement lgorithm [16] cn be used to merge those equivlent sttes nd get suitble bstrction s miniml bstrction of the system. In this pper, we investigte n lterntive pproch for ddressing the sme problem: vrint of the L lerning lgorithm is used to construct the bstrction. The

3 frmework is implemented on top of the Jv Pthfinder model-checker [23], building on previous work in [9] where similr pproch is used to infer component interfces. However, the setting of HMI systems presents some new chllenges s compred to interfce genertion. These chllenges re described in Section 2, where we lso explin why existing techniques re not stisfctory for bstrction of HMI systems. At high level, the proposed frmework first uses L to build 3DFA, tht is, deterministic finite utomton with ccepting, refusing nd don t-cre sttes. Sequences to don t-cre sttes correspond to situtions tht re not needed for properly operting the system but my be included in the bstrction without compromising opertion. They llow to obtin simpler, smller bstrction t the end, by merging together comptible sequences. The frmework subsequently minimizes the 3DFA into stndrd trnsition system, which is the desired miniml bstrction. Moreover, the prtilly built model is still usble in cses where the lgorithm fils due to resource limittions or indequte system models. The contributions of this work cn be summrized s follows. First, we provide lerning frmework for bstrction genertion; this consists of defining techer to be used in vrint of the L lgorithm to lern 3DFAs, which chrcterize the set of possible bstrctions stisfying the full-control property, this is the proper control criterion used in this work. Second, we use our implementtion of the frmework in the Jv Pthfinder model checker to provide evlution results on number of exmples: some benchmrks from previous work, nd some exmples provided by our NASA humn fctors collbortors. Third, we show how filed bstrction genertion provides counter-exmples tht sport detecting nd nlyzing violtions of required determinism properties. The reminder of this pper is orgnized s follows. Sections 2 nd 3 provide relted work, motivtion nd bckground. Section 4 is the core of the pper nd explins the proposed lerning-bsed frmework. Section 5 describes the prototype implementtion nd discusses the results of the experiments. Finlly, Section 6 concludes the pper with discussion nd plns for future work. 2. RELATED WORK AND MOTIVATION Anlysis of humn-mchine interction (HMI) is field tht hs been studied extensively by reserchers in psychology, humn fctors nd ergonomics, but forml methods cn lso contribute to the nlysis nd design of the behviourl spects of HMI. Indeed, since the mid-1980s, severl reserchers hve investigted the ppliction of forml methods to HMI nlysis, but most of the work so fr hs focused on specific trget pplictions or on the system nd its properties [20, 3, 22]. More recently, Heymnn nd Degni [11] pioneered more generic utomt-bsed pproch for checking nd generting dequte forml bstrctions of user s knowledge bout given system. Their work distinguishes between commnds, observtions nd internl ctions, nd their bstrction lgorithm is bsed on the definition of comptible system sttes nd merger tbles. Our terminology nd generl frmework re bsed on the work of Heymnn nd Degni. In [5], Combéfis nd Pecheur extended tht work by proposing forml definition of full-control to chrcterize good system s bstrctions, using lbelled trnsition systems (LTSs) s forml models. This definition induces similrity reltion on the sttes of the system, such tht similr sttes cn be confounded in the bstrction. When tht reltion is n equivlence for specific system, they develop minimiztion lgorithm for clculting the quotient of the system modulo the reltion. However, the reltion my fil to be trnsitive, so their lgorithm is not pplicble to some models s illustrted in Figure 5. The proposed pproch overcomes the ltter problem nd will be ble to produce miniml model for ny LTS of n HMI system. Abstrction genertion is relted to the problem of component interfce genertion. A component interfce summrizes ll possible correct usges of the component [10]. A lrge body of reserch hs used lerning for interfce genertion [9, 1]. In this work, we therefore decided to investigte nd evlute the pplicbility of lerning for bstrction genertion. The distinction between the two domins is tht, for interfce genertion, one does not typiclly differentite between controllble nd observble ctions. Moreover, the notion of precise interfce is defined s sfe nd permissive one, which is different from the notion of full-control ssocited with bstrctions. Note tht the notion of controllble nd observble ctions is similr to notion of inputs nd outputs, respectively. A distinction between input nd output ctions of system is mde in the lerning-bsed pproch for interfce utomt of Emmi et l. [7], but tht work is performed in the context of showing, in compositionl wy, component comptibility. The frmework tht we present in this pper hs fundmentl difference from ll of the bove frmeworks: the notion of full-control llows to optionlly ccept some sequences in the lerned lnguge. In our work, we investigted whether it would be possible to pply the frmework presented in [9] on LTSs of system models modified to cpture the distinction between observble nd controllble ctions in the full-control property. Observtions my or my not be dded, s driven by the need to merge sttes tht re equivlent with respect to the full-control property. In fct, the correct interprettion for missing observtions is don t cre one, where the decision on whether to dd them or not is driven by the needs of minimiztion. This motivted us to look into n lterntive version of L, which lerns 3DFAs, rther thn simple DFAs [4]. However, Chen et l. [4] defined their lgorithm in the context of computing miniml ssumptions for compositionl verifiction, s opposed to bstrction genertion for HMI systems, which will be presented here. We would like to stress tht, lthough lerning frmeworks hve similr overll structure, the chllenge for ny specific problem is in the definition of n pproprite Techer to represent the lnguge tht is being lerned. None of the existing lerning frmeworks tht we re wre of could hve been used for generting HMI bstrctions. 3. BACKGROUND We use the exmple of semi-utomtic vehicle trnsmission system (VTS) to illustrte some of the concepts in this section. The exmple is tken from [11]. The model of the system is shown on Figure 1. The system hs eight sttes nd two kinds of ctions. The initil stte is low-1. The ctions push- nd pull- re triggered when the user opertes the trnsmission lever. The ctions nd re triggered utonomously by the system, without the intervention of the user, nd corresponds to utomtic

4 internl ger shifting s speed chnges. The user cn just her the occurrence of those two lst ctions. Note tht this system hs prticulr behviour: while the system is in the low level (low-1, low-2 or low-3), if the user triggers push- ction, the system cn either trnsition to the medium level or high level depending on the current low stte the system is in. high-1 high-2 high-3 push- push- pull- pull- pull- medium-1 medium-2 pull- push- push- pull- low-1 low-2 low-3 push- Figure 1: Vehicle trnsmission system (VTS): the system model. 3.1 Lbelled Trnsition Systems Both system models nd bstrctions re formlly represented with n enriched version of lbelled trnsition system. Act is the universl set of ctions, τ is the unobservble ction, nd Π is specil stte which denotes n error. An HMI LTS M is tle M = S, L c, L o, s 0, δ where S is the finite set of sttes nd s 0 S is the initil stte. The set L c of commnds contins the ctions tht re controlled by the user, nd the set L o of observtions contins ctions controlled by the system but observed by the user. We use L co = L c L o to denote the ctions tht re visible to the opertor, i.e., commnds nd observtions. All unobservble nd uncontrollble ctions re represented by τ. The trnsition function is δ : S (L co {τ}) 2 S. We sy tht M is deterministic if it contins no τ-trnsitions nd if δ(s, ) contins t most one element. Figure 1 shows the grphicl representtion of the HMI LTS of the VTS system model. Commnds re depicted s solid lines nd observtions s dshed lines. The nottion s s is shortcut for s δ(s, ) nd corresponds to strong trnsition. It is extended for sequence = n L in the usul wy, tht is s s is shortcut for s 1 s n s. The nottion s = s represents wek trnsition nd is τ shortcut for s τ s, tht is the trnsition cn be preceded nd followed by zero or more τ-trnsitions. The nottion is extended for sequence in similr wy. The set of ll sequences belonging to model is denoted Tr(M) nd defined s { L co s 0 = s }. Given stte s S, the set of enbled commnds (resp. observtions), denoted A c (s) (resp. A o (s)) is defined by { L c s = s } (resp. { L o s = s }). In this work, system models nd bstrctions re represented s HMI LTSs M M nd M U which re defined on the sme lphbet L c, L o. Moreover, bstrctions re deterministic HMI LTSs without τ trnsitions, so tht s U0 = s reduces to s U0 s in M U. The possible interctions between system M M nd user following deterministic bstrction M U for tht system re represented by the prllel composition between the models nd denoted by M M M U. Sttes of M M M U re pirs of sttes (s M, s U ) S M S U ; in prticulr, the initil stte is (s 0M, s 0U ). There is trnsition (s M, s U ) (s M, s U ) with L co if there is both s M s M nd s U s U, τ nd there is trnsition (s M, s U ) (s M, s U ) if there is τ s M s M. For simplicity, in the reminder of the pper, n HMI LTS will simply be referred to s LTS. 3.2 Full-Control Abstrction In this work, both systems nd their ssocited bstrctions re represented with LTS. As formlized by some of the uthors in previous work [5], desirble property for n bstrction is tht of full-control, defined s follows. An bstrction M U llows full-control of system M M iff: L co such tht s 0M = s M nd s 0U s U : A c (s M ) = A c (s U ) A o (s M ) A o (s U ). (1) Intuitively, full-control bstrction llows user tht follows it to know exctly wht commnds cn be executed in the current stte of the system, nd to be prepred to receive t lest ny observtion tht the system my produce, nd possibly others too. Achieving full-control is only possible if the user cn know the llowed commnds fter ny sequence. Otherwise, the user hs no wy to know whether commnd is vilble or not. A system is full-control-deterministic iff: L co such tht s 0M = s M nd s 0M = s M : A c (s M ) = A c (s M ) (2) Full-control-non-determinism is detected nd reported during the genertion of bstrctions (see Section 4.4). Figure 2 shows the miniml full-control bstrction for the vehicle trnsmission system exmple. It is esily seen tht for every composite stte (s M, s U ) of the prllel composition between the models of Figures 1 nd 2, the full-control conditions A c (S M) = A c (s U ) nd A o (s M) A o (s U ) re indeed stisfied. The full-control requirement llows n bstrction to hve more observtions thn those possible on the system. To cpture nd represent such optionl behviour, we use Three- Vlued Deterministic Finite Automt (3DFAs). push- high medium, pull-, push- push- pull- low- low-b low-c push- Figure 2: VTS exmple: the miniml full-control bstrction. 3.3 DFAs nd Three-Vlued DFAs (3DFAs) A Deterministic Finite Automton (DFA) A is tle Σ, S, s 0, δ, Acc, where Σ is n lphbet, S is the finite set of sttes, s 0 is the initil stte, δ : S Σ S is

5 the trnsition function, nd Acc S is set of ccepting sttes. The trnsition function is extended in the usul wy to sequences, so tht for = 0 n Σ, δ(s 0, ) = δ(... δ(δ(s 0, 0), 1)..., n). A sequence Σ is ccepted by the utomton if nd only if δ(s 0, ) Acc. A Three-Vlued Deterministic Finite Automton (3DFA) C is tle Σ, S, s 0, δ, Acc, Rej, Dont, where Σ, S, s 0, δ re s defined in DFA. However, S is prtitioned into three disjoint sets Acc (ccepting sttes), Rej (rejecting sttes), nd Dont (don t cre sttes). Given 3DFA C = Σ, S, s 0, δ, Acc, Rej, Dont, sequence Σ is ccepted if δ(s 0, ) Acc, rejected if δ(s 0, ) Rej, nd is don t cre sequence if δ(s 0, ) Dont. Let C + denote the DFA Σ, S, s 0, δ, Acc Dont, where ll don t cre sttes become ccepting sttes, nd C denote the DFA Σ, S, s 0, δ, Acc, where ll don t cre sttes become rejecting sttes. By definition, we hve tht L(C ) is the set of ccepted sequences in C nd L(C + ) is the set of rejected sequences in C. A DFA A is consistent with 3DFA C if nd only if A ccepts ll sequences tht C ccepts, nd rejects ll sequences tht C rejects. It follows tht A ccepts sequences in L(C ) nd rejects those in L(C + ), or equivlently, L(C ) L(A) L(C + ). A DFA A is the miniml consistent DFA of 3DFA C if it is consistent with C nd hs the smllest number of sttes mong ll DFAs which re consistent with C. 3.4 The L Lerning Algorithm The lerning lgorithm L of Angluin [2] lerns n unknown regulr lnguge nd produces DFA tht ccepts it. Let U be n unknown regulr lnguge over some lphbet Σ. In order to lern U, L intercts with Techer tht must nswer correctly two types of questions. The first type is membership query, consisting of sequence Σ ; the nswer is true if U, nd flse otherwise. The second type is conjecture, tht is, cndidte DFA C whose lnguge L(C) the lgorithm believes to be identicl to U. The nswer is true if L(C) = U. Otherwise the Techer returns counterexmple, which is sequence in the symmetric difference of L(C) nd U. Let M be the miniml (in terms of number of sttes) utomton such tht L(M) = U. L is gurnteed to terminte with M s its lst conjecture. The conjectures mde by L strictly increse in size; ech conjecture is smller thn the next one, nd ll incorrect conjectures re smller thn M. 4. LEARNING FRAMEWORK FOR FULL- CONTROL ABSTRACTION GENERATION Similrly to Chen et l [4], we use L to lern 3DFAs, but in the context of bstrction genertion for HMI systems. The chllenge therefore lies in providing correct Techer tht cptures the notion of full-control. Our frmework uses L for 3DFAs to lern miniml full-control bstrction for system model M. The high-level structure of the frmework is presented in Figure 3. The frmework first uses L to lern miniml 3DFA C, with Σ C = L co. C must exhibit the full-control property, mening tht ny DFA consistent with C is full-control bstrction for M. The frmework subsequently genertes miniml DFA consistent with the 3DFA tht ws produced by L. In wht follows, we present our implementtion of Techer for L. Sections 4.1 nd 4.2 presents the two prts of Techer (membership query nd conjecture) nd provide brief justifictions bout their correctness which induces the correctness of the Techer. We lso discuss the minimiztion phse of the frmework, s well s complexity nd overll correctness issues. Note tht the lerning lwys succeeds when the system model is full-control deterministic. At the end of this section, we lso discuss the cse where the system is not full-control deterministic. L MQ()? T, F or DC Conj(C)? cex cex orcle 1 no techer membership yes orcle 2 no yes C U minimiztion Figure 3: Globl view of the proposed lerningbsed pproch to generte full-control bstrction from given system model. The notion of correctness for HMI system bstrctions is cptured by the full-control property s presented in Section 3.2. The definition of full-control involves wek trnsitions in the model, nd therefore our frmework Techer uses M wek, which is obtined from M by trnsforming its trnsition reltion into the corresponding wek trnsition reltion. This is performed with the stndrd τ -completion construction, which computes the reflexive nd trnsitive closure with respect to the τ reltion [12]. Moreover, let A = Σ, S, s 0, δ, Acc be DFA such tht Σ A = L co. We define lts(a) = Acc, L c, L o, s 0, δ, where δ is obtined from projecting δ onto the ccepting sttes Acc. In other words, lts(a) is deterministic LTS obtined by removing the rejecting sttes nd their corresponding trnsitions from the DFA. This trnsformtion is well defined becuse the DFAs tht re generted by our pproch re lwys prefix-closed, mening tht it is not possible to rech n ccepting stte fter rejecting stte hs been reched. 4.1 Membership query A membership query (MQ) determines whether sequence L co should be n ccepting, rejecting, or don t cre sequence in the lerned 3DFA C. There re therefore three possible outcomes to such queries: yes (T), no (F) nd don t cre (DC). Membership queries re nswered bsed on the full-control property requirement. Our membership query lgorithm opertes on M wek, completed on commnds by dding trnsitions leding to n error stte Π. Tht is for ech stte s, trnsition s Π is dded for ech L c \ A c (s). The sequence is then simulted on the completed system nd there re different possible outcomes giving rise to three different nswers: 1. my led to the error stte: MQ() = F; M U 2. cn be simulted entirely nd never leds to n error stte: MQ() = T; 3. cnnot be simulted entirely: MQ() = DC.

6 Notice tht for ny sequence such tht MQ() = F (resp. DC), it lwys follows tht MQ( ) = F (resp. DC) for ll sequences. Tht property is used in the implementtion to speed the membership queries lgorithm by using memoized tble tht stores the results of ll previously queried sequences. Intuition nd Justifiction. Cse 1: Since the error stte is reched during simultion of, it mens tht there exists sequence nd commnd c such tht c is prefix of which leds to the error. Therefore, c is not vilble fter in the system model. The full-control property requires tht c not be vilble fter in the lerned 3DFA either. As mentioned bove, if sequence is not ccepted by the lnguge tht we re trying to lern, then ny extension of tht sequence will not be ccepted either. It follows tht ny extension of sequence c is not ccepted either, nd therefore the nswer to query must be F. For exmple, MQ(pull-) = F, becuse low-1 pull Π. Cse 2: Let be, where is either n observtion or commnd. The full-control property requires for to be vilble fter in the full-control model (since it requires equlity of commnds nd serset for observtions), so the nswer must be T. For exmple, MQ(push-) = T, becuse the sequence exists nd never leds to error. Cse 3: Since cnnot be simulted entirely nd it does not led to the error stte, it must block on some observtion (since the system model is completed with respect to commnds). Therefore, there exists sequence nd n observtion o such tht o is prefix of, belongs to Tr(M) nd o is not vilble fter in the system model. Such observtions re optionl in the bstrction ccording to the full-control property, which explins the DC nswer. For exmple, MQ(push-, ) = DC, becuse MQ(push-) = T nd is not possible on the sttes reched fter executing push Conjectures A Conjecture (Conj) estblishes whether cndidte 3DFA C hs the full-control property, mening tht ny DFA tht is consistent with the conjectured 3DFA hs the full-control property. The lgorithm my reply with yes, in which cse lerning termintes, or with no, in which cse counterexmple cex is provided tht exhibits the fct tht the conjectured 3DFA does not provide full-control. In other words, some consistent DFA does not hve the full-control property. Checking this property on C is estblished in two steps, represented by Orcle 1 nd Orcle 2. Note tht in this work, we omit completeness check for the 3DFA defined in Chen et l [4]. The completeness check requires potentilly expensive determiniztion of the system model. By omitting this check, we my miss smller bstrctions, but this cse did not occur in our cse studies. Chen et l. lso omit this check in their experiments. Orcle 1 opertes on M wek nd C +. It first completes M wek with respect to commnds by dding trnsitions leding to the error stte Π: for ech stte s, trnsition s Π is dded for ech L c \ A c (s). It then computes the prllel composition of the resulting LTS with lts(c + ). If the error stte Π is not rechble in the composition, then the Orcle 1 check psses, nd Orcle 2 is invoked. Otherwise, the nswer is no, nd the counterexmple cex obtined is returned to L, which will strt new itertion of membership queries in order to produce refined conjecture. Intuition nd Justifiction. Orcle 1 estblishes whether C i such tht C i is consistent with C the following holds: L co such tht s 0M = s M, s 0Ci s Ci nd s Ci Acc Ci : A c (s M ) A c (s Ci ). In other words, fter ny string, the set of commnds vilble in the system model should be serset of the set of commnds vilble in the bstrction. We use C + to represent ll consistent DFAs of C for this check becuse C + ccepts the lrgest lnguge mong them. When Π is rechble in the prllel composition of lts(c + ) with M wek completed with Π on commnds, the obtined counterexmple exposes sequence nd commnd c where cn be executed in both models, but fter, commnd c is enbled in the bstrction but not enbled in the system model (hence it leds to Π). Therefore, the conjectured 3DFA represents t lest one consistent DFA (C + ) tht is not full-control model of the system. Since the system model is complete with respect to commnds, there is no wy of missing ny counterexmples tht re relevnt to Orcle 1. Orcle 2 opertes on M wek nd C. It first completes lts(c ) with respect to ll observble ctions (both commnds nd observtions) so tht ny missing trnsitions re replced with trnsitions to the error stte Π. It then computes the prllel composition of M wek with the completed lts(c ). If stte Π is unrechble in the composition, then the nswer is yes, nd L concludes producing C s representtive of ll full-control bstrctions for M. Otherwise, the nswer is no, nd counterexmple cex is produced, which exhibits the fct tht the cndidte C represents some bstrctions tht re missing trnsitions on some commnd or some observtion (the lst ction in cex). Bsed on cex, L strts new itertion of membership queries in order to produce refined conjecture. Intuition nd Justifiction. Orcle 2 estblishes whether C i such tht C i is consistent with C the following holds: L co such tht s 0M = s M, s 0Ci s Ci nd s Ci Acc Ci : A c (s M ) A c (s Ci ) A o (s M ) A o (s Ci ). In other words, fter ny string, the set of commnds vilble in the system model should be subset of the set of commnds vilble in the bstrction, nd the sme should hold for observtions. We use C to represent ll consistent DFAs of C for this check becuse C ccepts the smllest lnguge mong them. When the error stte of the completed lts(c ) is rechble in the prllel composition of lts(c ) with M wek, the obtined counterexmple exposes sequence nd n observble ction obs (obs my be commnd or n observtion) such tht, fter, ction obs is enbled in the system model but not enbled in the bstrction. Since lts(c ) is complete, there is no wy of missing counterexmples tht re relevnt to Orcle 2. Figure 4 shows 3DFA which is n intermedite cndidte produced by the lerning lgorithm. The cndidte is checked by the two orcles nd fils during Orcle 2 with the following counterexmple:,,,. Although this sequence is trce of the system, in the 3DFA, it leds to don t cre stte (stte 1), which corresponds to nonccepting stte in C nd therefore n error stte in the completed lts(c ). The error stte is therefore rechble in the prllel composition of M wek with the completed lts(c ), nd the bove counterexmple is returned to L* to refine the conjecture.

7 push pull- push- 2 pull- Figure 4: Intermedite 3DFA cndidte for the VTS exmple. Stte 1 is the don t cre stte nd 2 is the rejecting stte. 4.3 Minimizing 3DFAs The minimiztion step consists of computing miniml (in terms of numbers of sttes) DFA consistent with the 3DFA C U produced by L. We use the lgorithm proposed in [18] to perform this step. The lgorithm computes set Comp of sets of comptible sttes clled comptibles for short. We refer the reder to [18] for detiled definition, but intuitively, comptibles identify sttes tht could be merged becuse they exhibit comptible behviour. Two behviors re comptible if the two sttes to which they led re both ccepting, or both rejecting, or t lest one of them is don t cre, in which cse it could be interpreted either wy. Note tht some sttes my belong to multiple comptibles, which mens tht there exist severl choices when computing consistent DFA for C U. In generting n bstrction bsed on C U, the sttes of the 3DFA re merged ccording to the comptibles, but ech stte should be ssigned to single comptible mong ll the choices. In order to gurntee miniml bstrction, ll the possible mtching functions should be explored. Tht mounts to solving the set covering problem, known to be NP-complete [13]. The serch cn be improved by using heuristics, s proposed in [19] for exmple. Figure 5() shows n exmple of system for which the mximl comptibles overlp. Sttes B nd C re in the sme comptible, nd so re sttes C nd D. The lgorithm will output one of the two miniml full-control bstrctions depicted in Figures 5(b). A b d c B C D E () The system model. F e f 0 0 b, c d b c, d (b) The two bstrctions. Figure 5: A system for which the full-control similrity is not trnsitive, with two possible miniml full-control bstrctions. 4.4 Non-Determinism As mentioned, system models used throughout this work re expected to be full-control deterministic, s defined in Section 3.2, i.e., the sme observble sequence will lwys led to sttes where the sme set of commnds is vilble e f e f Indeed, if sequence my led to different commnds, then the user cnnot possibly know wht commnds re llowed fter tht sequence. Assume, for exmple, tht we modify our running exmple of Figure 1 by replcing the trnsition from low-2 to low-3 with τ (unobservble) trnsition. The modified system is no longer full-control deterministic. If we use our lerning frmework to compute n bstrction for this modified exmple, the lerning process fils on the following sequence:,,,,, push-,, pull-, pull- In generl, the lerning lgorithm fils when it cnnot use counterexmple to refine its current cndidte. This hppens whenever counterexmples obtined from conjectures disgree with informtion obtined through membership queries. In our exmple, the bove sequence is returned from filed conjecture check s trce tht should be included in the bstrction but is not. However, query on tht sequence returns F s result, becuse there exist executions of tht sequence where the lst pull- is not llowed. Such conflicting informtion by the techer confuses the lerner. The lgorithm fils nd reports the contrdiction, long with the bstrction built so fr, which my still be useful prtil result. Furthermore the filing trce precisely points to the source of non-determinism tht prevented successful genertion. In contrst, the bisimultion-bsed lgorithm of [5] simply fils on systems tht re non full-control deterministic, without providing ny tngible informtion. Note tht the sequence obtined is not miniml becuse the model checking Orcle used depth-first serch strtegy; bredth-first serch could be used lterntively for getting shortest counterexmples. 5. IMPLEMENTATION AND EVALUATION We hve implemented the presented lerning frmework within JvPthfinder (JPF), s new project (jpf-hmi). JPF 1 [23]) is n open-source, extensible verifiction frmework developed by the RSE gro t NASA Ames. It is softwre model checker tht hndles Jv bytecode directly. Detils bout jpf-hmi re provided in pper submitted in the JPF workshop ssocited with ASE The pproch developed in this pper hs been evluted on the following six different models: VTS is simple model of vehicle trnsmission system from [11], used s illustrtion in Section 3. AirConditioner comes from [5] nd is derived from the user mnul of n ir conditioner. TimedVCR is bsed on model of video-cssette recorder (VCR) developed in ADEPT, toolset for nlyzing HMI [8]. Its lrge number of sttes is due to flot-type vrible tperemining. In SimpleVCR, the tperemining vrible is omitted: internl sttes of the system with different vlues of remining tpe length re not distinguished in the system model. FullVCR refines SimpleVCR with different tpe speeds. AlrmClock is prtil model of n lrm clock nd AlrmClock2 is version with lrger rnges for time vlues, which result in mny internl τ trnsitions. We hve ttempted to generte bstrctions for ll these models using both the bisimultion-bsed technique from [5] 1

8 System Abstrction Lerning Bisim. Sttes / Trns. Sttes / Trns. 3DFA sttes Totl VTS 8 / 20 5 / ms ms AirConditionner 154 / / ms ms TimedVCR / / ms ms SimpleVCR 20 / / 9 65 ms ms FullVCR 24 / / ms ms AlrmClock 42 / / ms AlrmClock / / ms Tble 1: Experimentl results. nd the lerning-bsed pproch proposed here. Tble 1 summrizes the results of the experiments. Execution times were mesured on the sme mchine, nd represent the totl time needed to compute the miniml full-control bstrction. For the lerning-bsed pproch, this comprises generting the τ -closure, lerning the 3DFA nd minimizing to the LTS of the bstrction. τ -closure is lso needed in the bisimultion-bsed pproch. It ccounts for 10 seconds on the AlrmClock2 model nd is negligible for ll other models, which hve very few τ trnsitions. Minimiztion ccounts for less thn 10% of the time in ll cses. No lgorithm is uniformly better thn the other in terms of execution time. As expected, the lerning-bsed lgorithm performs better on the lrger TimedVCR model. When both pproches work, they produce the sme models. The AlrmClock model hs similr structure to tht of Figure 5(). As consequence, the bisimultion-bsed pproch fils while the lerning-bsed pproch genertes one possible full-control bstrction. In the TimedVCR nd SimpleVCR models, ll commnds re permnently enbled once the system is turned on, which results in rther trivil two-stte bstrction. The FullVCR yields lrger, more informtive 24-stte model becuse commnds re not lwys enbled. 6. DISCUSSION AND CONCLUSION We proposed frmework to utomticlly lern n bstrction for given system model, s n lterntive to n existing bisimultion-bsed pproch [5]. We hve demonstrted, through number of experiments, tht the lerning frmework cn be more efficient in some cses, but tht it lso wives some restrictions of the existing pproch, mking our frmework pplicble to lrger number of systems. Moreover, the lerning frmework cn provide useful dignostic messges when it detects violtion of full-control determinism. Note tht the ltest feture of our frmework cn be used to detect nother importnt problem in HMI systems, nmely mode confusion. Mode confusion hppens when the user believes tht the system is in different mode of opertion thn it ctully is, which my led into incorrect nd hzrdous mneuvers. The complex flight guidnce systems found on modern civil ircrfts constitute prominent trget for this kind of nlysis. In the bisimultion-bsed pproch of [5], modes re hndled by enriching models with mode ssignments on system model nd bstrction sttes, nd refining the lgorithm to preserve mode consistency. The sme result cn be chieved within the current frmework, by dding self-loop trnsitions s m s on system sttes to indicte tht s is within mode m. Treting these mode ctions s commnds ensures tht the bstrction knows in which mode the system is t ny time. Conversely, mode confusion will occur if the sme observble sequence leds to different modes. Since modes re treted s commnds, mode confusion cn be detected s n instnce of violtion of full-control determinism, where the lst ction in the filing sequence is mode ction. In terms of performnce, our experiments showed tht, when both pproches re pplicble, there is no cler winner between them. One could therefore include them both in n HMI nlysis environment, pply them in prllel, nd use the results of the one tht termintes first. In the future, we pln on working on optimiztions to the current lgorithms. Moreover, we re working on connecting jpf-hmi to the ADEPT tool for the specifiction nd genertion of userinterfces for HMI systems [8]. We hve lmost completed n utomtic trnsltion of ADEPT models into sttechrts s sported by the JPF tool. This will llow us to hve ccess to dditionl relistic exmples tht hve been developed in the domin of HMI systems. Such exmples will be used to thoroughly evlute but lso evolve our techniques for prcticl use in the rel world. In prticulr, sclbility is mjor direction tht we need to pursue; most systems in the HMI domin, such s utopilots, re lrge nd complex nd would chllenge ny forml nlysis technique. Acknowledgments This work is prtly sported by project MoVES under the Interuniversity Attrction Poles Progrmme Belgin Stte Belgin Science Policy. 7. REFERENCES [1] R. Alur, P. Cerný, P. Mdhusudn, nd W. Nm. Synthesis of interfce specifictions for jv clsses. In Proceedings of the 32nd ACM SIGPLAN-SIGACT Symposium on Principles of Progrmming Lnguges (POPL 05), pges , New York, NY, USA, Jn ACM. [2] D. Angluin. Lerning regulr sets from queries nd counterexmples. Informtion nd Computtion, 75(2):87 106, Nov [3] J. C. Cmpos nd M. D. Hrrison. Systemtic nlysis of control pnel interfces using forml tools. In Proceedings of the 15th Interntionl Workshop on the Design, Verifiction nd Specifiction of Interctive Systems, number 5136 in Lecture Notes in Computer Science, pges Springer-Verlg, July [4] Y.-F. Chen, A. Frzn, E. M. Clrke, Y.-K. Tsy, nd B.-Y. Wng. Lerning miniml seprting DFAs for compositionl verifiction. In S. Kowlewski nd

9 A. Philippou, editors, Proceedings of the 15th Interntionl Conference on Tools nd Algorithms for the Construction nd Anlysis of Systems (TACAS 09), volume 5505 of Lecture Notes in Computer Science, pges 31 45, Berlin, Heidelberg, Springer-Verlg. [5] S. Combéfis nd C. Pecheur. A bisimultion-bsed pproch to the nlysis of humn-computer interction. In G. Clvry, T. N. Grhm, nd P. Gry, editors, Proceedings of the ACM SIGCHI Symposium on Engineering Interctive Computing Systems (EICS 09), pges , New York, NY, USA, ACM. [6] A. Degni. Tming HAL: Designing Interfces Beyond Plgrve Mcmilln, Jn [7] M. Emmi, D. Ginnkopoulou, nd C. S. Păsărenu. Assume-gurntee verifiction for interfce utomt. In J. Cuellr nd T. Mibum, editors, Proceedings of the 15th Interntionl Symposium on Forml Methods (FM 08), volume 5014, pges , Berlin, Heidelberg, Springer-Verlg. [8] M. S. Fery. A toolset for sporting itertive humn utomtion interction in design. Technicl Report , NASA Ames Reserch Center, Mr [9] D. Ginnkopoulou nd C. S. Păsărenu. Interfce genertion nd compositionl verifiction in JvPthfinder. In Proceedings of the 12th Interntionl Conference on Fundmentl Approches to Softwre Engineering (FASE 09), pges , Berlin, Heidelberg, Springer-Verlg. [10] T. A. Henzinger, R. Jhl, nd R. Mjumdr. Permissive interfce. In Proceedings of the 10th Europen Softwre Engineering Conference (ESEC 05), pges 31 40, New York, NY, USA, Sept ACM. [11] M. Heymnn nd A. Degni. Forml nlysis nd utomtic genertion of user interfces: Approch, methodology, nd n lgorithm. Humn Fctors: The Journl of the Humn Fctors nd Ergonomics Society, 49(2): , Apr [12] P. C. Knellkis nd S. A. Smolk. CCS expressions, finite stte processes, nd three problems of equivlence. In Proceedings of the second nnul ACM symposium on Principles of distributed computing (PODC 93), pges , New York, NY, USA, ACM. [13] R. M. Krp. Reducibility mong combintoril problems. Complexity of Computer Computtions, pges , [14] N. G. Leveson, L. D. Pinnel, S. D. Sndys, S. Kog, nd J. D. Reese. Anlyzing softwre specifictions for mode confusion potentil. In Workshop on Humn Error nd System Development, pges , [15] N. G. Leveson nd C. S. Turner. Investigtion of the Therc-25 ccidents. IEEE Computer, 26(7):18 41, July [16] R. Pige nd R. E. Trjn. Three prtition refinement lgorithms. SIAM Journl on Computing, 16(6): , Dec [17] E. Plmer. Oops, it didn t rm. cse study of two utomtion surprises. In Proceedings of the 8th Interntionl Symposium on Avition Psychology, pges , [18] M. C. Pull nd S. H. Unger. Minimizing the number of sttes in incompletely specified sequentil switching functions. IRE Trnsctions on Electronic Computers, EC-8(3): , Sept [19] J. M. Pen nd A. L. Oliveir. A new lgorithm for the reduction of incompletely specified finite stte mchines. In Proceedings of the 9th IEEE/ACM Interntionl Conference on Computer-Aided Design (ICCAD 98), pges , New-York, NY, USA, Nov ACM. [20] J. Rushby. Using model checking to help discover mode confusions nd other utomtion surprises. Relibility Engineering nd System Sfety, 75(2): , Feb [21] N. B. Strter nd D. D. Woods. How in the world did we ever get into tht mode? Mode error nd wreness in servisory control. Humn Fctors: The Journl of the Humn Fctors nd Ergonomics Society, 37(1):5 19, Mr [22] H. Thimbleby nd J. Gow. Applying grph theory to interction design. In J. Gulliksen, editor, Engineering Interctive Systems 2007/DSVIS 2007, number 4940 in Lecture Notes in Computer Science, pges Springer-Verlg, [23] W. Visser, K. Hvelund, G. Brt, nd S. Prk. Model checking progrms. In Proceedings of the IEEE Interntionl Conference on Automted Softwre Engineering, pges 3 12, 2000.