formal methods for interactive systemsgroups.di.unipi.it/~cerone/courses/fmis/course...with a long...

Formal Methodsfor

Interactive SystemsPart 10 — Reverse Engineering with Matrix Algebra

Antonio Cerone

United Nations University

International Institute for Software Technology

Macau SAR China

email:[email protected]

web:www.iist.unu.eduA. Cerone, UNU-IIST – p.1/26



Danger: model accuracy relies on accuracy ofthe reverse engineering





=⇒ manifacturers do not provide formalspecifications





=⇒ manifacturers do not provide formalspecifications

=⇒ formal specifications must be reconstructed




device• observing user-machine interaction in the real

operating environemt





operating environemt• interviewing real users and manifacturer





operating environemt• interviewing real users and manifacturer• checking documentation (e.g., user manual)




• results can be verified against the device bythe reader




• results can be verified against the device bythe reader

• case studies are more credible ⇐= nottailored for the used modelling / verificationapproach




Matrices• are standard mathematical objects

with a long history





with a long history=⇒ no need to introduce yet another notation

• are easy to calculate






• are easy to calculate• semantics reflects human way of thinking






• are easy to calculate• semantics reflects human way of thinking• have







• structure =⇒ easy modelling







• structure =⇒ easy modelling• properties =⇒ verification tool







• structure =⇒ easy modelling• properties =⇒ verification tool

[Thimbleby 04] A. Cerone, UNU-IIST – p.5/26



Pressing the switch alternatively turns thelight on or off.





• 2 states: ON and OFF• 1 operation: push





• 2 states: ON and OFF• 1 operation: push

[Thimbleby 04]



�� OFF

' $?

push

�� ON

& %6

push

OFF = 0 , 1 ON = 1 , 0



�� OFF

' $?

push

�� ON

& %6

push

OFF = 0 , 1 ON = 1 , 0

push =01

10



OFF = 0 , 1 ON = 1 , 0

push =01

10

OFF



OFF = 0 , 1 ON = 1 , 0

push =01

10

OFF push



OFF = 0 , 1 ON = 1 , 0

push =01

10

OFF push = 0 , 101

10



OFF = 0 , 1 ON = 1 , 0

push =01

10

OFF push = 0 , 101

10

= 1 ,� � �

� k



OFF = 0 , 1 ON = 1 , 0

push =01

10

OFF push = 0 , 101

10

= 1 , 0� � �

� k



OFF = 0 , 1 ON = 1 , 0

push =01

10

OFF push = 0 , 101

10

= 1 , 0 = ON



OFF push = ON ON push = OFF




push push




push push =01

10

01

10




push push =01

10

01

10

=10

01




push push =01

10

01

10

=10

01

= I



OFF x = 0 , 1x1,1

x2,1

x1,2

x2,2= 0 , 1 = OFF

ON x = 1 , 0x1,1

x2,1

x1,2

x2,2= 0 , 1 = OFF



OFF x = 0 , 1x1,1

x2,1

x1,2

x2,2= 0 , 1 = OFF

ON x = 1 , 0x1,1

x2,1

x1,2

x2,2= 0 , 1 = OFF

x2,1 = 0 x2,2 = 1



OFF x = 0 , 1x1,1

x2,1

x1,2

x2,2= 0 , 1 = OFF

ON x = 1 , 0x1,1

x2,1

x1,2

x2,2= 0 , 1 = OFF

x2,1 = 0 x2,2 = 1x1,1 = 0 x1,2 = 1



OFF x = 0 , 1x1,1

x2,1

x1,2

x2,2= 0 , 1 = OFF

ON x = 1 , 0x1,1

x2,1

x1,2

x2,2= 0 , 1 = OFF

x2,1 = 0 x2,2 = 1x1,1 = 0 x1,2 = 1

=⇒ x =00

11



OFF x = 0 , 1x1,1

x2,1

x1,2

x2,2= 0 , 1 = OFF

ON x = 1 , 0x1,1

x2,1

x1,2

x2,2= 0 , 1 = OFF

x2,1 = 0 x2,2 = 1x1,1 = 0 x1,2 = 1

=⇒ x =00

11

∃ n such that pushn

= x ?



OFF x = 0 , 1x1,1

x2,1

x1,2

x2,2= 0 , 1 = OFF

ON x = 1 , 0x1,1

x2,1

x1,2

x2,2= 0 , 1 = OFF

x2,1 = 0 x2,2 = 1x1,1 = 0 x1,2 = 1

=⇒ x =00

11

∃ n such that pushn

= x ?

No because push 2= I A. Cerone, UNU-IIST – p.10/26


OFF x = 0 , 1x1,1

x2,1

x1,2

x2,2= 1 , 0 = ON

ON y = 1 , 0y1,1

y2,1

y1,2

y2,2= 0 , 1 = OFF

x2,1 = 1 x2,2 = 0 =⇒ x =

1 0

- -



OFF x = 0 , 1x1,1

x2,1

x1,2

x2,2= 1 , 0 = ON

ON y = 1 , 0y1,1

y2,1

y1,2

y2,2= 0 , 1 = OFF

x2,1 = 1 x2,2 = 0 =⇒ x =

1 0

y1,1 = 0 y1,2 = 1 =⇒ y =0 1

- -

- -



OFF x = 0 , 1x1,1

x2,1

x1,2

x2,2= 1 , 0 = ON

ON y = 1 , 0y1,1

y2,1

y1,2

y2,2= 0 , 1 = OFF

x2,1 = 1 x2,2 = 0 =⇒ x =

1 0

y1,1 = 0 y1,2 = 1 =⇒ y =0 1

1 0= on

0 1= off




One switch position (on) turns the light on;the other (off) turns the light off.





Properties• The system is closed





Properties• The system is closed• any sequence of actions is equivalent to the

last actions the user does



• matrix algebra can be used to find interestingproperties through

• direct manipulation of matrices (operations)rather than vectors (states)




• direct manipulation of matrices (operations)rather than vectors (states)⇐= number of operations much smaller thannumber of states





• the methodology is• scalable





• the methodology is• scalable• mechanisable [Gow and Thimbleby 04]



• Model: CASIO HL-820LC• State




• d = display contents




• d = display contents• m = memory contents




• d = display contents• m = memory contents• state representation: vector s = [d,m]




• d = display contents• m = memory contents• state representation: vector s = [d,m]

• Operations: binary 2×2 matrices




• M− subtract display from memory





• AC clear display






• MRC recall memory






• MRC recall memory

• MRC MRC recall and clear memory




• if m = 0 then no effect




• if m = 0 then no effect• if m 6= 0 then d := m





• pressed twice





• pressed twice• m := 0




• Semantics of pressed once depends onprevious content of memory





• Is MRC ( MRC MRC )= ( MRC MRC ) MRC ?





• Is MRC ( MRC MRC )= ( MRC MRC ) MRC ?

• Calculator:MRC ( MRC MRC ) = MRC MRC




• No!MRC MRC = MRC M−





• MRC MRC is a bad design choice!





• MRC MRC is a bad design choice!

[Thimbleby 00]



• Is a calculator safety-critical?• May a calculator-like interface be

safety-critical?



• Is a calculator safety-critical?• May a calculator-like interface be

safety-critical?• Yes!

Syringe pump have calculator-like interfaces


Seminar 6 — Usable CalculatorReverse Engineering | Matrix Algebra | Pushbutton | Safety | Two-position | Remarks on Matrix Algebra | Calculator | Exams | Refs

Topic: Calculator Interfaces

Towards a truly usable calculator• Harold Thimbleby

Computer Algebra for User Interface Design, 2004

• Harold ThimblebyA Novel Pen-based Calculator and its Evaluation, 2004

• Will Thimbleby and Harold ThimblebyA Novel Gesture-based Calculator and its Design Principles, 2005

• Websites on• Computer Algebra: http://www.cs.swan.ac.uk/∼csharold/CA/• Calculator: http://www.cs.swan.ac.uk/calculators/


http://www.di.unipi.it/~cerone/courses/fmis/ReverseEngineering-algebra.pdf

http://www.di.unipi.it/~cerone/courses/fmis/ReverseEngineering-pen-2004.pdf

http://www.di.unipi.it/~cerone/courses/fmis/ReverseEngineering-gesture-2005.pdf

http://www.cs.swan.ac.uk/~csharold/CA/

http://www.cs.swan.ac.uk/calculators/


• [Thimbleby 04]: Reverse Engineering andMatrix Algebra

• [Gow and Thimbleby 2004]: Matrix Algebraand Tools

• [Thimbleby 00]: Reverse Engineering


formal methods for interactive systemsgroups.di.unipi.it/~cerone/courses/fmis/course...with a long...

Documents