1. 1 Autopilot Tutor

2. 2 Model Checking the Autopilot GUI Program Program Automatically Replace GUI methods with stubs Instrument Event Handling (Semi-automated) Pilot Task Regular Expr JPF JPF Java Program Compiler + Pilot Mental Model + No Mode Confusion Error Script

3. 3 Event Handling public void mouseClicked (MouseEvent e){ //init button if((e.getX()>initbuttonx) && (e.getX() initbuttonx) && (e.getX()<initbuttonx+30) && (e.getY()>initbuttony) && (e.get() initbuttony) && (e.get()<initbuttony+20)){ //initialize variables } … public void mouseClicked (int e){ … //init button if( e == 1){ //initialize variables }...

4. 4 Pilot Task Descriptions #start=mouseClicked(1);#pullAltKnob=mouseClicked(6);#incrMCPAlt=mouseClicked(9);#incrMCPVS=mouseClicked(11);#fly=mouseClicked(14);#pilotExp=getExpectation(); //climb away from mcp altitude - 2 sec ( start > incrMCPAlt^10 > pullAltKnob > (pilotExp > fly)^8 > incrMCPVS^2 > (pilotExp > fly)^5 ); // climb away from mcp altitude ( start > incrMCPAlt^10 > pullAltKnob > (pilotExp > fly)^8 > incrMCPVS^6 > (pilotExp > fly)^5 ); ( start > incrMCPAlt^{1,10} > pullAltKnob > (pilotExp > fly)^{1,10} > incrMCPVS^{1,10} > (pilotExp > fly)^5 );

5. 5 Java for Pilot Task import gov.nasa.arc.ase.jpf.jvm.Verify; public class EnvDriverThread0 extends java.lang.Thread { public PilotMental field0; public CoreAutopilot field1; public PilotMental field0; public CoreAutopilot field1; public EnvDriverThread0(PilotMental param0, CoreAutopilot param1){ public EnvDriverThread0(PilotMental param0, CoreAutopilot param1){ field0 = param0; field1 = param1; field0 = param0; field1 = param1; } public void run(){ public void run(){ field1.mouseClicked(1); field1.mouseClicked(1); for(int i=0;i<1+Verify.random(9);i++){ field1.mouseClicked(9);} for(int i=0;i<1+Verify.random(9);i++){ field1.mouseClicked(9);} field1.mouseClicked(6); field1.mouseClicked(6); for(int i=0;i<1+Verify.random(9);i++){ field0.getExpectation(); field1.mouseClicked(14); } for(int i=0;i<1+Verify.random(9);i++){ field0.getExpectation(); field1.mouseClicked(14); } for(int i=0;i<1+Verify.random(9);i++){ field1.mouseClicked(11);} for(int i=0;i<1+Verify.random(9);i++){ field1.mouseClicked(11);} for(int i=0;i<5;i++){ field0.getExpectation();field1.mouseClicked(14);} for(int i=0;i<5;i++){ field0.getExpectation();field1.mouseClicked(14);} }} }}

6. 6 Pilot Mental Model public void getExpectation() { // current altitude 100ft or more below capture altitude - climb // current altitude 100ft or more below capture altitude - climb if(ap.mcpAltitude - ap.altitude >= 100) if(ap.mcpAltitude - ap.altitude >= 100) expectation = climb; expectation = climb; // current altitude 100ft or more above capture alitude - descend // current altitude 100ft or more above capture alitude - descend if(ap.altitude - ap.mcpAltitude >= 100) if(ap.altitude - ap.mcpAltitude >= 100) expectation = descend; expectation = descend; // at capture altitude - hold // at capture altitude - hold if(ap.altitude == ap.mcpAltitude) if(ap.altitude == ap.mcpAltitude) expectation = hold; expectation = hold; checkExpectation(); checkExpectation(); }

7. 7 Mode Confusion Property public void checkExpectation() { Verify.assert(expectation != climb || ap.situationNumber == 1 || ap.situationNumber == 2 || Verify.assert(expectation != climb || ap.situationNumber == 1 || ap.situationNumber == 2 || ap.situationNumber == 5 || ap.situationNumber ==12 || ap.situationNumber == 16); ap.situationNumber == 5 || ap.situationNumber ==12 || ap.situationNumber == 16); Verify.assert(expectation != descend || ap.situationNumber == 3 || ap.situationNumber == 4 || Verify.assert(expectation != descend || ap.situationNumber == 3 || ap.situationNumber == 4 || ap.situationNumber ==13); ap.situationNumber ==13); Verify.assert(expectation != hold || ap.situationNumber == 1 || ap.situationNumber == 2 || Verify.assert(expectation != hold || ap.situationNumber == 1 || ap.situationNumber == 2 || ap.situationNumber == 4 || ap.situationNumber == 5 || ap.situationNumber == 8 || ap.situationNumber == 4 || ap.situationNumber == 5 || ap.situationNumber == 8 || ap.situationNumber == 12 || ap.situationNumber == 16 || ap.situationNumber == 19); ap.situationNumber == 12 || ap.situationNumber == 16 || ap.situationNumber == 19);}

8. 8 JPF Output JPF produces an execution path through the Java code to the assertion violation –This can be analyzed in a debugger style, but since it is 1013 steps long this will be too tedious Process JPF output to capture GUI commands that leads to the mode confusion –start > incrMCPAlt > incrMCPAlt > pullAltKnob > fly > fly > incrMCPVS > fly Replay these steps in the Tutor Applet to see the problemReplay these steps in the Tutor Applet to see the problem