SignificantDistinctionsOnly: Context ...paritosh/papers/struss/Struss_1999... · SignificantDistinctionsOnly: Context-dependentAutomatedQualitativeModeling ... The first step is to

Significant Distinctions Only:Context-dependent Automated Qualitative Modeling

Peter Struss''Z and Martin Sachenbacher"

AbstractQualitative modeling means making the essentialdistinctions only . Compositional modeling requires to statebehavior models of system constituents (e.g components)independently of their context. This creates a problem,because what is essential depends not only on the localmodel fragment, but also on the context of the model and itsusage, i .e. the structure of the entire system and the task tobe performed. For instance, in diagnosis the goal ofdiscriminating between different behavior modes determinesthe distinctions to be made . The paper deals with theproblem of deriving the sets of qualitative values of modelvariables that allow to generate the distinctions required bythe goal of model based prediction and the structure of thesystem . We present a formal definition and analysis of theproblem and an algorithm for computing appropriatequalitative values based on propagation of distinctions . Animportant special case is the computation of locallandmarks of variables . Based on the generic solution, weshow how models for diagnostic can be derived .

IntroductionThe success of model-based systems and the growinginterest in their industrial application strongly relies on theavailability of models that are both compositional andpowerful enough to support solving different problems .Compositionality, i .e. the possibility to combine modelstaken from a library to form a system model, requiresgenericity and addresses the efficiency of the modelformation process . Models with a granularity andsufficient inferential power for a particular problem have tobe specific and address effectiveness and efficiency of theproblem solving process.Obviously, there is a tension between these requirements .Qualitative modeling, besides the feature of providingfacilities for conceptual modeling, can be seen as pursuing.the goal of making significant distinctions only in a model.However, what is significant depends, on the context andthe task . Finding a solution to this dilemma is crucial,

QR99 Loch Awe . Scotland

because otherwise model libraries with re-usable modelsare not feasible, and this will seriously reduce the practicalvalue of model-based systems .The paper presents a contribution to analyzing and solvingthe task of generating a model that reflects the distinctionsrequired by individual model fragments and the context andpurpose of the model. We first illustrate the problem by atiny, but practical example . Section 3 defines the goalformally and precisely . Then we characterize the solutionin a theoretical way . In section 5, we present thefoundations and an outline of an algorithm that computesthe solution . Finally, we attempt to assess the impact of theresults achieved so far and point out open questions andfuture work .

An Introductory ExampleThe following example is meant to illustrate the problemand, in the following, the solutions presented . Although wesimplified it for this purpose, it is drawn from a realapplication involving diagnosis and fault analysis ofvehicles .The device in Figure 1 shows a pedal position sensor in apassenger car . Its purpose is to deliver information aboutthe position of the accelerator pedal to the electroniccontrol unit (ECU) of the engine management system . Thishappens in two ways : via the potentiometer as an analoguesignal, v., and via the idle switch as a binary one, v_;,,, .The idle switch changes its state at a particular value of themechanically transferred pedal position (this is asimplification, since the transition happens in some "fuzzy"interval) . This system is fairly simply structured(nevertheless, the manufacturer's failure mode and effectsanalysis (FMEA) for this system covers 6 pages), and itselectrical subsystem comprises only standard components .We do not expect any problems finding appropriatebehavior models for them in our model library .Actually, there can be a problem, dependent on the type ofthe model . If we have chosen to use qualitative models,

'Technical Univ. of Munich 'OCC'M Software GmbH 'Robert Bosch GmbHDept. of Computer Science Gleissentalstr . 22 Department FV/SLN

Orleansstr . 34 D-82041 Deisenhofen P.O . Box 30 02 40D-81667 Munich Germany D-70442 Stuttgart

Germany Germany{struss, sachenba) @in.tum.de, struss@occm .de

http://www9.in.tum.de/MQM/

which distinguish only between voltage "gnd", "between"and "batt" as convenient for many tasks, the models of themain components, potentiometer and switch may be theones shown in Table 1 (the depicted case i.=0 applies tothe correctly working system of Fig . 1) and Table 2,respectively. They may suffice for some purposes .However, they are of limited use when we want to use themodel for instance for diagnosis, FMEA, or to support thedevelopment of control unit software . The reason is thatthese tasks have to exploit the redundancy whichpurposefully has been implemented in the system : the twosignals entering the ECU can be checked for plausibility .The two possible values of v,,,, due to the switch stateand, hence, the pedal position, correspond to two ranges ofVP� , separated by a particular voltage value . However, this"landmark" is missing in the domain of voltage, and, hence,the compositional model will be of very limited utility forsuch tasks . How could the modeler of the potentiometeranticipate this particular context? Actually, he could not,and, moreover, he should not, because the voltagelandmark would not make any sense in a differentstructure .

Figure 1 : The Pedal Position Sensor

Of course, we could use numerical models in our librarywhich would be able to relate the switching position to aparticular division of the potentiometer voltage and va, .However, this model would be overly detailed for thepurpose discussed . What we would like to have, is acomposition of component models that make just the rightdistinctions required by other components and the task themodel is used for . Since we cannot expect to find suchmodels in the library right away, the only way out is togenerate it from a base model which may be in a library . Ifwe cannot automate this goal-directed transformation ofmodels, much of the benefit of model-based systems,namely re-use of model fragments, cannot be achieved, andthis will limit the utility of the technology drastically .The example should trigger some intuitions of how thismight be achieved . Starting from a more detailed model,the requirements for certain distinctions arising from somecomponents and/or the particular task can inducesignificant distinctions in other components via thestructure of the device and the individual component

OR99 Loch Awe, Scotland

Table 1 : Partial potentiometer behavior model from thelibrary

Table 2: Switch behavior model from the library(pos.,, is the switching position)

models . For instance, the required distinction between"grid" and "batt" for v_;,,, requires the distinction betweenthe switch states which in turn determines a distinctiveposition of the pedal, and this induces a landmark in thedomain of va, .We would like to turn this intuition into an algorithm and,in order to to create its foundations, analyze the task in arigorous and formal way .

Formalizing the Goal

The first step is to state our goal precisely and formally.We will define it in a fairly general way . In particular, wedo not only treat models composed of continuous functions,but relational models, as motivated by the switch examplein the previous section . Accordingly, a model of a system,S, to be analyzed is given by a relation

RS c DOM(_v s ) ,where v_S is the vector of all parameters and variables(input, output, internal and state variables) in the system.In this formalism, our problem can be stated as follows :there is"

a base domain DOM�(v,) for each variable v,, (e.g . realnumbers, intervals reflecting precision, but also statesor a qualitative domain) and a modelRs.o c DOM,(v_S )

= DOM,(v,) x DOM,(v,) x . . . x DOM,(v,),a characterization of the primary distinctions for each v,required for some external reason (a functionalspecification, safety limits, diagnostic distinctions etc .)or due to the structure of the local model, expressed in

204

Pos i v v v0 0 {gnd, betw,

batt){gnd, betw,batt }

=vleft

.

pos y.��� 0 { grid, betw,batt)

{ gnd, betw,bait l

= v igh .

(0, os ,) 0 nd grid ILd(0, os ) 0 f nd, betw { betw, batt l betw(0, os .) 0 batt { nd, betwl betw(0, os ) 0 batt batt batt

os state v v v[0, pos,J left { gnd, betw, {gnd, betw, = vie,

bait) batt l(pos"M,, right {gnd, betw, {gnd, betw, = v,,g ,,os bait) batt )

DOM(,(v,) (e.g . the switch output voltage being zero orpositive) . More precisely, for a variable v, suchdistinctions are specified as partitions II=[P,) ofDOMo(v) 1 . A partition {P,) e P(DOMO(v)) (the powerset of the domain) is a set of non-empty disjoint subsetsthat together cover the entire domain :VP, :P,#0P,nP,#0 =* P,=P,andV P, DOM,(v) .

The intuition behind the partitions is that they definequalitative values : exactly values in different partitions P,have to be distinguished from each other. In our example,the output voltage of the switch has the primary partitionII,,w,",{{0), (0, -)) . For many parameters and internalvariables, there are no primary distinctions to be made . Inthis case, the partition is the trivial one :

I7=(DOM�(v)) .In the following, it is often convenient to talk about themapping of values to qualitative values, which we callqualitative domain abstraction .

Definition (Qualitative Domain Abstraction)A qualitative domain abstraction is a mapping

't : DOM,(v) -> DOM,(v) c P(DOMo(v))where `d voE DOM,(v) : v�E'C(vo) .

Remark : A qualitative domain abstraction is a domainabstraction in the sense of (Struss 92) and induces anabstraction of the system model by

Rs.*:=T(R,) .There is an obvious correspondence between domainabstractions and partitions : a qualitative domain abstraction,r of DOMo(v) induces a partition

II, =T(DOM,(v)) ,and vice versa . By n, we denote the qualitative domainabstraction induced by the primary partition :n:=(71,, 71" . . . iQ : DOM,(v_S ) -4 II, x 112 x . . . x n. .

Variables that do not have any primary distinctionassociated, are mapped to the trivial partition, i .e. thereexists only one �qualitative value" which represents theentire domain . Our view is that all we are ultimatelyinterested in when using the model is optimal informationabout the primary distinctions, and that other distinctionsshould be considered if and only if they are necessary toderive conclusions about the primary ones . From the initialfine-grained model R,,, primary distinctions can bedetermined by applying n.What does it mean to ,use the model"? It means, giveninformation on some parameters or variables (throughmeasurements, design choices, etc .), to determine resultingrestrictions on other parameters and variables . If, for

I In the following, when considering an arbitrary variable, wedrop the index to improve readibility.

QR99 Loch Awe . Scotland

instance, measurements MEAS for some variables with thegranularity of the respective DOM,, are given, we cancompute the resulting restriction RS.,, n MEAS . But onlythe primary distinctions implied by this restriction matter,i .e .

n(R,on MEAS) .RS. , may not be able to determine all required distinctions .But w.r .t. the possible ones, DOMo(v_ 5 ) may be overlydetailed . We would like to determine the distinctions to bemade for each v ; that are both necessary and sufficient inorder to express the model in terms of these distinctionsonly without losing the "distinguishing power" ofDOMJy_S ) . This means: finding a qualitative domainabstraction for DOM,(_vs)

T=(T,, T 2 , . . ."C.)where 'L; : DOM,(v,) -> DOM.(v,) =P(DOM,(v;))

which is maximal in some sense but does not destroy theprimary distinctions . For instance, if the pedal position isgiven, then distinguishing values [0, pos,,J from those in(pos,, m,, , pos,.J is necessary and sufficient to derive theprimary distinctions for v h (zero vs . non.zero). In generalterms, the requirement means : if there is any externalrestriction on the system behavior (actual observations,design specification, etc .), applying the qualitative domainabstraction 't before determining the primary distinctionsdoes not change the result, formally : if the externalrestriction is given by a relation R~�eDOMo(v_S), then

n'(T(R,.,) n T(R,,,)) = n(R,,, n Zs,) . (1)Here, n' : r(DOM,(v,)) -> IZ, x 17 2 x . . . x I7. maps theresults of the qualitative domain abstraction r (i .e . sets) tothe primary partitions they are contained in :

n'(T(v))= TE(v)) for ve V .

Obviously, this is well-defined only if r is a refinement of naccording to the following definition .

Definition (Refinement and Merge of Partitions andDomain Abstractions)Let 17,, 112 in DOM,,(v) be two partitions . TI, is called arefinement of another one, 112, iff

b' P,E 17, 3 PE 112

P ig P, .It is called a strict refinement, if, additionally,

3 P,E n,

VPZE n2

P,*P2.

The merge of two partitions 17,, �2 of DOM,(v) is thepartition containing all intersections of their elements :

merge(17,,11):= { P, nP, I P,E TI, A PE 112 )\{0) .

We apply the same terminology to the qualitative domainabstractions induced by the partitions .Property (1) guarantees that we can first abstract both themodel and the measurements and still are able to detect thesame primary distinctions as before :

n'(,r(RS .,)n T(MEAS)) = n(R,,on MEAS) .

Re. Rs .0

't : DOM,(v_s ) --4 P(DOM,(v_S))

T(Rex) T (Rs.0)

/nIn

.,,, n Rs.o

r(R..) n T(Rs.o)7<

/ n'

n(R~x, n Rs.o)

=

n'(i(Reti)"n t(Rs.o))

Figure 2 : Relationship of primary and inducedqualitative domain abstractions

Figure 2 illustrates the situation . This analysis justifies thefollowing definition of our target :

Definition (Distinguishing Qualitative DomainAbstraction)Let RS,a in DOMO(v_S) be the original fine-grained model of asystem S and, for each variable v,, a finite set of primarydistinctions be given as a partition Fl,(PJ of DOM�(v,) .A qualitative domain abstraction

is distinguishing w.r .t . {fl,) iff it is a refinement of n andVR,� c DOM,(v_)n'(T(R,.) n T(R,.o)) = n(R,., n R, .,) . (1)

A distinguishing domain abstraction r is maximal, if thereis no distinguishing qualitative domain abstraction T' thatmakes less distinctions w.r .t . one DOM,(v,), i .e . there is noT that is a strict refinement of any T' ; .An important and common specialization of distinctionsand of the task of finding maximal qualitative domainabstractions is obtained if qualitative values are given asintervals of ordered domains of variables . In this case, wecan represent qualitative values in a compact way by theirboundaries, the �landmarks" as opposed to an extensionalrepresentation of sets . For instance, the partition ofDOM(pos.w;,,h) can be represented by the landmark pos,,,.Definition (Landmark partition)Let DOMo(v) be a totally ordered domain for a variable v .For a landmark set

L=( 1,) c DOM�(v) with k<m ==> h<lm

the induced partitionn,=( (h} ) U ((1 r,1.))

is called a landmark partition .

QR99 Loch Awe, Scotland

In this case, we can hope for a compact representation ofpartitions, and, if there are (piecewise) monotonicfunctional dependencies among variables, also an easierway of computing maximal distinguishing qualitativedomain abstractions .

Now that we have defined our goal, i .e . maximaldistinguishing domain abstractions, we will characterize thedesired solution in a formal way .

Characterizing Maximal DistinguishingAbstractions

The intuition behind the formal characterization of thedesired qualitative domain abstractions is that property (1)can be established if the qualitative domain abstraction ~. ofeach single DOM,,(v) reflects the primary distinctions n, ofany other DOM,,(v,) (of course, including its own) . Thismeans, we apply r to one DOM,,(v,) at a time only (leavingthe other variables at the granularity of DOME) whichcorresponds to the mapping

( id ,, . . . . idj _,, TJ , ids� , .

, id~) ,where id, is the identical mapping on DOM,,(v k ) . Then wedetermine the primary distinctions by the mapping

n"j _ (n,, .. .

. , n.) ,and (1) implies

d i,j

pr;(n"; (r"i (Re.,) n 'c"J (R,,))= pr.(n(R.., n R,, .o)),

(2)where pr, is the projection to the i-th variable . On the otherhand, if (2) holds, then (1) can be proved. This motivates acharacterization of distinguishing qualitative domainabstractions starting from the question : Which distinctionsin DOM,(v) are necessary in order to guarantee thedetermination of the primary distinctions in DOM,(v,)under the assumption that all other variables can makedistinctions given by DOM,?Given the primary distinctions for some DOM,,(v,), we haveto determine which values in DOM,(v) can be aggregatedinto one qualitative value . The answer is that we canaggregate two values v.,, v.2 in DOM,(v) if they alwayslead to the same conclusions for the primary distinctions ofDOMo(v,), regardless of any additional restriction on othervariables . This idea is captured by the followingequivalence relation on DOM�(v) .

Definition (Induced Partition)Let an equivalence relation on DOM,(v) be defined by

vi.,', v,z :<-* `d i,k

pr.,(( v = v,,) (9 Rs .u ® { v, = PJ)= pr;( ( v ; = v; .z) ® RS. ,, (9 { v, = PJ ) ,

(3)where pr_, denotes the projection that eliminates the j-thvariable, and for two relations R,, RZ, the join R,®R, is theintersection of the relations after their embedding into thedomain of all occurring variables .The sets of partitions I7,.d ,, for DOM,(v) given by theequivalence classes of the relations =i ,

11.., := DOM,(v) I -iare called the partitions induced by the primarydistinctions .

This means : two values are in different equivalence classesif and only if they entail different conclusions for at leastone P,t (i .e . refuting it or not), possibly together withadditional information on other variables . This leads to thefollowing characterization .

206

Lemma (Characterization of Maximal DistinctiveDomain Aggregations)The set of induced partitions { n,,j } defines a maximaldistinguishing qualitative domain abstraction T;, w.r .t. tothe primary distinctions .

Example (Pedal Position Sensor Switch)Considering our introductory example and assumingDOMo(v,e�)=DOM,,(v,;gh,)=DOM�(vsw;,ch )=III,'

andDOM,,(pos sw �<h) = [O,pos, ._.] c IR

for the variables of the switch, we can express the taskrequirement of distinguishing at vs,,,ch between 0 (= "gnd")and positive values as an primary partition for v s,O ,,h : Ilv_;,~h= {{0}01 .For all other variables (including the switch state), we donot assume any primary distinction . When applying (3), wehave to consider Rsi,,o®{ vsw,,cn01 and R_;wh.00f vsw�ChE IR 1displayed in the tables below :

Rswiwh, 0 (v, ., .h

0) :

Rsw,wLU ® 1 Vswheh E ff 1 :

To compute the induced partition for, say, v,;gh ,, theprojections defined by (3) have to be compared for eachvalue of vngh,. As can be easily seen, all positive values forv,; h, occur in the same tuples both for vsw�ch = 0 and v-�1h Ell $ and hence, form one partition, whereas v i,,,, = 0 occurswith state = right for vsw;,,, = 0 in contrast to all positivevalues . Hence, the lemma successfully induces the partitionnv,;gh , = f (0), HC) as we would expect . Please note, thatthis happened only because we looked at the switch inisolation . If we consider the entire pedal position sensorand, hence, the connection to the battery as in Figure 1, v,, gh ,would be constrained to "batt" and not receive thelandmark .We point out, that (3) also induces a partition for the state,n,., = ( (left),(right 11 . This seems obvious . However, ifthe switch would be seen as part of a different structure,e.g . connected to the battery as displayed in Figure 3, thenwe obtain Rswe,,® 1v,wihh = 01 as

os state(0, os ]

(left,ri htl

and R_,1,.0 ® IW = Q), and there is no reason to distinguish

QR99 Loch Awe, Scotland

VMh0

the two states (and no values of other variables) . Thisillustrates that the induction of partitions can also beapplied to discrete variables and may detect that it isuseless to distinguish between certain states .

Vswitch ;

gnd 'batt Battery

Figure 3: Switch with modified structure

Example (Multiplication Constraint)As a second example, we consider the constraint c=a*b. Letus assume first thatDOM�(a)= DOMo(b)= DOM�(c)= IR

and that there is an primary partition on DOM �(c) given bythe landmark set Lc (0, 11 for c and none for a and b . If wetry to construct a maximal abstraction ti according to (3),we have to realize that, except for T--id, there is noabstraction that has the discriminating power of the realnumbers . In fact, if a qualitative abstraction r would maptwo different real numbers, a,<a 2, onto one partition, thenchoosing

R,,,={a=a,)® {b=1/a,)reveals the loss : over the real numbers, the resultingabstraction n yields

n(R,x, r) R,.o) = (K IR , { 11) ,whereas n' produces

n'(,r(R,x,) r) ,r(R,)) = (1R IR, [1, -)) .In other words, we cannot maintain the precision of IRwhen we give up IR . However, if we change thegranularity of the domain (e.g . because we cannot measurereal numbers, anyway) and choose intervals bounded byintegers,

DOM,(a)= DOM,(b)= DOM0(c)=( (z, z+1) I zEINT 1,then the picture changes . As suggested by Figure 4, we cansummarize all values greater than 1 for a. Intuitivelyspeaking, it would not pay off to distinguish between thembecause b's values are not fine-grained enough to exploitthe distinction, say, for determining whether or not c is lessthan, equal to, or greater than 1 . Applying (3) induces thelandmarks

L,-- Le (-1, 0, 11 .As a lesson to be learnt here, the choice of the initialrepresentation (the �gold standard") can be crucial for theresult obtained .

207

os state[0, os left(os , os ] right 0 DOE 0

os . state[0, os ] left I©I' I',

(os, os ri ht I' ~aE~ 1'

"'mapsIMOVE

EMERVI; ftlVe`l a

i44-4-1

a

OR99 Loch Awe, Scotland

v.v';v;.z :camf/ i,k

v;, E pr;(R, .o (&P,k )bv;.z Epr).(

Rs.,,(9 Pie ) . (3' )

What makes the characterization according to (3) not veryhandy for the actual computation of the qualitative domainabstraction, is1 . that checking (3) involves comparison of any pair of

values in the fine-grained representation of DOMo, and2 .

that computation of { v,.,) ® Rs_o ® P,, can be costly forcomplex devices .

Regarding 1, we cannot do much about it without losingdistinguishing power, except for the case of landmarkpartitions and continuous functions . A weaker equivalencerelation would be

The resulting qualitative domain abstraction joins thevalues if and only if the same conclusions for the primarydistinctions can be derived from them alone, i .e . withoutregarding additional information on other variables. (3) isinteresting because it does not require mutual comparisonof values, but computation of projections and theirintersection .As for the second computational problem, we have severalobservations : the computation of the Rs.� ® P, can be doneonce for the checks on all DOM,,(v) . More importantly, weshould consider how this computation can be achieved .Unless the system is highly connected, the interactionbetween v and the distinctions in DOM,,(v,) is not direct,but mediated by a sequence of other variables . This leads tothe idea of exploiting the structure of the system and topropagate distinctions through it to compute the possiblequalitative domain abstractions in different parts of thesystem . In other words, while we usually computedistinctions from the model by propagating given externalrestrictions, we would like to start from the necessaryprimary distinctions and propagate them "backward" inorder to determine the granularity that provides optimalresults when propagated "forward" .

Foundations of the Propagation AlgorithmIn this section, we provide the formal foundations for theiterative computation of the Fl,-,,, by propagation ofdistinctions . There are two fundamental ideas that have tobe formalized and proved : For each variable v,,1 . we can compute the final partition n;,, ,, by computing

Figure 4: Projections of a*b=c to the (a,b)-plain for the qualitative values of c

the partitions induced by the primary partitions n, of theother variables v, individually and merging them .

2 . Rather than carrying out the checks involved indefinitions (3) or (3') globally, i .e . w.r .t . the entireRs.o®P,e, the algorithm propagates the qualitative valuesP,, to generate induced partitions in variables adjacent tov and then compute the equivalence classes of v w.r .t .these neighbor partitions only .

The first step is straightforward, since it means checkingthe condition for the equivalence for a growing set ofindices (i,k) which can only lead to further splitting ofequivalence classes and never to joining them . Formally :Lemma: (Iterative computation ofinduced partitions)Let IK = { (i,k) } be the entire index set of the primarypartitions CI, = (PJ and IK" e IK' c IK. Then n_ .f(IK') isa refinement of FI,.,.,(IK") and more specifically,

CI ;.,,(IK') = merge II;,,,(IK"), n;,,,(IK' \ IK"))Here, FI;,,,,,(IK') is obtained by applying (3) or (f),respectively, quantifying over (i,k) E IK.

To formalize the second idea, we select two differentvariables v,, v and analyze how to compute the partitions ofv induced by v; (Figure 5a) . v, can only receive inducedpartitions via constraints it is directly involved in . Hence,we split the entire relation Rs,o for each variable v into tworelations Rs .u = R~.,o ® R_,.o, where R, ., comprises allconstraints that involve v directly (i .e . restrict it) and R_,,othe other ones . In terms of component-oriented modelingthis means :

For internal variables and parameters v, the respective1~,o is basically the component model relation (possiblywithout constraints that do not mention v)

" For the interface (terminal) variables shared by thecomponents, RJ,0 is constituted by the constraints in thetwo connected components that refer to v .

This replaces Rs.o ® P. by I~.o ® R_j, ® P,, in (3) . In Figure5b, the ellipse separates 1~, (in its interior) from R_j,, Sincev does not directly interact with R_, . O , it reflects thepartitions P, r by reflecting the partitions induced by P, t onthe "neighbor variables" of vf, i .e . all variables occurring inR,, � except for v . This means the induced distinctions for vare obtained in two steps : First, for all neighbor variablesv,. of v, the partitions P., induced on them by v; arecomputed . Then the partitions on v are computed withinthe ellipse, i .e . by confining (3) to the neighborhood of v;,

208

i .e . to Rp ® P., (Figure 5c) . The following lemma statesthat this correctly determines the partitions for v, .

Lemma (Propagation of Partitions)Let IK' c IK, where for (i,k) E IK', v ; does not occur in Ri.o

i .e . is not a neighboring variable of v' . Let further ML bean index set, such that for all (m,l) E ML, vm is a neighborvariable of v) and ML is given by the partitions induced byP;~ :

{Pm , I (m,l) E ML} = 11,~,.m(R;, , IK') .Then

nioe.i(R,, , IK')

ML).Here

- ) means that (3) are carried out for Rxreplacing R,,.This provides the foundation for an algorithm (or, rather, afamily of algorithms) that computes induced qualitativevalues from the primary distinctions by propagationthrough the structure of the model, as illustrated by Figure5 a, b, c . It can be sketched as follows (Figure 6) :

Algorithm ComputelnducedPartitions(variable list)1 .

For all variables v;current partition(v) E -- primary partition(v)

2 . ComputeNeighborPartitions(variable list)3 .

For all variables v;first partition(v) f- current partition(v)current partition(v) <-- primary partition(v)

4 . ComputeNeighborPartitions (reverse(variable list))5 .

For all variables v;final partition(v) E- merge(first partition(v), currentpartition(v) )

Figure 6: Algorithm for the computation of inducedpartitions

The procedure ComputeNeighborPartitions gets the firstvariable on the variable list and its current partition,computes the induced partitions for all neighboringvariables in the rest of the list, then merges them with thecurrent partitions and recursively calls itself on the rest ofthe variable list .

QR99 Loch Awe, Scotland

Figure 5 a, b, c : Localizing the computation of partitions

After the first call of the procedure, every variable in thevariable list has received induced partitions from allpredecessors in the list, and in the second run from allsuccessors .For our example of the pedal position sensor, thepropagation algorithm would induce the landmark poss �.for the switch which maps to posrd . �l ~, for the pedal andpos,,N.�,, for the potentiometer, finally generating alandmark v, ,_, corresponding to this position, as neededfor the task described .

Application : Models for Diagnosis andSignificant Deviations

In many cases, for instance in diagnosis and FMEA, whatmakes a distinction in a model of a component is notdetermined by some absolute values of other variables, butby the fact whether or not it enforces a significantdeviation on them, regardless of what their specific valueis . The view is here that the function of the overall deviceimposes a certain tolerance on the output of this device, andits components are not considered faulty anless theirbehavior causes a disturbance of the output beyond thegiven tolerance . If we succeed to compute the tolerances ofthe parameters of the component models starting from thegiven functional specification, we can automaticallygenerate fault models that reflect the particular device andits context, which we cannot expect by definition fromgeneric models .

Y

Yact

Ay 1Yref

Figure 7: A relational model can impose constraints onthe deviations of variables

The idea underlying deviation models is to describedeviations of variables which are consistent with a certainbehavior model (Figure 7). For this purpose, we defineA : DOMo(v) x DOMJv) --> DOMO(v)Wx,, X Z, . . ., x~), (Y" Yz" . . ., YO) :=(A,(x,Y) , A,(xz,YZ),,Ok(x.,Y.))= (x, -YV X2_Y21 - x.Y~)

The deviation model of R, denoted R,, describes howdeviations of variables propagate through a component :

R, c DOMO (_y) x DOM,,(_v) x DOM,,(v_)R, := ( (_v, v', A(_v, v_) I _v, v_' E R }

The projection of R, on the Ov,, pr,,;(R,), can be viewed asa "pure" deviation model which relates deviations ofvariables independent of their actual and reference value .This is meaningful only in some cases, for example, if therelation describes a monotonic function . In general, at leastinformation about the actual value will be necessary . Theanalysis of significant distinctions developed above can beapplied to such deviation models : we can specify what isconsidered to be a significant deviation of some relevantvariables by landmarks of the respective A-variable . Theywill induce partitions for other respective A-variables, butcan also propagate to the domains of the variablesthemselves .The induced landmarks in the model can be used toproperly model the (context-dependent) limits of correctbehavior and to define fault models . They also indicatesome requirements on the precision of observations fordiagnostic purposes .Basically, the technique determines the model granularity(and observation granularity) given particular functionaldistinctions . The result will mainly serve fault detection .Fault localization and identification might be possible, butis not guaranteed .For the latter, the goal is to determine model andobservation granularity given particular behavior modedistinctions.The question is here : Given a set of behavior modes foreach component (one correct mode and several faulty,ones), what distinctions have to be made in the models (andthe observations) to help discriminate the modes?One way to address this problem is to represent thecomponent models as follows : For component c, a modevariable m. is introduced whose values represent thevarious, mutually exclusive behavior modes m,, of thecomponent. Each mode has an associated model relation,R,J . This establishes the component model as

A, (mode, = m« =-*model(R,,. )),or, in relational form,

R,= u, ( m, .,) x R.,The system model relation is then the join of all thesecomponent models . For this, we can now formulate the taskin our formalism : for each component, we define theprimary partition of its mode variable to be the totalpartition :

Hmode, , , = ( {m, .,) ),

QR99 Loch Awe, Scotland

and compute the induced qualitative values . Basically, thismeans treating the behavior mode like a state variablewhose values have to be completely distinguished formeach other .

Summary and DiscussionThe work presented here is an attempt to make progress inunderstanding and solving the crucial question inqualitative reasoning : How to generate models that makethe essential distinctions only?Pursuing the goal of automated generation of such modelsaims at coping with the tension between the genericity andcompositionality of models and their specificity and powerfor a particular context and task . We feel that ignoring thisproblem could lead to a failure or, at least, limitations in theapplication of model-based systems, because re-usability ofmodel fragments and model libraries would be low .What have we achieved by now? There are two outcomesthat both should be appreciated : on the one hand we startedto provide a formal, theoretical foundation for formulatingand analyzing the goal, the problems and solutions in arigorous way . This is important, because we have to beaware that a huge part of the problem space is not tractablein theoretical and/or practical sense . We better analyze andcharacterize what we can expect to solve in practice . Afterall, this work connects to the analysis in (Struss 88), (Struss90) where we showed that trying to make all significantdistinctions in qualitative models can lead to infinitedomains (like the rational numbers) . Here, we do attempt tocreate models that make all significant distinctions, and onegoal of future work is to identify conditions under whichthis can work . We believe that the chosen representation,relational models, is general enough as a basis .The second result is the design of an algorithm (or, rather, afamily of algorithms) that actually computes the significantdistinctions making use of the particular system structure .Of course, its applicability and feasibility is threatened bythe same problems as its theoretical foundation . There aredifferent dimensions of these problems and potentialsolutions :"

The computation of the equivalence classes accordingto (3) and (3) may simply lead to infinite distinctions orbe practically impossible . As we illustrated with anexample, the granularity of the base model plays animportant role here . If a type of constraint is known toprovide no qualitative values if only one variablerequires distinctions, the respective method could justskip the computation or replace it by a weaker onewhich, for instance, combines landmarks of severalvariables to generate others .

" Intuitively, the special case where the relationsrepresent functional relationships among variablesseems more restricted . However, there are severalcaveats : dependent on the granularity for the domainDOMo , the abstraction of a real-valued function may nolonger be a function, and a landmark does notnecessarily induce a single value elsewhere . On the

21 0

other hand, multi-variate real-valued functions may failto induce a finite set of landmarks, as the multiplicationexample showed. What will work smoothly are simple(piecewise) monotonic functions where landmarks mapto landmarks and intervals to intervals .Right now, the algorithm propagates primarydistinctions everywhere . There is simply no criterionwhere they might ultimately be needed . We were notvery specific about where primary distinctions comefrom and what they mean. Also, the definition ofdistinguishing domain abstractions, criterion (3), andthe algorithm contain or exploit no restriction on thenature or structure of the external restrictions, R. � .When actually solving a particular task, R.� will not bearbitrary (e.g . representing measurements of a certainsubset of the variables), and only particularcomputational paths in the model might actually berelevant . If it is possible to anticipate them, there mightbe a way to control the "backward" propagation ofdistinctions appropriately . For instance, if the model isused for prediction, say support for FMEA, then theprimary distinctions for variables that are functionallyrelevant have to be reflected by induced qualitativevalues of internal variables, but not vice versa, since theprediction always progresses from presumed faults tothe output variables .

Future work will have to both push the analysis ofconditions that prevent or guarantee the generation of afinite set of qualitative values and the development ofappropriate specializations of the algorithm and theexploitation of general or task-dependent control heuristics .Other extensions to the theory and its application concerntemporal aspects . We consider our theory to provide a basisfor a proper treatment of time scale abstraction (Iwasaki92) and, in particular, hybrid modeling . The reason is thatwhether or not certain changes can be either ignored ortreated as discontinuous changes reflects what the currenttask requires in terms of significant distinctions inmagnitude of variables, their derivatives and durations . Tohandle this as an instance of our framework, time has toincluded as a variable and integration rules must becomepart of the model relations .Finally, there exists a more abstract and weaker version ofour target: rather than computing qualitative values as setsof values of DOM., we might want to introduce distinctionsonly as (partially) ordered landmarks and then propagateordering information through the model . While thiseliminates some of the computational problems, the resultmay simply be too weak and ambiguous .In summary, we are convinced that more research shouldbe dedicated to this important practical problem since it isessential for bringing compositional qualitative modeling toreal applications .

QR99 Loch Awe, Scotland

AcknowledgmentsMany thanks to the members of the MQM group at theTechnical University of Munich for discussions andcollaboration . The reviewers' comments were very helpfulin our attempt to improve the final version, although wecertainly did not satisfy all their requests . This work wassupported in part by the Commission of the EuropeanUnion (#BE 95/2128) and by the German Ministry ofEducation and Research (#01 IN 509 41) .

ReferencesIwasaki, Y . 1992 . Reasoning with Multiple AbstractionModels . In Faltings, B . and Struss, P . eds . 1992 . RecentAdvances in Qualitative Physics . Cambridge, Mass. : MITPress .

Struss, P . 1988 . Mathematical Aspects of QualitativeReasoning . International Journal of Artificial Intelligencein Engineering Vol . 3 Nr . 3, Computational MechanicsPublications, pp . 172-173.

Struss, P . 1990 . Problems of Interval-Based QualitativeReasoning . In Weld, D. and de Kleer, J . eds . 1990 .Qualitative reasoning about physical systems . MorganKaufmann Publishers, pp . 288-305 .

Struss, P . 1992 . What's in SD? Towards a Theory ofModeling for Diagnosis, In Hamscher, W., Console, L ., andde Kleer, J . eds . 1992 . Readings in Model-based Diagnosis .Morgan Kaufmann Publishers, pp . 419-449 .