CU Most Product Launches Fail Due the Brand Rushes Them to Market Discussion

EXPERIMENTATION
4 Tips for Launching
Minimum Viable Products
Inside Big Companies
by Debbie Madden
SEPTEMBER 30, 2015
?We have to disrupt ourselves before the market does.? It?s not an uncommon mandate today.
Established enterprises need to innovate to keep pace with the more nimble, smaller startups.
Perhaps no approach has captured the imagination of big companies yearning to get more nimble
than the lean startup method: quickly building and launching minimum viable products ? MVPs ?
and then iterating and pivoting based on market feedback.
COPYRIGHT ? 2015 HARVARD BUSINESS SCHOOL PUBLISHING CORPORATION. ALL RIGHTS RESERVED.
2
Take the example of Beth, Director of e-Commerce & Digital Innovation at a company I?ll refer to as
Acme, a 20-year-old, global enterprise. Beth manages a team that?s considered a ?startup within the
enterprise.? Acme expects Beth?s team to create $50 million in incremental revenue over the next 3
years by following lean startup principles.
But Acme isn?t a startup. It?s a large, established global firm. Like most big companies, it relies on
efficiencies of scale for competitive advantage. Innovation by definition is inefficient.
However, there are in fact a few tricks of the trade that, if done well, can make an impact for large
companies trying to act more like startups.
1. Make true failure a real option. A colleague said to me the other day: ?I figured out what bothers
me so much about my job. I?m working on a startup team that has no real threat of failure. It should
have failed months ago but hasn?t.?
This often happens inside enterprise companies. At Acme, Beth should have a threat of real failure ?
a salary cut, getting fired, stopping the project, having to fire or reallocate her team. On the flip side,
if she wins, she should have skin in the game. If she?s tasked with building $50 million in new
revenue, she should be rewarded for success ? a raise, equity in the startup part of the business, a
promotion.
The point is, the team building the MVP inside an enterprise should truly act like a startup. They
should have funding to pay for salaries for the team as well as for any and all expenses, and that
funding should come with expectations around performance. If those goals are not met, the funding
should run out. If funding runs out, the team no longer has those jobs. I know it?s harsh, but without
these consequences, too many skunkworks teams go on and on, and on and on, and on and on?..
2. Get the right people on the bus. Jim Collins, in the classic bestseller Good to Great, famously wrote:
?The executives who ignited the transformations from good to great did not first figure out where to
drive the bus and then get someone to take it there. No, they first got the right people on the bus (and
the wrong people off the bus) and then figured out where to drive it.?
Enterprise companies can fool themselves into thinking, ?Mary in product will be a great fit for digital
product.? Wrong. Mary has spent the last 20 years outfitting brick and mortar stores with physical
product. She is not an automatic fit for the digital innovation side of the business.
Real startups are forced to seek new team members from outside their organization. In a ?lean? team
inside a large company, it?s wise to go through a true hiring strategy exercise. Take the time to get the
right people on the bus. Even if it takes longer. Even if it means having to hire people from outside
the firm.
COPYRIGHT ? 2015 HARVARD BUSINESS SCHOOL PUBLISHING CORPORATION. ALL RIGHTS RESERVED.
3
3. Get out of the building. Again, take a lesson from actual startups. Startups find it easy to get out of
the building, often because they don?t have an office building to begin with. Even as they grow and
get their first office space, they aren?t bogged down with executive team meetings and processes, so
they have more freedom to get out of the building.
Take the time to identify what hypothesis your MVP is aiming to confirm or disconfirm, and get
yourself out of the building, talking to actual users and potential users, and work like mad to confirm
or deny this hypothesis.
Note: Technology is not required to do this step. Sure, we could design prototypes, wireframes, scope
documents, write code. But none of this is required to get out of the building. All that?s required is
understanding who your target market is, figuring out where they hang out, and going there.
4. Create a realistic, disciplined MVP. It didn?t take long for the concept of an MVP to mean different
things to different people. Stick to the basics. It?s just meant to be a very simple product that will let
you test out the concept. What are the core features you really need? What?s the minimum you can do
to deploy the project?
Building MVPs is fun. When done well, it can be the catalyst that enables enterprise to innovate and
keep pace with the smaller more nimble competitors. What doesn?t work is acceding to political
requests from different departments who?re all trying to staple their pet project onto your MVP.
Using lean startup principles inside large companies is not impossible ? as long as your innovation
team acts as like a real startup.
Debbie Madden has built 5 companies from the ground up and has been CEO of three of them. She is currently the CEO
of Stride, an Agile software development consultancy in NYC. Prior to Stride, Debbie was the CEO of Cyrus Innovation,
which she ran for 10 years, grew into a 5-time Inc 5000 winner, and Crain?s NY Best Place to Work.
COPYRIGHT ? 2015 HARVARD BUSINESS SCHOOL PUBLISHING CORPORATION. ALL RIGHTS RESERVED.
4
Copyright 2015 Harvard Business Publishing. All Rights Reserved. Additional restrictions
may apply including the use of this content as assigned course material. Please consult your
institution’s librarian about any restrictions that might apply under the license with your
institution. For more information and teaching resources from Harvard Business Publishing
including Harvard Business School Cases, eLearning products, and business simulations
please visit hbsp.harvard.edu.
PROTOTYPING
CHOOSING THE RIGHT PROTOTYPING
TECHNIQUE FOR YOU
By Megan Crouse, Real-Time Digital Reporter
W
ith the addition of 3D printing
to a designer?s arsenal,
prototyping becomes quicker
and easier. Current 3D printers can
quickly create models from multiple
materials or from ultra-light plastic.
ZMorph CEO Przemek Jaworski and Guillermo Parodi,
owner of Draw2CNC, both have their fingers on the pulse
when it comes to what clients need from prototypes.
In his business, Jaworski saw that customers wanted the
most available material, as well as the cheapest, such as
ABS plastic. This allows for versatility and easy printing.
ABS is a good material for prototyping not just because it is
readily available, but also because it can be used for many
different types of pieces.
PLA, a bioplastic based on corn, is also a popular
material. There are a lot of possible setting techniques in
order to refine the part after it is printed. Post-processing
techniques including painting, smoothing, or sanding can
change the appearance and strength of the part, making it
smoother or rougher.
?Very often we can print parts with PLA and then use them
24
as molds for other types of materials. The actual plastic part
can be destroyed afterward,? Jaworski says. Alternatively, the
original part in this situation can be used as a mold in order
to create another version of the object with another material,
such as ceramics.
3D printing and digital fabricating is useful for prototyping
in other ways too. Objects larger than the surface area of
the printer can be built by assembling parts together using
acetone or adhesives.
Acetone, which is used to smooth out or dissolve the
crosshatched surfaces, can also make melted edges sticky,
enabling different parts to be stuck together. Removing the
part from the printer doesn?t necessarily have to be the last
step, Jaworski says.
By combining 3D printing with subtractive techniques
like CNC machining or laser cutting, there are even more
possibilities. A part that is milled, for example, from aluminum
can be combined with a printed part.
?You get a really, really strong part with some intricacies
of geometry from the part that is 3D printed. So you can
combine intricacy with strength,? Jaworski says.
Jaworski believes that one of the most underappreciated
parts of creating a prototype through 3D printing is acquiring
the 3D geometry. 3D models can be created by either the
client or the printing company using 3D scanners. No matter
what process one is using (CNC milling, 3D printing, or
MARCH 2016
15038-MPC PDD mag mar16.indd 24
29/02/2016 15:19
Image credit: ZMorph
something else) creating reusable models can save time.
3D blueprints ? probably made on one?s own in the case
of prototyping but also possibly based on a plan from a
manufacturer ? are needed in order to make the part and be sure
that its interior architecture can stand up to being printed. The
prototype will then be able to accurately reflect the stresses that
will be on the object when it enters the physical space.
Jaworski is always keeping an eye out for new materials.
Conductive materials, which allow electrical signals to flow
through them, might be the next big thing when it comes to
printing prototypes that not only accurately show a potential
product?s physical properties, but also its electrical properties.
For example, Jaworski says, a company could produce a
functioning robot in one piece.
?For now these conductive materials are of poor quality and
very expensive, so it?s not happening yet, but it will happen at
some point and things will change,? he says.
His interest in the next generation of printers also focuses on
the increased capabilities of desktop printers. The real key to
making 3D printing more common is to find a ?killer application?
which no one yet uses 3D printing for, he says. That could enable
people to print things at home and make printers an essential,
common part of life more than ever before. Jaworski predicts that
the key element of this change will not come from what materials
are used, but from what they are used for.
Guillermo Parodi, owner of Draw2CNC, a CNC machining
service, also weighs in on using CNC machines to create
prototypes. Most of his clients request small aluminum parts,
under 2 inches per side but with too much depth to produce on
a router. Interest in Teflon parts is also on the rise.
Draw2CNC uses a free CAD program to let clients see how
their product might be produced as a prototype using a CNC
machine.
Parodi says that the most important thing to look for when
considering using a CNC machine for prototyping is reliability.
Especially for professional shops, a machine must be able to
guarantee performance within the time reported to a client, and it
must be able to meet expected yield.
Someone who wants to use a CNC machine for personal use
might be less concerned about perfect reliability, but still needs
to find a machine within the right price that will work as much
and as efficiently as they need it to. Maximum volume must also
be taken into consideration. Draw2CNC uses a minimum of
3-axis machines, but some companies may need the fourth axis
depending on the type of work they do.
Both CNC machining and 3D printing, as well as a
combination of both and additional subtractive techniques, have
changed the way prototyping can be done in the modern era. The
most important elements have not changed, though ? a prototype
must accurately reflect the finished product and be flexible and
strong enough to undergo testing or display. Finding out what
method will work best for your business is just the first step.
www.pddnet.com
15038-MPC PDD mag mar16.indd 25
25
29/02/2016 15:19
Copyright of Product Design & Development is the property of Advantage Business Media
and its content may not be copied or emailed to multiple sites or posted to a listserv without
the copyright holder’s express written permission. However, users may print, download, or
email articles for individual use.
Special Issue on Artificial Intelligence, Paving the Way to the Future
Smoke Test Planning using Answer Set Programming
Tobias Philipp1, Valentin Roland1, Lukas Schweizer2 *
SINA Development and Verification Team, Division Defence & Space, secunet Security Networks
AG, Essen (Germany)
2
Computational Logic Group, Technische Universit?t Dresden, Dresden (Germany)
1
Received 10 November 2020 | Accepted 23 November 2020 | Published 10 February 2021
Abstract
Keywords
Smoke testing is an important method to increase stability and reliability of hardware-dependent systems. Due
to concurrent access to the same physical resource and the impracticality of the use of virtualization, smoke
testing requires some form of planning. In this paper, we propose to decompose test cases in terms of atomic
actions consisting of preconditions and effects. We present a solution based on answer set programming with
multi-shot solving that automatically generates short parallel test plans. Experiments suggest that the approach
is feasible for non-inherently sequential test cases and scales up to thousands of test cases.
Planning, Answer Set
Programming, Testing.
I. Introduction
Q
uick development-test-cycles are vital for the development
of functional and reliable software. Thus, it is considered bestpractice to frequently run a subset of regression tests, called smoke
tests, to catch as many issues as possible as early as possible [1]. In
contrast to regression testing, smoke tests lean towards minimizing
the time spent on a test run, sacrificing coverage if necessary. To
reduce overall run time, software tests are often run concurrently on
isolated instances of the system under test (SUT). This works well if
the software system can run on virtualized infrastructure, which can
be easily scaled.
However, some systems depend on real hardware and thus
virtualization is impossible. Furthermore, functional and performance
characteristics of a virtualized system may significantly differ from
operations on bare metal, which would render performance and load
tests meaningless.
In this paper we propose to decompose test cases into atomic
actions with preconditions and effects such that we can automatically
infer a suitable test plan that is short and parallel. Each action is a
small, specific instruction performed on the SUT, like ?boot system
X? or ?connect to host Y?. Preconditions describe the state of the SUT
in which an action is executable. Effects describe the changes of the
state of the SUT after successful execution of the action. Furthermore,
actions are associated with instructions determining their failure or
success.
In our proposed method, this information is given declaratively
to enable the automated generation of short parallel test plans. We
demonstrate that solving the planning problem can be done using
Answer Set Programming (ASP) and show that the system can solve
planning problems with thousands of actions on non inherentlysequential problems. The main benefits of this approach include:
1. Reduced overall execution times: Consider Fig. 1 that compares test
executions with automated planning to a predefined sequential
test plan in which a secure network connection is established,
user interface tests are performed and a certificate is exchanged.
Note that the parallel plan consists of four time points whereas the
sequential needs eight.
Smoke testing of hardware or hardware-dependent systems requires
some form of planning: A running test inevitably changes the state
of the SUT and thus the hardware state. Therefore, isolation of test
cases is difficult, since multiple tests may depend on the same physical
resources. Consequently, tests can neither be easily parallelized nor
chained and some execution strategy is required.
2. Maximal test execution: In case of failing tests, as many tests as
possible can be executed by replanning: Assuming that the action
?Host 2 Boot? fails, the predefined sequential test plan fails early,
whereas one can construct a new test plan that allows the continued
execution of tests that do not depend on host 2. Consequently, the
state of the SUT is preserved, no reboots are necessary and we do
not need to (re-)execute passed tests.
A straightforward solution is to bring the SUT to a clean state after
each test has run individually, e.g. by a cold reboot. For a number of
reasons, this is not satisfactory: Resetting the SUT to a known state is
often difficult or time-consuming. Issues, such as hidden assumptions
on the concurrent use of different SUT features, may not occur with a
strictly sequential execution.
* Corresponding author.
E-mail addresses: [email protected] (T. Philipp), science@
vroland.de (V. Roland), [email protected] (L. Schweizer).
DOI: 10.9781/ijimai.2021.02.003
3. Specification reuse: Declarative definition of actions and a flexible
planning framework allows reusing actions in regression tests,
integration tests, fixed scenarios or component-wise testing
trough different planning goals and constraints.
Due to the nature of testing we deal with uncertainty in the outcome
of actions as well as in the SUT state itself, which captures the ideas
of conformant planning [2]. Moreover, maximal test execution can
– 57 –
International Journal of Interactive Multimedia and Artificial Intelligence, Vol. 6, N?5
Fig. 1. Comparison of test execution with sequential and parallel plans, in the scenario of the action ?Host Boot 2? failing.
be seen as some form of oversubscription planning [3], which aims
to achieve as many sub-goals as possible instead of a conjunctively
defined (single) top-goal.
The paper is structured as follows: We briefly describe ASP in
Section II, before a formal description of smoke test planning is then
given in Section III. The ASP encoding and its correspondence to tests is
then presented in Section IV. In Section V, we present an experimental
evaluation on the basis of a family of benchmarks. Finally, we describe
related work and conclude.
II. Preliminaries
ASP is a declarative modeling and problem solving framework
that combines techniques of knowledge representation and database
theory. Two of the main advantages of ASP are its expressiveness
[4] and, when using non-ground programs, its advanced declarative
problem modeling capability. Such programs must be transformed to a
ground program prior to solving.
We review the basic notions of answer set programming [5] under
the stable model semantics [6], and refer to introductory literature [4],
[7], for a more comprehensive introduction.
We fix a countable set of (domain) elements, also called constants;
and suppose a total order < over the domain elements. An atom is an
expression p(t1, …, tn), where p is a predicate of arity n = 0 and each ti
is either a variable or an element from . An atom is ground if it is free
of variables. B denotes the set of all ground atoms over . A (normal)
rule ? is of the form
with m = k = 0, where a, b1, …, bm are atoms, and ?not ? denotes
default negation. The head of ? is the singleton set H(?) = {a} and
the body of ? is B(?) = {b1, …, bk, not bk+1, …, not bm}. Furthermore,
B+(?) = {b1, …, bk} and B-(?) = {bk+1, …, bm}. A rule ? is safe if each
variable in ? occurs in B+(r). A rule ? is ground if no variable occurs
in ?. A fact is a ground rule with empty body. An (input) database is
a set of facts. A (normal) program is a finite set of normal rules. For
a program ? and an input database D, we often write ?(D) instead of
D ? ?. For any program ?, let U? be the set of all constants appearing
in ?. Gr(?) is the set of rules ?s obtained by applying, to each rule ? ?
?, all possible substitutions s from the variables in ? to elements of U?.
An interpretation I ? B satisfies a ground rule ? iff H(?) n I ?
whenever B+(?) ? I, B-(?) n I ? . I satisfies a ground program ?, if
each ? ? ? is satisfied by I. A non-ground rule ? (resp., a program ?) is
satisfied by an interpretation I if I satisfies all groundings of ? (resp.,
Gr(?)). I ? B is an answer set (also called stable model) of ? if it is the
subset-minimal set satisfying the Gelfond-Lifschitz reduct ?I = {H(?)
? B+ (?) | I n B- (?) = , ? ? Gr(?)} [6]. For a program ?, we denote
the set of its answer sets by
(?).
We make use of further syntactic extensions, namely integrity
constraints and choice rules, which both can be recast to ordinary
normal rules as described in [8]. An integrity constraint is a rule ?
where H(?) = , intuitively representing an undesirable situation; i.e.
it has to be avoided that B(?) evaluates positively. Choice rules are of
the form l {a : a1, …, ai} u, where a is an atom and aj = pj or aj = not
pj, for aj an atom, 1 = j = i, l and u are non-negative integers, and the
expression {a : a1, …, an} denotes the set of all ground instantiations of
a, governed through {a1, …, an}. Intuitively, an interpretation satisfies a
choice rule, if l = N = u holds, where N is the cardinality of any subset
of {a : a1, …, ai}. In our encodings, we further use -a, to denote the
classical negation of an atom a, though ?-? is not an operator present in
the introduced language and merely represents syntactic sugar1.
Programs in this paper are given in the input language of Clingo
[9], a state-of-the-art system combining an ASP grounder and solver.
However, rule head and body are separated with ? instead of :- for
improved readability.
III. Smoke Tests as Planning Problems with Unknowns
In the following, we describe the smoke test planning and
optimization problem in terms of a planning problem in which the
state of SUT properties may be unknown and actions can be executed
in parallel. As executing many actions in a short time span is crucial,
we consider parallel plans. Here, we consider a new semantics based
on the ?-step semantics [10], in which actions may be executed
simultaneously, as long as they can be executed in any sequential
order resulting in a unique state.
A. The System State as Fluents
We describe the state of the SUT in terms of fluents that correspond
to atomic properties of the system. The set of fluents is a designated
subset of the set of terms . For instance, the fluent system_up(host1)
states that the machine host1 is running. In a system state , a fluent
f can hold, not hold or it may be unknown, whether f holds or not.
This is indicated by unary operators +, – and unknown for holds, does
not hold and unknown, respectively. If f is a fluent, then + f, – f and
1
Note that -a merely represents a special predicate name, and together with
an integrity constraint ? -a, a, the behavior of classical negation can be
emulated.
– 58 –
Special Issue on Artificial Intelligence, Paving the Way to the Future
unknown f are fluent literals. For instance, the fluent literal -system_
up(host1) denotes that host1 is not running. The set of all fluent literals
is referred to as
. Formally, we represent the state St of the SUT
at time t as a finite set of fluent literals. Initially, the presence of all
fluents is unknown, thus S0 = {unknown f | f ? }.
maps a set of fluent
The function fluents:
literals to the set of fluents occurring in that set. The function lits :
maps a set of fluents F to the corresponding set of
possible fluent literals {+ f, – f, unknown f | f ? F}.
B. Test Cases as Actions
Smoke test cases are usually specified at varying levels of
complexity and abstraction. A test describing a user interface
workflow is semantically different from testing a single button press.
To reason about SUT behavior for test planning, we need a unified,
fine grained view on how the system state is changed. Thus, we
decompose test cases into actions. Such actions represent small, selfcontained operations. In the context of the test planning problem, we
consider only the information relevant for planning.
Definition 1 (Action). An action a is a tuple (P, E, M), where
? P?
is a finite set of preconditions, which do not contain fluent
literals of the form unknown f,
? E?
is a finite set of effects, and
? M ? is a finite set of modifications, which is the set of fluents an
action may change if the action fails.
The set of all actions is denoted by . An action (P, E, M) is
executable in state if P ? , i.e. its preconditions are satisfied.
Definition 2 (Successor State). The successor state
executing a finite set of actions A, denoted by
as follows:
i+1
of i after
is defined
C. Plan Semantics
For all permutations (a1, …, an) of a set of actions At, their sequential
application
must always result in a unique
state G.
Definition 3 (Plan). A plan P for a set of actions
of slots P = ?A0, …, An?.
an action always holds during the execution of an action. If this is not
the case, the fluent must also appear in the set of modifications of that
action. Condition 4 guarantees that two actions running in parallel
do not modify fluents which are modified by another action. Thus,
their parallel execution is independent of each other, in particular in
case of failing actions. These conditions guarantee the prevention false
positive or false negative test results.
Note that by defining non-interference and executability in this
fashion, we model uncertainty in the SUT state as the third fluent state
unknown. This is different to approaches like conformant planning
[2], [11], where uncertainty in the initial state is modeled as a set of
possible states. While one could construct such a belief-state for a state
, the initial state is not the only source of uncertainty. Even when
successful, actions can introduce uncertainty through their effects:
For instance, consider an action which re-starts the SUT. While some
properties of the SUT will be known, some components may be in an
uninitialized state, thus the related fluents are made unknown in the
action?s effects.
D. Planning Goal
In contrast to classical planning problems in which a desired goal
state is to be reached, the goal in this paper is to find a shortest parallel
plan that executes all actions. We call such a plan complete. In the
case that there is no such plan as many actions as possible should
be executed, which can be seen as some form of oversubscription
planning [3]. While the system state determines which actions can
be executed at any point in time, there is no specified goal state. The
planning goal is a property of the plan itself, not of the system under
test.
Example 1. Consider an arrangement of two devices, where a subset
of the activities shown in Fig. 1 are tested: 1. The devices connect to
each via encrypted network connections, 2. each device connects to the
outside network, and 3. the devices stay connected if the encryption
parameters of their connection are changed. Consider the following
set of fluents that describe the relevant system properties and the
set of actions as described in Table I:
= {system_up(host1), system_up(host2)}
? toutside_up(host1), outside_up(host2)u
is a finite sequence
Intuitively, all actions must be executable when applied, are
mutually non-interfering, and each action a occurs at least once in a
slot At for some t ? {0 … n}.
,
2. {+ f | f ? P1} n {- f, unknown f ? E2} =
3. {- f | f ? P1} n {+ f, unknown f ? E2} =
4. (fluents(P1) ? fluents(E1) ? M1) n M2 =
? tconn_to(host1, host2), conn_to(host2, host1)u
We can obtain the plan Pe = ?A0, …, A3? with the following
considerations:
Definition 4 (Non-interference). Let a1 = (P1, E1, M1) and a2 = (P2, E2,
M2) be two actions. Then, a1 and a2 are non-interfering, if the following
mutually holds:
1. fluents(E1) n fluents(E2) =
? tenc_conn_up(host1), enc_conn_up(host2)u
,
, and
.
Intuitively, the conditions describe the following: Condition 1.
excludes concurrent modification of system properties. From the point
of view of classical planning, this constraint seems too restrictive as it
disallows executing actions in parallel although any order of execution
results in the same final state [10]. However, in the context of smoke
testing, actions represent state transitions of physical systems and
fluents describe its properties. Therefore, a change of the presence
of a fluent indicates concurrent access to physical resources that
may be unsafe. Conditions 2. and 3 ensure that no action affects the
precondition of other, concurrently executed actions. This assumes
that a fluent literal which is present in the precondition and effects of
– 59 –
? In state S0 = {unknown f | f ? }, we can see that only boot(host1)
and boot(host2) are executable in A0. Since precondition and
modifications are empty, 2, 3 and 4 are satisfied. As both
actions each only affect one of the hosts, respectively, they are
also non-interfering. Thus, we can schedule both actions in
A0 = {boot(host1), boot(host2)}
? With
{+system_up(host1), unknown enc_
conn_up(host1)},
the
actions
connect_en-crypted(host1),
connect_encrypted(host2),
connect_out-side(host1)
and
connect_outside(host2) get executable. Through checking for noninterference, we can see that they can all be scheduled for A1.
? In 2, change_conn(host1) as well as change_conn(host2) are
executable. However, they mutually interfere due to conditions 1
and 4. Thus, we need to schedule them sequentially, for instance as
A2 = {change_conn(host1)} and A3 = {change_conn(host2)}.
? The resulting plan Pe = ?A0, …, A3? is a shortest plan.
International Journal of Interactive Multimedia and Artificial Intelligence, Vol. 6, N?5
TABLE I. Representation of the Example in Terms of Actions. The Variables H1, H2 ? {host1, Host2} Are Placeholders for Any Concrete Host,
Where H1 and H2 Are Distinct
Action
Precondition P
Effects E
Modifications M
+ system_up(H1)
unknown enc_conn_up(H1)
unknown outside_up(H1)
unknown conn_to(H1, H2)
boot(H1) ? Boot up H1.
connect_outside(H1) ? H1 initiates an (unencrypted) connection to an outside network.
+ system_up(H1)
+ outside_up(H1)
connect_encrypted(H1) ? H1 initiates an encrypted connection to the other host H2.
+ system_up(H1)
+ conn_to(H1, H2)
+ enc_conn_up(H1)
change_conn(H1) ? H1 initiates a change of
encryption parameters, e.g. renews a certificate.
+ system_up(H1)
+ enc_conn_up(H1)
+ conn_to(H1, H2)
+ conn_to(H2, H1)
+ conn_to(H1, H2)
+ conn_to(H2, H1)
E. Replanning
Consider a plan ?A0, …, At-1, At, At+1, …, A ?, the corresponding states
, …, and suppose action e = (P, E, M) in At fails. In the case that E
= and M = , the SUT state is consistent with the plan. Otherwise,
actions in the slots At+1, …, A could be non-executable and therefore,
a new plan involving as many actions as possible that have not been
executed is generated.
0
enc_conn_up(H1)
enc_conn_up(H2)
conn_to(H1, H2)
conn_to(H2, H1)
supplying initial conditions and goal condition via external atoms. We
use the atoms as presented in Table II to encode the planning program
which is divided into four subprograms: the instance program, the base
program, the transition program, and the goal program.
TABLE II. ASP Predicates and Their Meaning: I Denotes May Atoms
That May Be Added Incrementally, E Denotes May External Atoms
Replanning follows the same rules outlined in Section C, but with
a different initial state. Intuitively, the new initial state is constructed
by applying the successful actions as scheduled in previous plan, but
making any fluent the failed action may have changed unknown.
Formally, let Faffected = fluents(Ee) ? Me. Then, the new initial state is
derived from the system state t-1 before the action failed as follows:
F. Finding Maximal Runnable Subsets
A complete plan may not exist, in particular in case of replanning as
a failed test is excluded. For instance, an action that cannot be executed
because all sequences of actions making its precondition true contain
some action which has already failed. However, with the overall goal
to quickly execute as many actions as possible, a partial plan can be
constructed instead, which executes as many outstanding actions as
possible. We can exploit the flexibility of a declarative approach to
obtain such a maximal partial plan, by maximizing a score function
instead of solving for satisfiability of a set goal. As a score function
for a plan P of length n, we use the number of distinct outstanding
actions g