On State Machine Mining from Embedded Control Software

Program understanding is a time-consuming and tedious activity for software developers. Manually building abstractions from source code requires in-depth analysis of the code in the first place. Model mining can support program comprehension by semi-automatically extracting high-level models from code. One potentially helpful model is a state machine, which is an established formalism for specifying the behavior of a software component. There exist only few approaches for state machine mining, and they either deal with object-oriented systems or expect specific state implementation patterns. Both preconditions are usually not met by real-world embedded control software written in procedural languages. Other approaches extract only API protocols instead of the component's behavior. In this paper, we propose and evaluate several techniques that enable state machine mining from embedded control code: 1) We define criteria for state variables in procedural code based on an empirical study. This enables adaptation of an existing approach for extracting state machines from object-oriented software to embedded control code. 2) We present a refinement of the transition extraction process of that approach by removing infeasible transitions, which on average leads to more than 50% reduction of the number of transitions. 3) We evaluate two approaches to reduce the complexity of transition conditions. 4) An empirical study examines the limits of transition conditions' complexity that can still be understood by humans. These techniques and studies constitute major building blocks towards mining understandable state machines from embedded control software.