\subsection{Distance-based Optimization}

In this scenario, the policy optimization process is based on the total traveling distance of all the agents, i.e., the optimizer aims to minimize the traveling distance when optimizing the policies. We verify our optimizer with 2 cases: one without the simulation but the accumulated Euclidean distance by traversing all the items in the shopping list, while the other using live simulations to collect the actual translation data of the agent model traveling in the 3D environment.

The experiments are conducted as follows. To calculate the Euclidean distance without running the simulation, we generate a random shopping list with $i$ shopping items, then accumulate the path length from the entrance to the 1st item, then from the 1st item to the 2nd, etc., eventually from the $(i-1)$-th item to the $i$-th item. Similarly, for the simulation-based experiment, the path length is calculated by sampling the positions of the agents by each frame.

The results in Figure \ref{fig:unittest} show that the optimization approach we used can be applied to the traveling distance data collected via simulation. The shaded part of the optimization curve shows the range of traveling distance of all the children in the current generation. As is shown in the graph, starting from a directional policy (\ref{subfig:init_dist}), both experiments reduce the total travel distance as the optimization proceeds. Both experiments show similar convergence rates, the variance of the simulation experiment is larger and the convergence speed is slower. A possible reason causing such variance is the simulation artifacts. The traveling distance is calculated by accumulating the translation of the agents by each frame, which is influenced by the position sampling interval, locomotion, and animation system. A higher sampling rate can help record the data with higher accuracy.

\begin{figure}
  \centering
    \begin{subfigure}[h]{1.0\linewidth}
    \centering
        \begin{subfigure}[h]{0.5\linewidth}
            \centering
            \includegraphics[width=\linewidth]{images/simple/begin.png}
            \caption{Initial graph}
            \label{subfig:init_dist}
        \end{subfigure}
    \end{subfigure}

    \begin{subfigure}[h]{1.0\linewidth}
      \begin{subfigure}[h]{0.49\linewidth}
        \centering
        \includegraphics[width=\linewidth]{images/simple/curve_theory.png}
        \caption{Static convergence curve}
        \label{subfig:opt_proc_th}
      \end{subfigure}
      \hfill
      \begin{subfigure}[h]{0.49\linewidth}
            \centering
            \includegraphics[width=\linewidth]{images/simple/end_theory.png}
            \caption{Static optimized graph}
            \label{subfig:opt_dist_th}
      \end{subfigure}
    \end{subfigure}

    \begin{subfigure}[h]{1.0\linewidth}
        \begin{subfigure}[h]{0.49\linewidth}
            \centering
            \includegraphics[width=\linewidth]{images/simple/curve_sim.png}
            \caption{Simulated convergence curve}
            \label{subfig:opt_proc_sim}
        \end{subfigure}
        \hfill
        \begin{subfigure}[h]{0.49\linewidth}
            \centering
            \includegraphics[width=\linewidth]{images/simple/end_sim.png}
            \caption{Simulated optimized graph}
            \label{subfig:opt_dist_sim}
        \end{subfigure}
    \end{subfigure}

    \caption{\ref{subfig:init_dist} shows the initial policy graph with uni-directional edges for the optimization, \ref{subfig:opt_dist_th} shows an optimal policy optimized for static distance (theoretical), \ref{subfig:opt_dist_sim} shows an optimal policy optimized for simulated distance, \ref{subfig:opt_proc_th} shows the objective convergence for \ref{subfig:opt_dist_th}, and \ref{subfig:opt_proc_sim} shows the objective convergence for \ref{subfig:opt_dist_sim}.}
    \label{fig:unittest}
\end{figure}

\subsection{Virtual Retail Environment}

We created a virtual grocery store that resembles a typical configuration of a grocery market with vertically aligned shelves and horizontal hallways. Based on a constant occupancy setting, we conducted a complete simulation-optimization experiment to search for the optimal policy for this scenario. The optimization starts with the graph that consists of no directional constraints, as is shown in Figure \ref{subfig:begin_graph}. This is considered as the baseline case for a store environment: normally, all customers can move in the store freely in any direction. Apparently, this policy can potentially cause jamming and blockage, leading to a high \ac{SDI} value.

During the simulation, the environment is initially empty, and the agents start entering and conduct their shopping behaviors by visiting each target item shown in their shopping lists. When the occupancy load is reached, no more agents are allowed to enter, until any agent in the scene finishes the checkout behavior and exits the scene. Figure \ref{fig:sim_vis} shows 3 typical states of one simulation session: agent entering, shopping, and exiting.

The experiment uses 1 edit distance to produce the children of every generation, and the size of each generation is 5. The window size $w$ is 20 and the stopping threshold is $10^{-5}$. We run the simulation for a simulated time of 30 seconds of each scenario to collect data for the \ac{SDI} model, then the optimizer decides the graphs to use for the next iteration using the returned result of SDI. The optimization process finished in 93 generations. As is shown in Figure \ref{subfig:exp_curve}, The results show that our optimization process reduced \ac{SDI} by about 20\%. Similar to \ref{subfig:opt_dist_th} and \ref{subfig:opt_proc_th}, the shaded area shows the range of the \ac{SDI} values of all the children in a generation.

\begin{figure*}[h!]
  \centering
  \begin{subfigure}[b]{0.55\linewidth}
      \begin{subfigure}[b]{0.44\linewidth}
        \centering
        \includegraphics[width=\linewidth]{images/exp1_begin.png}
        \caption{Beginning state of the graph}
        \label{subfig:begin_graph}
      \end{subfigure}
      \hfill
      \begin{subfigure}[b]{0.50\linewidth}
        \centering
        \includegraphics[width=\linewidth]{images/heat_begin.png}
        \caption{Initial heatmap (agent positions)}
        \label{subfig:begin_heat}
      \end{subfigure}

      \begin{subfigure}[b]{0.44\linewidth}
        \centering
        \includegraphics[width=\linewidth]{images/exp1_end.png}
        \caption{Optimized policy}
        \label{subfig:end_graph}
      \end{subfigure}
      \hfill
      \begin{subfigure}[b]{0.50\linewidth}
        \centering
        \includegraphics[width=\linewidth]{images/heat_end.png}
        \caption{Final heatmap (agent positions)}
        \label{subfig:end_heat}
      \end{subfigure}
  \end{subfigure}
  \hfill
  \begin{subfigure}[b]{0.4\linewidth}
    \centering
    \includegraphics[width=\linewidth]{images/exp1_curve.png}
    \caption{Optimization process}
    \label{subfig:exp_curve}
  \end{subfigure}
  \caption{The policy optimization example of a virtual retail store. \ac{SDI} is used as the optimization scoring metric. \ref{subfig:begin_graph} shows an initial policy graph, \ref{subfig:begin_heat} shows the starting heatmap of agent positions, \ref{subfig:end_graph} shows the optimized policy, \ref{subfig:end_heat} shows the ending heatmap of agent positions, and \ref{subfig:exp_curve} shows the objective convergence.}
  \label{fig:experiment_simple}
\end{figure*}

\begin{figure*}[h!]
  \begin{subfigure}[b]{0.33\linewidth}
    \centering
    \includegraphics[width=0.75\linewidth]{images/sim_1_start.png}

  \end{subfigure}
  \hfill
  \begin{subfigure}[b]{0.33\linewidth}
    \centering
    \includegraphics[width=0.75\linewidth]{images/sim_2_shopping.png}

  \end{subfigure}
  \hfill
  \begin{subfigure}[b]{0.33\linewidth}
    \centering
    \includegraphics[width=0.75\linewidth]{images/sim_3_exit.png}

  \end{subfigure}
  \caption{Simulation snapshots: (Left) In the beginning, agents are entering the facility, (Middle) During the simulation, agents are shopping the items following the policies, and (Right) At the end, agents are gradually finishing up the shopping and starting to queue up at the checkout counters.}
  \label{fig:sim_vis}
\end{figure*}

\subsection{Graph-based Representation of Crowd Management Policies}
\label{subsec:graph-based-representation}

We propose a graph representation of the directional policies enforced in the environment using a tuple of directed graphs $<g,h>$. The graphs are represented with nodes and directed edges. Each tuple of graphs contains (i) a \textit{structural} graph $g$ and (ii) a \textit{navigational} graph $h$.

\begin{table}
    \centering
    \small
    \begin{tabular}{c|c||c|c}
        \hline
        Symbol & Notation & Symbol & Notation\\
        \hline
        $h$ & Time factor & $m$ & Min distance\\
        $q$ & Max distance & $t$ & Time\\
        $O_{L}$ & Occupancy load & $e, e_{ij}$ & Edge\\
        \hline
        $g,g_c$ & Structural graph & $G,G_c$ & Set of $g,g_c$\\
        $h$ & Navigational graph & $H$ & Set of $h$\\
        $n,n_i$ & Node & $N,N_g,N_h$ & Set of $n,n_i$\\
        \hline
    \end{tabular}
    \caption{Symbols used in this paper.}
    \label{tab:term}
\end{table}

For each environment, a \textit{structural} graph is a static and abstract model that describes the high-level features of the environment, i.e., the directional policies enforced on the edges and the key nodes in the environment. Such key nodes in the structural graph represent significant locations in the environment, e.g., the entrance, the exit, or a joint location of paths. An edge in the graph is considered as an abstract relation between two nodes, i.e., a policy that allows the agent to pass from one node to the other, or forbids such motion. These policies enforce that traveling between any two nodes can only be either bi-directional, single-way, or blocked (disjoint).

\begin{figure}[htbp]
  \begin{subfigure}[b]{\linewidth}
    \centering
    \includegraphics[width=0.8\linewidth]{images/graphs.pdf}

    \label{subfig:navgraph}
  \end{subfigure}
  \par \medskip
  \begin{subfigure}[b]{\linewidth}
    \centering
    \includegraphics[width=0.75\linewidth]{images/SplitScreenAgents.JPG}

    \label{subfig:splitscreenagent}
  \end{subfigure}
  \caption{(Top) Example of nodes and edges for the structural and navigational graphs. There are $2$ structural nodes $A$ and $B$ with a directional edge from $A$ to $B$. Along this edge, there are $6$ navigational nodes ($AB_1,AB_2\ldots,AB_6$) and $16$ corresponding navigational edges connecting them. (Bottom) During simulation, the agents will follow the direction for pathfinding. The colored arrows represent the directional policies (e.g., $\textit{Green} \rightarrow \textit{Red}$).}
  \label{fig:graphs}
\end{figure}

Based on the structural graph, we dynamically generate a corresponding \textit{navigational} graph during runtime for the pathfinding of the agents.
Nodes in the navigational graph contain detailed navigation points of interest such as a specific shopping item. The navigational edges enumerate all possible paths between any two nodes in the structural graph so that when any agent traverses from one node to another, they can also approach a target shopping item without violating the policies. Figure \ref{fig:graphs} shows the relationship and difference between the structural and navigational graphs.

\subsection{Human Behavior Simulation} \label{subsec:hbs}

The human behavior simulation (also known as crowd simulation) uses a Unity-based framework, ADAPT~\cite{kapadia2014adapt}, to design and author meaningful animation, navigation, and agent behaviors in virtual environments. The framework consists of three layers: (i) a goal-directed locomotion and collision avoidance layer, (ii) a navigation layer for path planning, and (iii) a behavior tree layer for parameterized agent behaviors.

\subsubsection{Locomotion and collision avoidance.} This layer controls the steering capabilities of the agents in the virtual environment. It uses ORCA (Optimal Reciprocal Collision Avoidance)~\cite{van2011reciprocal} to find the optimal velocities for the agents using gradient descent. It communicates with the navigation layer for agents' path planning. Certain crowd steering configurations such as walking speed, stopping conditions, and maintaining social distances are also set in this layer.

\subsubsection{Path planning.} The planning layer uses Unity's AI system for pathfinding in the environment. To compute the path from any two nodes in the graph, our nagivational graph first breaks the path down into small trajectory snippets, then for each trajectory snippet, we provide its starting and ending position to Unity's navigation system to conduct the actual locomotion. The navigation graphs are meticulously designed that any trajectory snippet is small enough to prevent the agents from violating the policies.

\subsubsection{Behavior tree.} The behavior tree layer defines all the permissible actions that agents can perform during the simulation. These actions include walking, shopping, queuing, and entering/exiting the environment. The behavior tree layer is also responsible for scheduling and managing the sequence of behaviors that agents carry out during the simulation in an ordered fashion. Please refer to~\cite{shoulson2011parameterizing} for more details on the underlying implementation and authoring of behavior trees. \newline

In the simulation process, we first load the environment model. All the furniture items (e.g., item shelves and checkout counters) are then procedurally generated. Next, the agents are initialized at the entrances. Initially, there is no agent present in the environment. We gradually let the agents enter the facility at a varying rate until the capped maximum capacity of the environment is reached. Afterward, a new agent is spawned only when an existing agent leaves the environment after performing the assigned behaviors. When an agent is spawned in the environment, it is given a list of randomly generated shopping items. The agents' tasks are to shop all the items from the list by traversing the environment and obeying any enforced navigation policies. Once all the items are obtained, the agent queues up at the checkout counter to pay for the items, and exits the environment. In our experiments, we scaled up the simulation speed for higher runtime efficiency.

\subsection{Spatial Distancing Index} \label{subsec:sdi}

We present \ac{SDI} as a function of the occupancy load over time for the given environment. The \ac{SDI} considers the ability to maintain distances between the occupants, and for a given design (and its navigation policy), the ability to maintain distances at the various occupancy loads allowed in the environment space. For more details, see Section~\ref{sec:sdi}.

\subsection{Optimization}

Based on the graph representation of the policies, we devise a hybrid optimization process using the genetic algorithm (GA) and simulated annealing (SA) to approach the optimal policy with the best value of SDI or another arbitrary measuring metric. Details about the optimization framework and implementation of the algorithms are elaborated in Section \ref{optimization}.

\subsection{Optimization Formulation}

Given the structural policy graph $g$ and a specified occupancy load parameter $O_L$, the optimization problem is formulated as
\[\argmin_{e_{ij}\in G} L(g|O_L)\text{ s.t. } \forall v_{i},v_{j}\in g,v_{j}\in R_{G}(v_i)\]
where $e_{ij}$ is an edge connecting nodes $v_i$ and $v_j$ in the structural graph $g$, and $L(g|O_L)$ can be an arbitrary scoring metric that measures the performance of the graph, e.g., $L(g)\coloneqq \texttt{SDI}(G|O_L)$. $R_G(v_i)$ is the set of all the strongly connected components of $v_i$.

In other words, our optimization process minimizes the target function by changing the state of the edges, while maintaining the strong connectivity of the structural graph. As an NP-optimization (NPO) problem, this process is an NP-complete combinatorial optimization that requires probabilistic methods (e.g., simulated annealing) to approach the optimal.

\subsection{Optimization Approach}

Due to the NP complexity with regard to the number of nodes in the graph, we use a mixed approach by combining GA and SA to search for the optimal policy. Our GA-SA approach is based on a few definitions and assumptions.

\subsubsection{Edit Distance}

Given two isomorphic structural graphs $g_1$ and $g_2$, the edit distance $d(g_1,g_2)$ is defined as the total number of edge edits to make $g_1$ and $g_2$ identical. Formally,
$$d(g_1,g_2)=\sum_{e_{ij}\in g_1,e'_{ij}\in g_2}{d_e(e_{ij},e'_{ij})}.$$
Given two isomorphic edges, the edit distance value $d_e(e_{ij},e'_{ij})$ is defined by Figure \ref{fig:edit_dist}, which shows a total of 4 possible states of edges between nodes $n_1$ and $n_2$: (i) $n_1\rightarrow n_2$, (ii) $n_1\leftrightarrow n_2$, (iii) $n_1\quad n_2$, and (iv) $n_1\leftarrow n_2$. The solid lines mark 1 edit between states, while the broken lines mark 2 edits, e.g., the cost from state (i) to (ii) requires 1 edit, and that from state (i) to (iv) requires 2 edits.

\begin{figure}
  \centering
  \includegraphics[width=.6\linewidth]{images/edit_distance.pdf}
  \caption{Definition of the edit distance for a pair of isomorphic edges. Edges with shorter edit distance are considered as more similar.}
  \label{fig:edit_dist}
\end{figure}

\subsubsection{Similarity Monotonicity}

We assume that graphs with greater similarity yield closer \ac{SDI} values. Formally, given graphs $g,g_1,g_2$ and an arbitrary mapping function $f(g):g\rightarrow\mathbb{R}$, we have
$$d(g,g_1)\leq d(g,g_2)\Rightarrow|f(g)-f(g_1)|\leq|f(g)-f(g_2)|.$$
That said, given a graph $g$ and its corresponding score $s_g$, we will get larger score difference if we apply more edge edits on $g$. Note that we assume ``greater similarity'' is just sufficient to conclude ``smaller difference,'' so this assumption is not reversible: we don't assume that graphs are more similar \textit{due to} smaller \ac{SDI} difference.

\subsection{Algorithms}

Based on the formulation above, we propose this GA-SA method, described in the following algorithms. The pipeline of the optimization process is described in Algorithm \ref{alg:overview} and Figure \ref{fig:optim_pipe}, and detailed implementation of some functions are expanded in Algorithm \ref{alg:production}.

\begin{algorithm}
\small
  \SetKwInOut{Input}{input}
  \SetKwInOut{Output}{output}
  \SetAlgoNoEnd

  \Input{Structural graph $g_0$, Children count $n_c$, Edit distance $d$, Window size $w$, Optimization threshold $\hat{t}$, SA scalar $a$}

  $g\gets g_0$\tcp*[f]{Initial graph}\\
  $n\gets0$\tcp*[f]{Generation counter}\\
  $m_0\gets0$\tcp*[f]{Average SDI of most recent $w$ generations}\\
  $m_{-1}\gets0$\tcp*[f]{Average SDI of previous $w$ generations}\\
  $S\gets\emptyset$\tcp*[f]{Array of the final SDI of each generation}\\
  \While{$n<w$ \textbf{or} $n\geq w$ \textbf{and} $\frac{|m_0-m_{-1}|}{m_{-1}}>\hat{t}$}{
    $G\gets Produce(g,n_c,d)$\\
    \For{each $g'\in G$}{
      $h\gets Populate(g')$\tcp*[f]{A new navigational graph}\\
      Run simulation based on $h$\\
      Calculate \ac{SDI} of $g'$
    }
    \If{$Random(0,1)<a\exp(-\frac{1}{n})$}{
      $g\gets g'\in G$ with best \ac{SDI}\tcp*[f]{Conditional accepting}
    }
    $S\gets S\cup\{\text{ SDI of }g\}$\tcp*[f]{Save final SDI of generations}\\
    $n\gets n+1$\\
    \If{$n>w$}{
      $m_{-1}\gets m_0$\\
      $m_0\gets\frac{1}{w}\sum_{i=n-w}^{n}{s_i\in S}$\tcp*[f]{Average SDI}
    }
  }
\caption{Optimization iteration overview. We start with the initial graph $g_0$ and produce a generation of size $n_c$, then run the simulation with each child and get their corresponding \ac{SDI} values. We pick the best child as the parent for the next generation with a probability, and terminate the optimization process when the SDI value doesn't change significantly.}
\label{alg:overview}
\end{algorithm}

When starting the optimization process, we run the optimization process on the first $w$ generations of graphs. Starting from the $n$-th generation ($n\geq w+1$), we keep track of the mean value of the best \ac{SDI} scores of the recent $w$ generations and that of the $(n-1)$-th generation. When a generation is finished, we check if the value change is greater than a threshold and if so, the optimization process is considered ended.

As is shown in Figure \ref{fig:graphs}, the $Populate(\cdot)$ function processes the structural graph with the following steps:

\begin{enumerate}
  \item Inherit all the nodes in the structural graph to the navigational graph;
  \item Populate navigation nodes between the structural nodes with proper information, i.e., coordinates and item tags;
  \item Connect item nodes with joint nodes with edges complying to the policies defined in the corresponding structural graph.
\end{enumerate}

The navigational graphs are only used during the simulation and to calculate the scores of the graphs, and hence are discarded when the current iteration is over and will not be carried to the next generation.

The production function uses the GA method to generate new graphs in the next generation. In the $RandomizeState(\cdot)$ function, the state of the edge will mutate according to the transition relationship shown in Figure \ref{fig:edit_dist}. There are four states that the edges $e$ connecting nodes $n_1$ and $n_2$ can mutate to, and the edge must mutate to one of the rest 3 states where it is not currently in.

\begin{algorithm}
\small
  \SetKwInOut{Input}{input}
  \SetKwInOut{Output}{output}
  \SetAlgoNoEnd

  \Input{Base structural graph $g$, Sibling count $s$, Edit distance $d$}
  $n\gets 0$\\
  $G'\gets\emptyset$\\
  \While{$n\leq s$}{
    $n_e\gets0$\\
    $g'\gets\emptyset$\\
    \While{$n_e\leq d$}{
      Randomly pick one edge $e\in g$\\
      $e'\gets RandomizeState(e)$\tcp*[f]{Mutate edge}\\
      $n_e\gets n_e+d_e(e,e')$\\
      $g'\gets g'\cup\{e'\}$\\
    }
    \If{$g'\in G'$ \textbf{or} $g'$ is not strongly connected}{
      \textbf{continue}\\
    }
    $G'\gets G'\cup\{g'\}$\\
    $n\gets n+1$\\
  }
  \Return{$G'$}\\

\caption{Production function $Produce(\cdot)$. This function mutates the parent graph and generates all the children structural graphs for the next simulation sessions.}
\label{alg:production}
\end{algorithm}

When all the children from the current generation finish simulation and evaluation, all the SDI values are used by the optimizer to decide whether to accept the best-performed children as the parent for the next generation or reject it with a threshold and keep the original parent. The threshold decreases as the generation counter increase. This process uses the concept of conditional acceptance in the SA approach, as is shown in line 12--13 of algorithm \ref{alg:overview}, to prevent the algorithm from falling into a local optimum.

\section{Introduction} \label{sec:intro}
\input{sections/introduction}

\section{Related Work} \label{sec:related}
\input{sections/related_work}

\section{Overview and Preliminaries} \label{sec:overview}
\input{sections/methodology}

\section{Spatial Distancing Index} \label{sec:sdi}
\input{sections/sdi_metric}

\section{Optimization Framework} \label{optimization}
\input{sections/optimization}

\section{Evaluation and Case Study}\label{sec:eval}
\input{sections/evaluation}
\input{sections/experiments.tex}

\section{Conclusion}\label{sec:conclusion}
\input{sections/conclusion}

\begin{acks}
This research has been partially funded by grants from ISSUM, and in
part by NSF awards: IIS-1703883, IIS-1955404, and IIS-1955365.
\end{acks}
\bibliographystyle{ACM-Reference-Format}


\section{Conclusions and Future Work}
\label{sec:conclusions}
In this paper, we have presented \emph{RESAM~} as a systematic approach for discovering, specifying, and analyzing requirements for DLMs. Diagnostic information provided by formal documentation was augmented by expert opinions shared in online discussion forums. We combined the information from both sources to discover and specify requirements for anomalies related to vibration, mechanical problems, compass interference, GPS glitches, and power problems. We then leveraged this information to design and train  LSTM time-series models for three failure types and compared the results to rule-based anomaly detectors. Our evaluation showed that the requirements specified as a result of the \emph{RESAM~} were sufficient for guiding the construction of effective anomaly detectors. Furthermore, we observed that the expert knowledge obtained from the forum discussions led to anomaly detectors that outperformed the ones based on recommendations from the formal documentation alone.
Finally, we have laid out a series of open challenges including automated support for mining discussion forums, exploring more diverse algorithms, providing explanations for the identified anomalies, and specifying and analyzing non-functional requirements to guide the architectural decisions of the anomaly detectors.

 \section*{Acknowledgments}
This work is primarily funded by the USA National Aeronautics and Space Administration (NASA) under grant number: 80NSSC21M0185.

\bibliographystyle{IEEEtran}
\interlinepenalty=10000

\section{Related Work}
\label{sec:related}
Our research differs from a large body of previous work which has used ML or AI techniques to enhance the general requirements engineering process for specifying, analyzing, and prioritizing requirements in traditional software systems \cite{ml4re1,ml4re2,ml4re3}. In more closely related work, Vogelsang and Borg interviewed four data science experts and identified three key considerations for requirements engineering of ML based systems. These included understanding  qualitative measures specific to ML, addressing new requirement types such as explainability and freedom from discrimination, and generally adapting the RE process for ML \cite{DBLP:conf/re/VogelsangB19}. While their work generally discussed the importance of selecting suitable training data, it did not address the challenges of multi-variate time-series data. Heyn et al., studied AI-intensive Systems Development and identified four RE challenges regarding requirements specification of context, data quality, performance and impact of human factors \cite{wain}. Belani et al., discussed the RE challenges for AI systems and outlined the 'RE4AI' taxonomy for tailoring the AI development process \cite{re4ai}. Finally, Horkoff explored the specification of non-functional requirements (NFR) such as performance, reliability, and maintainability for ML based systems \cite{NFR}. This is relevant to \emph{RESAM~} although in this paper we have focused on functionality rather than NFRs. This prior work, which is based on interviews and surveys, discusses the challenges of requirements engineering for ML based systems but does not offer a concrete requirements engineering process for engineering AI-based systems, especially those using time-series data.

We also briefly discuss related work in anomaly detection of time-series data where a large body of prior work exists. Proximity based approaches such as \textit{K}-nearest neighbors \cite{hautamaki2004outlier} and clustering-based methods \cite{cluster, OCSVM} have been proposed as solutions but
these classifiers do not treat the data as a time-series, rather they treat every sample as a discrete point. Statistical methods \cite{brockwell2009time,https://ARIMA-SARIMA,sarima} capture temporal dependencies, however they are not robust to noise. Deep learning techniques \cite{DL_anomaly, DL_anomaly2}, including  Recurrent Neural Networks (RNN) or Long Short-term Memory (LSTM) structures have been especially popular in time-series anomaly detection because of their ability to capture the patterns of time-series \cite{LSTM-RNN}. LSTM overcomes some of these problems with RNN on long sequences such as the vanishing and exploding gradient problems \cite{tanh,rnndiff}. Using deep learning based autoencoder \cite{autoencoder3,autoencoder1} for anomaly detection has proven to be successful in recent times. LSTM autoencoders have been proven to be very effective in detecting anomalies in time-series data \cite{LSTMAuto}. While out of scope of this paper, we have explored other DL models (e.g., Autoencoder Neural Networks \cite{ann}) to investigate performance vs. accuracy tradeoffs, and will build further on this in our future work.
Further, we are simultaneously exploring a richer multi-variate approach which takes massive amounts of time-series data as input and learns to detect all anomalous behavior but then leverages our \emph{RESAM~} to provide human-understandable explanations of the anomalies. This body of work tends to focus upon the actual time-series models without exploring the fundamental requirements engineering processes that are necessary for designing models that meet stakeholders' requirements.

\section{Applying RESAM to an sUAS Flight Controller}
\label{sec:uavstudy}

We illustrate and evaluate our approach in the domain of sUAS flight controllers \cite{sensing, surveillance1}, where the growing number of sUAS has led to a rapid escalation of incidents \cite{accident1, accident2}.  {Our targeted stakeholders primarily include remote pilots in command (RPICs), sUAS maintainers, and accident investigators.} Many flight incidents have occurred due to faults caused by GPS glitches, incorrect configurations, or mechanical problems. When problems are experienced, remote sUAS pilots use software applications, such as QGroundControl \cite{qground} and MissionPlanner \cite{mplanner} to inspect the flight logs in an attempt to diagnose the problem. However, given thousands of configuration parameters and sensor readings in typical flight controllers, these tools tend to focus on common failure cases whilst lacking specific information about data attributes, acceptable threshold values, and multivariate patterns that are symptoms of emergent problems. As a result, remote pilots (many of them hobbyists) often struggle to interpret flight log data, and often resort to posting their flight logs on open-source forums in order to get advice from experts. As experts are often able to quickly pinpoint the root cause of the failure, our goal is to leverage their advice from the discussion forums, to specify, design and construct DLM anomaly models.  We focus on the \emph{Ardupilot} \cite{ardupilot} flight controller, as it represents one of the most popular open-architecture flight control stacks.

\subsection{Analyzing Formal Documentation (S4)}
The Ardupilot documentation provides a clear list of common failures found under two categories of {\it Problem Diagnosis}\footnote{
\url{https://ardupilot.org/copter/docs/common-diagnosing-problems-using-logs.html}} and {\it Prearming safety checks}\footnote{\url{https://ardupilot.org/copter/docs/common-prearm-safety-checks.html}}. We list these in Table \ref{tab:fault_types} as common {diagnosis} problems (CP) and safety checks (SC) respectively. The most common diagnosis problem include  excessive vibration,  mechanical failure,  power issues,  GPS failures,  compass interference, and  failsafe errors.  The ArduPilot documentation on safety checks (SC) describes several problems also covered in the Problem Diagnosis explanations. In addition it describes  Barometer failures,  Compass failures, and Inertial Navigation System failures. For each of these failure types, we retrieved lists of attributes and ranges of their values that served as indicators or symptoms of the failure.

The Ardupilot documentation also provides mappings between some of the failure types and specific attributes that serve as {\it indicators} of failure.
 It documents 19 different groupings of attributes, such as
ATT (Attitude), CTUN (Control, Throttle, and altitude), and
IMU (Accelerometer and gyro information). Each group contains from 1 to 20 attributes. For example, ATT includes actual and desired values for Roll, Pitch, and Yaw; while CTUN includes ThO (throttle). While the documentation provides mappings from failures to specific attributes, details are often sparse.  For example, in cases such as {\it Gyros not healthy}, the problem is described as ``One of the gyroscopes is reporting it is unhealthy which is likely a hardware issue''; however no attributes are listed as indicators of poor gyro health. In many cases the documentation failsto describe normal thresholds or ranges, most likely because these are expected to vary across different models of sUAS. As a stand-alone knowledge source, it therefore lacks sufficient details for guiding the development of a broad set of DLM for purposes of anomaly detection.

\input{tables/faults.tex}
Given insufficient documentation, RPICs are often confused about the underlying root cause of a problem.  For example, one person posted a comment to the Ardupilot forum (with expletives removed) saying that ``I am afraid to arm because all kinds of warnings pop up: at first it was HIGH GPS HDOP..., then ALT DISPARITY... : BAD GYRO HEALTH.... {\bf I have no idea what to do.}'' Forum experts were able to discuss and diagnose this problem as a power supply issue, meaning that none of the actual error messages were directly related to the diagnosis. In general we found that the Ardupilot documentation provided information about the most common causes of failures, whilst ignoring edge cases which occur frequently enough to cause problems in practice.

\subsection{Analyzing Forum Discussions (S5)}
Given these limitations, we conducted a systematic search of issues in Ardupilot discussion forums\footnote{\url{https://discuss.ardupilot.org}} with the aim of augmenting the information provided in the formal documentation in order to identify and specify clear requirements for building our targeted suite of anomaly detectors.  We first selected the `Log Analysis' category and then used search terms of{ vibration}, { power}, { motor}, { mechanical}, { compass}, { interference}, { GPS}, {  battery}, and { roll}, based on the emphasis on these problems in the formal documentation.  We then filtered out the results to remove issues that (1) represented basic queries about accessing or viewing logs such as ``How are the logs stored?'' or ``how to set the camera to record crashes?'', (2) provided only vague descriptions of the problem (e.g., ``drone is acting weird''), (3) had neither logs attached nor graphs describing the problem, or (4) lacked a clear diagnosis of the problem in the subsequent discussion.
For each of the retrieved issues, we carefully read the post and the subsequent discussion, and reviewed data plots using the Mission Planner and MAV Explorer tools. While there is a possibility that some of the  recommendations were incorrect, they were frequently corroborated by others. Approximately 25\% of the top ranked solutions were posted by users with a forum-wide average of 304 likes, and were owners of with `developer' badges with an average of 83.5 posts each.

There were numerous cases in which experts provided insightful comments. For example, in response to a help request for interpreting an in flight EKF-INAV failsafe warning\footnote{{https://discuss.ardupilot.org/t/beginning-flight-testing-log-analysis-shows-in-flight-failsafe-ekfinav/64970}}, one expert identified several different issues including vibration on the Z axes, a problem with the motor PWM, and a compass interference problem. Such insights enhanced the knowledge provided by the formal documentation, especially when experts suggested alternate causes to those already described in the documentation.

To identify an initial list of failures, we classified each issue we encountered using a hybrid deductive/inductive approach. If the issue referred to one of the failures described in the Autopilot documentation (cf. Table \ref{tab:fault_types} CP and SC), then we categorized it accordingly. All other reported issues that did not match any existing category were initially classified as { `other'}. For issues in the { `other'} category we used a snowballing technique which used key terms from the discussion to search for other related posts. For example given a post describing { failure to disarm} we searched for {`problem'} and {`autodisarm'}. This resulted in 36 posts categorized as {`other'}. We manually clustered  similar issues and then named the  cluster appropriately. This produced the following six additional types of failures: {`tuning errors'}, {`EKF switching'}, {`voltage sensor calibration'}, {`logging issues'}, {`disarming errors'}, and {`radio controller issues'}, which are listed in Table \ref{tab:fault_types} as `forum only' issues.

As with all forum discussions, interpretations and solutions are provided by both experts and non-experts, and represent their opinions about root causes \cite{experts}. As these opinions are not necessarily correct, we therefore read each discussion carefully including the disagreements between contributors, and focused on the final solution and expertise level of the contributor to identify the problem analysis deemed to be the correct one \cite{DBLP:journals/corr/abs-2101-02830}. For discussions that provided both a clear solution and an associated flight log, we retrieved, stored, and annotated the log to show the start and end points of the identified anomaly.

\subsection{Specifying Requirements for Anomaly Detection Models}
\label{sec:common_failures}

In order to evaluate our approach and create an initial set of DLMs, we analyzed five types of failures that were discussed particularly frequently in the discussion forums. These were mechanical problems, vibration problems, electrical interference on the compass, power problems, and GPS connectivity. For each of these we carefully reviewed the documentation and forum discussions to identify the following: {(1) Sensor attributes that serve as indicators for the failure,} (2) Rules for acceptable upper or lower bounds on individual attribute values, or on interactions between attributes (e.g., deltas or combinations) that are indicative of these failures,  and (3) Temporal patterns claimed as indicators of emergent problems.\vspace{4pt}

We then documented our findings using a template that included: failure type, placeholder requirements, and links to alternate causes. Each individual requirement was structured using the EARS event-driven template \cite{EARS} as follows: \vspace{4pt}\newline \noindent \mybox{lightgray}{{\bf When [event] then [named anomaly] shall be detected.}}

The requirements were treated as placeholders because they included qualitative adjectives (highlighted in yellow) such as {\it sufficiently} or {\it suddenly} and/or used unsubstantiated threshold values (highlighted in green) such as {\it more than 100 times} or {\it exceeds 60ms$^2$}. While, we expect the Deep learning model to learn its own patterns and threshold values from the data, these descriptions are useful  for two purposes. First, they can be used later in the process to generate explanations of detected anomalies in terms that are meaningful to humans, and second, they help guide the manual process of annotating flight logs with anomaly tags, thereby constructing a training and evaluation dataset.

\subsection{An Illustrated Example: Mechanical Problems}
To illustrate our approach we provide a detailed explanation of how requirements were identified and specified for one particular anomaly type related to detecting mechanical problems.

\subsubsection{Analysing forum discussions for posts related to mechanical problems}
We retrieved 26 different issues discussing mechanical problems from the Ardupilot forum. These primarily referred to motor or ESC failure, broken or loose propellers, imbalance in weight distribution, overly heavy payloads, and improper calibration. Experts agreed that mechanical errors generally cause a sudden divergence of actual attitudes (i.e., roll, pitch, and yaw) from the desired ones represented by the attributes ATT.Roll, ATT.Pitch and ATT.Yaw, and ATT.DesRoll, ATT.DesPitch and ATT.DesYaw. They also discussed that imbalance in RPM values sent to each of the motors, could be indicative of mechanical imbalance caused by uneven weight distribution, a twisted motor mount, or erroneous motor positioning.

\subsubsection{Specifying requirements for detecting mechanical anomalies} {The expert's comments provided the information we needed to (a) define the symptoms of mechanical problems (i.e., divergence of actual and desired roll, pitch, and yaw), (b) identify associated time-series data streams (e.g., ATT.Roll, ATT.DesRoll), and (c) provide the basis for explaining anomalies related to mechanical problems. Furthermore, in the cases where logs were provided to support the discussion, we retrieved and annotated the log to mark anomalies discussed by the experts, and then saved it for training and testing purposes.}
\input{tables/flight-problems-1}
{As an example, consider the information collected for mechanical failures in Table \ref{tab:reqs_mechanical}. The first requirement states that ``When the actual roll, pitch, or yaw deviates suddenly and sufficiently from desired roll, pitch, or yaw, then an attitude divergence anomaly shall be detected.'' This tells us that we need to build a deep learning model capable of detecting this type of divergence. As the DLM will learn its own thresholds for ``suddenly'' and ``sufficiently'', we accept fuzzy (soft descriptions) in the requirements definition. Our template also includes a section for symptoms, which are cross-referenced with the requirements.} The \emph{symptoms} discussed in the forum highlight the attributes of interest, and allow us to specify a derived requirement (aka design specification).  For example, in the case of Mechanical Failures, we document the fact that we can detect the sudden divergence of actual roll, pitch, and yaw, from desired roll, pitch, and yaw by building a deep learning model based on the time-series data associated with ATT.Roll vs ATT.DesRoll; ATT.Pitch vs ATT.DesPitch; and ATT.Yaw vs. ATT.DesYaw.

\input{tables/flight-problems-2}

\subsubsection{Non-functional requirements for mechanical anomaly detectors}
{While the primary focus of \emph{RESAM~} is on functional, rather than non-functional requirements (NFRs), the \emph{RESAM~} template could also be extended to include NFRs. These NFRs may differ significantly according to how and where the DLM will ultimately be deployed.  For example, the DLMs that we developed for the sUAS domain have two distinct purposes.  First, they could be deployed onboard each sUAS to support inflight, real-time analytics and to detect emergent failures and enact mitigations \cite{DBLP:conf/euromicro/VierhauserCBKRG18,DBLP:journals/tse/VierhauserBWXCH21}. Second, they could be used after a failed flight to analyze flight logs to assess the root cause of any failures.

Each scenario introduces different tradeoffs between qualities such as runtime performance, accuracy, and explainability.  In the onboard scenario, the DLM must support {\it fast} and {\it accurate} analysis.  Two example NFRs might be specified as ``Alerts for anomalous attitude divergence shall be detected and raised within 3 seconds of their occurrence'' and ``Alerts shall be raised at recall and precision levels of 90\%''. In contrast, when used to support post-flight analysis, fast analysis may no longer be a priority, and the DLM might favor recall over precision and require clear explanations of the anomalies to draw attention to potential causes of the flight failure.  In this case, two example NFRs might state that ``Potential anomalies shall be retrieved at recall levels of 99\%'' and ``All candidate anomalies shall provide explanations that are comprehensible to 90\% of RPICs in a randomly recruited user group''.

Well-established techniques can be used for analyzing quality tradeoffs and specifying NFRs  \cite{robertson,DBLP:journals/ansoft/BoehmEPSKM98,6365165}.}
 The different NFRs for these two use-cases suggests the need to train an individual DLM for each scenario. However, in the remainder of this paper, we focus on developing DLMs that achieve high degrees of accuracy.

\subsection{Additional Examples of Failure Types}
In order to illustrate the breadth and depth of requirements-related information available in discussion forums, we show four additional examples of RESAM templates in Table \ref{tab:morefailures}. The additional failures include vibration problems, compass interference, GPS glitches, and power issues, all of which represent commonly occurring flight failures, with clear time-series attributes that serve as indicators.   We summarize the expert advice as follows:

\begin{itemize}[leftmargin=*]
 \setlength\itemsep{.2em}
\item {\bf Vibration problems:}
 Experts explained that vibrations introduce errors in the way accelerometer values are computed, resulting in deviations between GPS readings and the estimated position (computed via GPS readings and barometer) which potentially results in fly-away behavior under certain flight modes  (See Table~ \ref{tab:reqs_vibration}).

 \item {\bf GPS glitches} have multiple causes. Experts stated that they  can generally be detected by checking the number of satellites and the horizontal dilution of precision information (See Table~\ref{tab:reqs_gps}).

\item {\bf Compass problems:} Experts focused on electrical interference from onboard components, and noted that the most common case occurs when the throttle is raised and the motors draw high current from the power source. The resulting current can impact magnetometer readings and cause the compass to provide wrong headings, resulting in erroneous yaw estimates and causing the UAV to deviate from its intended flight route (See Table~ \ref{tab:reqs_compass}).

\item {\bf Power brownouts:} Experts again identified multiple causes, with erratic swings in altitude serving as a predictive indicator when the sUAS is temporarily deprived of power (See Table~\ref{tab:reqs_power}).\vspace{0pt}
\end{itemize}

These findings clearly show that leveraging both documentation and forum discussions led to a richer understanding of the attributes that serve as indicators of UAV failures.
\section{Discussion and Open Challenges}
\label{sec:discussion}
RESAM was created to address the pressing challenge of designing and building onboard analytic solutions for sUAS in the absence of a clear set of requirements. At the start of our project we neither knew which types of flight failure to address, nor which time-series attributes to include in the identified DLMs. Whilst our team had some knowledge of the sUAS domain and runtime monitoring of sUAS systems \cite{SPLC2020,DBLP:journals/tse/VierhauserBWXCH21}, we needed to identify at least a preliminary set of failures to address and then learn how to diagnose those failures based on time-series data attributes available to us.  However, a preliminary analysis of flight control documentation indicated a vast space of over 1400 unique time series data streams exposed by the Ardupilot software.  Without conducting a systematic requirements elicitation process, we would have needed to build an anomaly detector that takes all of these time-series attributes as input, which would require huge amounts of training data and non-trivial resources. This motivated us to explore effective means of supporting the requirements discovery process, ultimately resulting in the RESAM process.

In retrospect, RESAM gave us the ability to identify and even rank the occurrence of common types of failures, to discover which attributes provide symptomatic clues, and to identify specific data patterns that are indicative of failure. This information enabled us to build an initial suite of DLMs. However, the process we have reported is just a starting point, and the DLMs described here are simply proof-of-concept solutions.  We therefore outline ongoing challenges and opportunities for further research as follows:\vspace{3pt}

\begin{figure*}[t]
    \centering
     \includegraphics[width=.75\textwidth]{figures/Explain-CompassInterference.pdf}
    \caption{A prototype showing an annotated anomaly, labeled  using explanatory text taken from the \emph{RESAM~} template.}
    \label{fig:explainability}
    \vspace{-8pt}
 \end{figure*}

{\begin{itemize
 \setlength\itemsep{.3em}
\item[{\bf C1:}]{\bf Lack of automation:} Forum mining aspects of RESAM were supported only by basic search features. NLP supported tools are needed that  automatically extract and rank common anomalies, their symptoms, and diagnoses.
\item[{\bf C2:}]{\bf Complex interactions between symptoms:} In practice a detectable anomaly (e.g., excessive attitude fluctuation) can serve as a symptom of multiple types of failure. Failure diagnosis therefore involves the simultaneous consideration of multiple symptoms, for example, through the use of a decision tree or recommender system \cite{recsys1}. An open challenge, which we are addressing in our current work focuses on automatically mining a far richer set of symptoms and mapping them into a  diagnostic tree.
\item[{\bf C3:}]{\bf Explainable diagnoses:} Our long-term goal is to explain detected anomalies in ways that are understandable and actionable to RPICs and other stakeholders. The challenge is to mine explanation information from the forums and to integrate this into explanations, as illustrated in Figure \ref{fig:explainability}. In this example an LSTM-detected anomaly is augmented with an explanation extracted from the \emph{RESAM~} template.  The algorithms for automating the generation of explanations remains an open challenge, and additional studies are needed to discover how to best explain anomalies to the targeted stakeholders.
\item[{\bf C4:}]{\bf Beyond functional requirements:} As discussed earlier in this paper, NFRs have a strong impact upon the way each DLM is designed and validated, and we need to understand how a DLM will be deployed in order to understand the relevant quality concerns and specify appropriate and measurable NFRs \cite{NFR}. Future work will extend RESAM to support NFRs, potentially through exploring NFR patterns applicable to anomaly detectors, and through developing appropriate tool support.
\item[{\bf C5:}]{\bf Single DLM vs Composition of DLMs:} In this paper we have presented each DLM as an individual entity; however, it is potentially beneficial to combine all of the time-series data, or a subset of critical attributes, into a single DLM and train it to simultaneously detect diverse anomalies. In current work we are comparatively exploring both options. However, from a requirements engineering perspective, the requirements remain the same - to diagnose and explain anomalies as they occur.
\end{itemize}}
\section{{Validation via Analysis of Anomaly Detectors}}
\label{sec:eval}
In this section we first report accuracy results and then discuss their implications with respect to our research questions.

\subsection{Evaluating Results}
We evaluated the efficacy of the LSTM and Rule-based models using the following metrics:

\begin{itemize}[leftmargin=*]
\item \textbf{Area under the Curve:~} For each of the LSTM autoencoders, we measured Area Under the Curve (AUC) of the Receiver Operating Characteristic (ROC) \cite{roc} by plotting the True Positive Rates (TPR) against False Positive Rates (FPR) for a range of autoencoder thresholds. The higher the AUC, the better the model is at differentiating between anomalous and non-anomalous samples \cite{roc2}.

\item \textbf{Precision, Recall, Accuracy and F1 score:~}
For the LSTM autoencoder models we first applied the models to the non-anomalous training data and computed the maximum reconstruction errors for each multi-variate time-series. We used these  reconstruction errors as autoencoder thresholds for detecting anomalies in the test logs. For the rule-based approach, we use thresholds defined in Section \ref{rule-def}. Based on the thresholds established for each model we computed precision, recall, accuracy, and F1-scores with respect to the detected anomalies, where precision is the fraction of detected anomalies that are truly anomalous and recall is the fraction of known anomalies that were correctly detected. F1 score is the harmonic mean of recall and precision, while accuracy is the fraction of correct predictions out of all samples.
\end{itemize}

The AUC results, reported in Table \ref{tab:auc} show that our models performed particularly well for vibration and attitude scoring between ~0.82 and ~0.96 in all cases. The AUC for interference detection was 0.75 which is comparatively lower than vibration and attitude likely because the model needed to learn more sophisticated correlations between two distinct time-series (i.e., throttle and magnetic field). The F1 results in Table  \ref{tab:eval} show that LSTM achieved an average score of ~0.81, compared to that of ~0.57 for the rule-based approach, increasing the F1 score by almost 42\%.

From Table \ref{tab:eval}, we observe that the LSTM models outperforms the rule-based detection methods for all the attributes. The LSTM models achieved significantly higher F1 score than rule-based detection methods in all the cases.

\subsection{Addressing the Research Questions}
We now address our two requirements-related research questions. We answer RQ1 primarily by discussing the effectiveness of the evaluated DLMs with respect to the stated requirements. Through following our process we found that the forums provided ample information for identifying key anomalies, defining meaningful requirements in the selected template, and identifying time-series data associated with each of the targeted anomalies. While we could have specified actual design definitions, we chose instead to simply list the informal names and formal attribute types of the time-series attributes that would be needed to build a DLM to detect the targeted anomaly. Our experiments served to validate that the requirements provided sufficient information to design, train, validate, and test each DLM, thereby enabling the requirements validation, and ultimately providing support that the RESAM process was effective.

Our second research question asked whether the additional effort of mining information from the forums was worthwhile, or whether the requirements could have been elicited purely from the formal documentation.  To answer this question we first refer to the types of anomalies depicted in Table \ref{tab:fault_types}, which shows that the documentation discussed six major types of anomalies under `common diagnosis problems', and five (including two overlaps) under `safety checks'. The forums discussed all nine of the faults plus six additional ones.  Furthermore, based on the results from our experiments, the LSTM model consistently outperformed the rule-based detection models by a fair margin in terms of F1 score. We observed three potential flaws in the rule-based detection method. (1) In many cases, actual anomalies occured even though the data remained within the threshold. This is illustrated in Figure \ref{fig:res3} which  shows an example in which anomalous vibration values were below the threshold ($30ms^{-2}$)  even though the vibration was flagged as anomalous by the experts. The rule-based approach failed to detect the anomaly whilst the LSTM model detected it successfully. (2) Rule-based detection often raises false positive results when sudden spikes occur in the data -- for example, quick maneuvers often cause increases in roll, pitch or yaw. LSTM models raised far fewer of these false alarms. Finally, (3) rule-based detection methods detect anomalies only after they exceed predefined thresholds, and are therefore unable to predict emerging anomalies.  For example, in Figure \ref{fig:res4}, the rule-based approach detected an anomaly when the vibration crossed the threshold, whereas the LSTM model was able to forecast the anomaly beginning from the first peak.

We conclude that the LSTM approach outperformed the rule-based approach. While these findings are clearly influenced by the availability of information on the Ardupilot website and user engagement in the discussion forums, they clearly show that discussion forums can provide useful sources of information for supporting and augmenting the requirements discovery process for anomaly detection.

\section{Introduction}
\label{sec:Introduction}
Cyber-Physical Systems (CPS), supported by IoT devices, are becoming increasingly ubiquitous in society where they are used for diverse sensing and actuating tasks such as detecting environmental conditions, supervising power plants and factory environments, and monitoring autonomous machines such as factory floor robots and small Uncrewed Aerial Systems (sUAS). These IoT devices often collect large  amounts of multi-variate time-series data which are used in realtime or offline to detect anomalies and to diagnose failure conditions. Analyzing this data often requires significant domain expertise. Some market products include tools that are designed to help users interpret the data. For example, in the commercial sector, AssetSense collects, monitors, and analyzes data from power plants and provides interactive tools to allow users such as operators, managers, and other plant personnel, to effectively interpret the data and to make actionable decisions \cite{assets}. However, in other domains, huge volumes of data are collected without the benefit of fully automated analysis tools.

The use of deep learning models (DLMs) to monitor data streams and create user-facing explanations of anomalies can address this need.  However, while DLMs can learn to recognize anomalies through a self-supervised training process, they often have a limited ability to explain the impact and root causes of the anomalies that they detect -- especially for less common cases or cases in which multiple errors occur simultaneously and explanations are quite complex. On the other hand, domain experts often have deep knowledge about the attributes and multivariate time-sequence patterns that serve as indicators of those failures. By leveraging this knowledge we can design and deploy ensembles of effective DLMs, each targeted at different types of anomalies and imbued with the ability to explain the anomalies they detect. However, this introduces a requirements engineering (RE) challenge to determine what types of anomalies are worth detecting and explaining, and identifying the right data sources for training DLMs to detect them \cite{REChallengeInML}. In practice, requirements for DLMs often go under-explored, and as a result the training data is often not well-aligned with the goals of the DLM. Therefore, the research challenge that we address in this paper focuses on {\bf``how to systematically leverage available information sources in order to identify, analyze, and specify {functional} requirements for designing Deep Learning Models capable of detecting and explaining anomalies in multivariate time-series data?''} This represents an emergent challenge at the intersection of requirements engineering and AI, and is likely to increase in importance with the growing use of Machine Learning (ML) and AI solutions to support the rapidly expanding deployment of IoT devices  \cite{DBLP:conf/re/VogelsangB19}. {While other aspects of the requirements elicitation process, such as  non-functional requirements (NFRs) related to critical qualities of fairness, accuracy, and performance, are equally important, this paper focuses primarily on the functional aspects.}

{Our approach can potentially be useful in any domain for which an active discussion forum provides support for analyzing data streams or logs. Examples include the sUAS domain \cite{qground,mplanner,ardupilot}, automotive data logs \cite{autodomain}, and space observatory data (e.g., \cite{astronomydomain})}. However, rather than address this challenge in a general way, we take a relatively deep dive into the domain of sUAS flight controllers, motivated by the challenges we have experienced in designing and constructing DLMs for sUAS flight control data, coupled with the lack of a prescriptive requirements process describing how to accomplish this task.

\begin{figure*}[t]
    \centering

    \includegraphics[width=.98\textwidth]{figures/FlightLogAnalysisProcess-Reduced-Version3.PNG}
    \caption{RESAM process for supporting the design and validation of deep-learning anomaly detection models }
    \label{fig:requirements_model}

\end{figure*}

Our paper therefore makes two primary contributions. First, it describes \emph{RESAM}, a systematic requirements process for leveraging multiple data sources including domain experts, discussion forums, and documentation, in order to elicit, analyse, and specify requirements for DLM-based monitoring and analysis tools. \emph{RESAM~} stands for {\bf R}equirements {\bf E}licitation and {\bf S}pecification for {\bf A}nomaly {\bf M}odels.  Second, given the domain of sUAS, we provide example specifications for constructing anomaly detectors for five different types of failures. Then, to validate \emph{RESAM}, we use the specified requirements to guide the construction of deep-learning LSTM (Long short-term memory) models and show that these models satisfy their specified requirements.  Further, given the effort of mining requirements information from discussion forums, we compare the quality of the DLMs built using forum data versus those built using only formal documentation, and show that in our experiments incorporating forum data results in more accurate models.

The remainder of this paper is structured as follows. Section \ref{sec:process} describes our \emph{RESAM~} approach for identifying failures, mapping them to sensor attributes, and specifying initial requirements for DL-based anomaly models. Section \ref{sec:uavstudy} adopts the \emph{RESAM~} process to specify requirements for five types of anomaly. Sections \ref{sec:techniques} and \ref{sec:eval} validate the \emph{RESAM~} requirements through constructing and testing two types of models. Finally, Sections ref{sec:discussion} to \ref{sec:conclusions}  discuss the strengths and limitations of our work, identify open challenges, discuss related work, and draw conclusions.

\section{The RESAM Process}
\label{sec:process}
Given the complexity of sensor data produced by many CPS and IOT devices, it is helpful to follow a systematic requirements process for discovering, specifying, analyzing, and validating requirements for DLMs that are capable of effectively detecting and explaining anomalous behavior.  Models built in a more ad-hoc manner can suffer from several different problems including: (1) incomplete analysis of failure types that the DLM should be trained to detect, (2) incomplete analysis of the root causes of a specific failure type resulting in missed attributes and an unreliable model that fails to detect key anomalies, and finally (3) n\"aive diagnoses that fail to consider alternate explanations for anomalous values and therefore return incorrect diagnoses.

We lay out our systematic process through steps (S1-S12) in Figure \ref{fig:requirements_model}. First we establish initial scope on what the system will and will not do (S1) {through the requirements activities of \emph{stakeholder identification}, \emph{and preliminary requirements elicitation} in order to \emph{establish goals} and \emph{system boundaries} for the planned AI components} \cite{robertson}. Leveraging the knowledge of the stakeholders, we then identify knowledge sources for supporting the  requirements discovery process {associated with each of the planned AI components }(S2). These sources include \emph{domain experts} who brainstorm a list of common failures and potential causes (S3), \emph{formal product documentation} including any information about diagnostic checks and alerts (S4), and relevant \emph{discussion forums} (S5). Discussion forums can be public or private. Either way they can contain potentially vast quantities of data typically grouped by categories and threads. We therefore establish search criteria designed to identify specific \emph{types of failures}, and perform inductive analysis to identify failure types (S6). Depending upon the nature of the forum, some posts will include data logs with accompanying analysis (S7). These logs are helpful for several reasons including (a) identifying failure types, (b) discovering how to detect failures of each type, and (c) building a collection of failure examples for later training of the DL models. We therefore annotate these logs according to expert consensus achieved in the forum discussion.

Based on the results from each of these steps we create an initial, merged list of failure types (S8), triage the failures to establish the scope of the DL models and then identify relevant time-series data streams for each failure type (S9). These steps represent a top-down approach to requirements discovery which can easily miss alternate explanations for a specific anomaly. For example, we might find that a specific type of failure is common and has symptoms A and B, but we could miss the fact that A is also a symptom of other types of failures. Our approach therefore also includes a bottom-up search for forum posts that discuss each identified symptom (S10) in order to explore alternate explanations for the symptoms.
Once failures, attributes, and patterns have been identified, we specify  and analyze requirements for the targeted anomaly models (S11), and finally train, validate, and test the DL models using the previously annotated datasets to ensure that they satisfy the requirements (S12).

\section{Validating DLM Requirements}
\label{sec:techniques}
Requirements are typically validated for characteristics such as completeness, consistency, validity, ambiguity, and correctness through activities that include requirements analysis, testing, prototyping, and reviews;  however, as the work in this paper represents a preliminary proof-of-concept, we focus only on evaluating whether individual anomaly detectors, designed and constructed to satisfy requirements for detecting a specific type of anomaly, are able to accomplish that goal successfully.
Our first question therefore evaluates whether the requirements and supporting information such as symptoms and flight logs, provided sufficient guidance and support for building effective DLMs.\vspace{4pt}

\noindent{\bf (RQ1)~{Is the information retrieved from the forums, including the problem definitions, discussions, conclusions, graphs, and flight logs, sufficient for specifying requirements and identifying time-series attributes needed to design and deploy DLMs capable of effectively detecting the targeted anomalies?}} \vspace{4pt}

Next, given the additional time and effort needed to mine requirements-related information from the discussion forums, we posed a second question about the performance of these models versus the models derived solely from the threshold-driven information in the online documentation. Our research question addresses whether the additional effort in eliciting requirements and their supporting data from the forums was worthwhile. The question is stated as follows:\vspace{4pt}

\noindent{\bf (RQ2)~Do the DLM's constructed using data collected from both documentation and forums outperform the rule-based anomaly detectors based on guidance related to threshold values described in the documentation?  }\vspace{-4pt}\newline

We addressed RQ1 and RQ2 by creating two different anomaly detector models for each of three failure types - a subset of mechanical issues exhibiting attitude problems, excessive vibration, and compass interference.  We first trained a Long Short Term Memory (LSTM) autoencoder \cite{LSTMAuto, LSTM}, which  is a variant of the Recurrent Neural Network (RNN) and capable of handling long term temporal dependencies \cite{LSTM} as found in flight log data \cite{autoencoder1,autoencoder2, autoencoder3}; and then created a rule-based anomaly detector using threshold values for sensor data as  defined in the Ardupilot documentation.  For RQ3 we provide only a single preliminary example showing the viability of using \emph{RESAM~} data to explain anomalous behavior.

\subsection{Data Sets}
For training and validation purposes we collected 670 Ardupilot dataflashlogs from 23 of our own Ardupilot UAVs including Iris 3DRs, America Hexcopter Spreading Wings S900, and Intel Aeros; and then for  testing purposes we used 46 of the dataflash logs collected from the Ardupilot Discussion Forum (cf., Step S7, Fig. \ref{fig:requirements_model}). All logs were converted to text format using the open source {\it pymavlink} library.  Given the time needed to annotate all 670 training logs, we first eliminated logs that (1) did not include the desired attributes (e.g., VIBE, ATT), (2) had higher degrees of uncertainty expressed in the related forum discussions, (3) had no obvious anomalous behavior matching the targeted attributes, or (4) were smaller than 2 megabytes as larger files tended to provide larger data samples of the anomalous behavior. 350 logs were retained following the filtering process, from which we randomly selected 135 logs for  vibration analysis, 112 logs for attitude analysis, and 38 logs for compass interference. We manually annotated these logs with start and end points of anomalies  associated with attitude, vibration, and compass interference. Table \ref{tab:annotated} summarizes our annotation.

\input{tables/annotated_logs}

\subsection{Constructing LSTM Models }
We trained, validated, and tested each LSTM autoencoder model using Ardupilot flight-logs using the multi-variate time-series data that matched the symptom attributes identified within the \emph{RESAM}' template. {Autoencoder-based anomaly detection includes several steps.  First (1), we feed the autoencoder non-anomalous data (training data) so that it learns to recognize normal behavior.  Autoencoders take time-series data as input, encode that data, and then learn to decode it back to its original form. They learn to perform this task on non-anomalous data but typically underperform when fed data containing anomalies.  Our second step therefore involves (2) running the model on the training data to calculate the reconstruction error for normal data, and then (3) setting the maximum reconstruction error from the training data as a threshold to distinguish between anomalous and non-anomalous data.  Finally, we (4) apply the model on unseen data with potential anomalies, and detect anomalies when a reconstruction error is returned higher than the established threshold.  Therefore, a higher threshold leads to higher precision but lower recall.}

For each of the three failure types we extracted the attributes of interest (e.g., VIBE, ATT) from non-anomalous log files in order to build a training set of normal flight behavior in the form of \textit{samples$\times$features}. Through initial trial and error, we selected a sliding window to iterate over the sequences of data in order to create the third dimension - '\textit{timesteps}' required by LSTM, and concatenated data samples from all the non-anomalous log files to create a dataset of shape \textit{samples$\times$timesteps$\times$features}. Then we randomly split the dataset into 80\% for training and 20\% for validation. \vspace{4pt}\newline

\noindent{\bf $\bullet$~Vibration:} We used 68 non-anomalous Ardupilot flight logs and extracted the VIBE.VibeX, VIBE.VibeY, VIBE.VibeZ attributes. We experimentally chose a sliding window of 200 and created a dataset of the shape \textit{samples $\times$ 200 $\times$ 3} for each of the log files, and concatenated them to produce a dataset of the shape {255059 $\times$ 200 $\times$ 3}. We applied min-max normalization to make the convergence faster, and used a stacked reconstruction LSTM architecture. The encoder had 2 hidden LSTM layers with 100 and 16 units respectively to create an encoded representation of length 16. A $RepeatVector$ layer was implemented as a bridge between the encoder and the decoder which repeats the encoded representation $timesteps$ (200 in this case) number of times. The decoder served as a mirror to the encoder, and the $TimeDistributed$ layer ensured that the number of output features matched the number of inputs. The $tanh$ activation function was used to help avoid the vanishing gradient problem \cite{tanh}. We used mean absolute error (MAE) loss function and the adaptive moment estimation (Adam) optimizer (learning rate=0.001) was utilized to minimize it. We applied L2 regularization (factor=0.001) to avoid over-fitting, and the model was trained using a batch size of 200 data samples. Visualized results for executing the vibration detection model are shown in Fig.~\ref{fig:res1}, for a flight log with clear vibration problems.

\begin{figure}
     \centering
   \includegraphics[width=1\columnwidth]{figures/ADPD-048__detection_y.jpg}
    \vspace{-8pt}
    \caption{\centering Detection of anomalous vibration by LSTM model}
    \label{fig:res1}
\end{figure}

\noindent{\bf $\bullet$~Attitude Anomalies: }
We extracted ATT.DesRoll, ATT.DesPitch, ATT.DesYaw, ATT.Roll, ATT.Pitch, ATT.Yaw from 76 non-anomalous flight logs for training and validation purposes. As we were interested in divergence between values, we subtracted actual values from the desired ones (e.g., ATT.DesRoll - ATT.Roll) for roll, pitch and yaw producing a dataset of the shape \textit{samples $\times$ features} from each of the log files. Using a sliding window of size 200 produced a dataset of shape  {322777 $\times$ 200 $\times$ 3}.
The Attitude LSTM autoencoder had only one LSTM hidden layer with 64 units on each of the encoder and decoder sides and the \textit{RepeatVector} in the middle. The length of the encoded representation is 64. We used the $tanh$ activation function, MAE loss function and Adam optimizer (learning rate of 0.001). L1 regularization (factor=0.00015) was applied. We fed the data to the model with a batch size of 200.
\vspace{4pt}\newline
\noindent{\bf $\bullet$~Compass Interference: }
 We extracted CTUN.ThO, MAG.MagX, MAG.MagY, MAG.MagZ, MAG2.MagX, MAG2.MagY, MAG2.MagZ from 38 non-anomalous log files. We then calculated the \textit{l2}-norm of the magnetic fields for MAG and MAG2, respectively. Based on initial experimentation, we used a sliding window of size 50 to produce a training dataset of shape {159843 $\times$ 50 $\times$ 3}. The LSTM-based autoencoder has both an encoder and a decoder structure. The encoder has an LSTM layer which encodes the input sequence with 3 features per $timestep$ into 8 hidden features per $timestep$. We take the last hidden representation learned from the input sequence as the encoding. The decoder has an LSTM layer that first converts the dimension of 8 to a dimension of 16 and finally, a fully-connected layer that maps from the hidden space to the original space for reconstruction. We used the MSE loss and an Adam optimizer (learning rate of 0.001) to train the model. We also stacked the input data into a set of mini-batches, where the batch size is 100.

\subsection{Constructing Rule-Based Models}
\label{rule-def}
Our rule-based models use a simple thresholding technique to flag anomalies when the data exceed a predefined threshold. For vibration and compass interference, we use suggested thresholds provided by the Ardupilot documentation. For interference, the threshold value was established when the correlation between CTUN.Tho and the l2-Norm exceeds 30\% and for vibration anomalies, we set a maximum allowable threshold of 30$ms^{-2}$ for each of VibeX, VibeY and VibeZ. As the documentation did not provide thresholds for anomalous attitudes, we tested different thresholds (5$^{\circ}$, 10$^{\circ}$ and 15$^{\circ}$) and selected 10$^{\circ}$ as the one that returned highest accuracy.

\input{tables/results}
\input{figures/graphs}

\subsection{Testing LSTM and Rule-Based Models}
We then applied each model against the test data, which represented previously unseen time-series data from the Ardupilot forum. The vibration test set contained VIBE data for 22 normal and 24 anomalous logs. The attitude test set included ATT  data for 22 normal and 24 anomalous logs. Finally, the compass interference test set included 10 normal and 10 anomalous logs. It was smaller than the others due to fewer available logs.