Eventual Failure Explanations (EFE)

• Eventual Failure Explanations (EFE) are automata-based summaries that capture bug-triggering behavior by identifying regions where passing tests become impossible.
• The approach leverages a learned three-valued DFA with relabeling and minimization to abstract away incidental test constraints and focus on essential failure patterns.
• EFE enables earlier detection of inevitable failures in reactive systems, thus supporting efficient debugging and enhancing the precision of failure analysis.

Searching arXiv for recent and relevant papers on Eventual Failure Explanations and closely related failure-explanation work in robotics, CPS, debugging, and predictive failure analysis. Eventual Failure Explanations (EFE) are automata-based summaries of bug-triggering behavior introduced in “Automata Models for Effective Bug Description” (Yaacov et al., 15 Jul 2025). In that framework, tests are words over a finite alphabet $\Sigma$, the modeled test space is a regular language $T \subseteq \Sigma^*$, executable tests form $S \subseteq T$, and failing tests form $B \subseteq S$. An EFE differs from an ordinary Failure Explanation (FE) by allowing the explanation automaton to characterize some tests that have not yet failed but are already in a region from which passing is no longer possible. The intended effect is to move the description of a bug from the point of observed assertion failure toward the earlier behavioral pattern that makes failure inevitable.

1. Formal setting and motivation

The EFE framework assumes a model-based testing setting for reactive software systems. A word over $\Sigma$ is an abstract test sequence; a testing infrastructure maps that sequence to concrete interactions and assertions. The central semantic sets are $T$, $S$, and $B$: the modeled tests, the executable tests, and the failing executable tests, respectively. A key assumption is that $B$ is extension closed with respect to $S$: if $T \subseteq \Sigma^*$0 and $T \subseteq \Sigma^*$1, then $T \subseteq \Sigma^*$2. Intuitively, once a test has entered a failed state, executable continuations remain failed (Yaacov et al., 15 Jul 2025).

This setting is motivated by the claim that raw failing traces, and even the full bug language $T \subseteq \Sigma^*$3, can be poor bug descriptions. They often contain incidental constraints imposed by the test model or harness, such as mandatory setup actions, session protocol, or delayed assertion steps. EFE is designed to factor out such irrelevant structure and retain only the behavioral pattern that is essential for the bug. This suggests a shift from trace enumeration to language-level summarization: the explanation is itself a regular language, ideally recognized by a small automaton, rather than a single counterexample or prose narrative.

2. FE, EFE, and ED

The paper defines explanations through constraint specifications. A pair $T \subseteq \Sigma^*$4 with $T \subseteq \Sigma^*$5 and $T \subseteq \Sigma^*$6 is a constraint specification; a language $T \subseteq \Sigma^*$7 is consistent with $T \subseteq \Sigma^*$8 if $T \subseteq \Sigma^*$9 and $S \subseteq T$0. Words outside $S \subseteq T$1 are don’t-care cases (Yaacov et al., 15 Jul 2025).

The distinctive notion behind EFE is “will eventually fail.” A prefix $S \subseteq T$2 may pass if either it can be extended to a finite maximal passing test, or it can be extended indefinitely through passing tests. The paper then defines that $S \subseteq T$3 will eventually fail iff $S \subseteq T$4 may not pass. Accordingly, EFE is based on inevitability, not merely on the existence of some failing continuation.

Notion	Consistency target	Interpretation
FE	$S \subseteq T$5	Accept failing executable tests; reject passing executable tests
EFE	$S \subseteq T$6	May accept some not-yet-failed tests that will eventually fail
ED	$S \subseteq T$7	Accept prefixes that must remain on an accepting path while excluding reject prefixes

Here $S \subseteq T$8 denotes the set of tests in $S \subseteq T$9 that will eventually fail. Two consequences are technically important. First, EFE is looser than FE: it may accept words that are not yet in $B \subseteq S$0, provided they are already in $B \subseteq S$1. Second, EFE is not defined as exact recognition of $B \subseteq S$2; it is any language consistent with $B \subseteq S$3. Thus an EFE must contain all actual failing tests, must reject tests that are not eventually failing, but need not accept every eventually failing word.

The paper also defines Early Detection (ED), and correspondingly EDFE and EDEFE. ED shifts acceptance to prefixes whenever a prefix lies in $B \subseteq S$4 but not in $B \subseteq S$5. In the EFE context, this pushes explanation even further toward the earliest point at which the system has irreversibly entered failure-bound behavior.

3. Automata construction and minimization

The implementation first learns a three-valued DFA, or 3DFA,

$B \subseteq S$6

whose accepting, rejecting, and don’t-care states correspond ideally to $B \subseteq S$7, $B \subseteq S$8, and the non-executable remainder. Learning is performed with an $B \subseteq S$9-style active procedure adapted to a three-valued teacher. Membership answers are $\Sigma$0 for $\Sigma$1, $\Sigma$2 for $\Sigma$3, and $\Sigma$4 otherwise. Equivalence is approximated by repository checks, test-model checks, and randomized conformance testing (Yaacov et al., 15 Jul 2025).

EFE is then obtained by relabeling the learned 3DFA. The relabeling algorithm computes which rejecting states still “may pass.” It first identifies rejecting states that can end in finite maximal passing behavior, then augments this set using strongly connected components that contain rejecting states, capturing the possibility of infinite passing continuations. Backward reachability propagates this may-pass property to predecessors. The final relabeling keeps only those rejecting states that may-pass: $\Sigma$5 and moves the remaining rejecting states into don’t-care: $\Sigma$6 This construction matches the formal EFE definition: states that no longer admit a passing future are relaxed from hard rejection, allowing the final explanation automaton to absorb them if that yields a smaller summary.

The last stage converts the relabeled 3DFA into an ordinary DFA. Although the paper notes that exact minimization for incompletely specified machines can be exponential, the implementation uses RPNI as a passive-learning approximation. This reflects the overall design choice: explanation quality is operationalized mainly through compactness of the resulting automaton.

A related structural result is that, if $\Sigma$7 is extension closed with respect to $\Sigma$8, then there exists an extension-closed FE or EFE language whose minimal automaton is smallest among all automata recognizing FE or EFE languages. This gives extension-closed explanations a privileged status without making them unique.

4. Empirical behavior on benchmarks

The evaluation uses 27 reactive software systems from the RERS 2019 benchmark suite. Three testing regimes are considered: unrestricted ($\Sigma$9), failure-driven ($T$0), and assertion-driven ($T$1). The $T$2 setup is the most informative for EFE because it inserts three explicit assertion actions after the causal bug state, thereby separating cause from manifestation (Yaacov et al., 15 Jul 2025).

In $T$3, both FE and EFE are significantly smaller than the baseline automata for $T$4, and EFE is significantly smaller than FE, with a reported significance level of approximately $T$5. The explanation given in the paper is straightforward: the wrapper causes the real bug to surface only after three trailing assertion steps, and EFE can abstract away those delayed manifestation steps because it is allowed to recognize earlier words that will eventually fail. Concrete benchmark instances reflect this compression; for example, the reported state counts include cases such as $T$6 and $T$7.

The practical cost of the EFE-specific postprocessing is low. The relabeling and minimization stages are reported as negligible, typically under five seconds per benchmark. The expensive part lies upstream, in active learning and in subset checks against large test models. This suggests that, within the automata-learning pipeline, EFE itself is not the dominant computational bottleneck.

5. Relation to adjacent explanation paradigms

EFE belongs to a broader landscape of failure-explanation methods, but its representational choice is distinctive. “Automatic Failure Explanation in CPS Models” explains failures by mining specifications from passing traces and then ranking anomalous internal signals, variables, and model elements in failing runs (Bartocci et al., 2019). “Why does it fail? Explanation of verification failures” explains failed proof obligations by extracting salient predicates and recursively refining them into branching explanation trees in domain vocabulary (Eriksson, 23 Mar 2026). “Explaining Failures of Cyber-Physical Systems with Actual Causality” defines sufficient explanations as minimal subsets of observed environment elements that, when retained under intervention, reproduce the same failure type (Elimelech et al., 23 Jun 2026). “From Program Slices to Causal Clarity” studies LLM-generated software failure explanations as first-class artifacts and shows that explanation quality is causally affected by context composition, with failure-specific artifacts improving causal and actionable quality (Porbeck et al., 20 Apr 2026).

Compared with these approaches, EFE is language-theoretic. It does not primarily produce ranked anomalies, countermodels, causal subsets, or natural-language narratives. Instead, it computes a regular language whose accepted traces summarize when the system has entered a failure-bound behavioral region. This makes EFE especially suitable when failures are best described as recurrent trace patterns and when concise automata are a useful explanatory object in their own right.

6. Broader interpretations and limitations

Within the supplied literature, (Yaacov et al., 15 Jul 2025) is the paper that explicitly introduces the term EFE. The underlying idea, however, has close analogues elsewhere. In conversational HRI, failure explanation is framed as a communicative act that should arise once misunderstanding or incapability becomes interactionally relevant, not only after explicit user requests (Kontogiorgos, 2023). In unrecoverable robot handover failures, participants want explanations that resolve expectation violation, clarify capability, and support corrective action (Han et al., 2020). Work on robot execution-failure explanation distinguishes plan explanation from execution-failure explanation and shows that context-based explanations improve human recovery selection (Das et al., 2020), while a closely related study finds that context plus recent action history is especially effective for non-experts (Das et al., 2021). A causal-Bayesian-network method for robot failures generates contrastive explanations by finding the closest nearby state that would have succeeded (Diehl et al., 2022). In predictive settings, failure explanations can take the form of precursor-event summaries for failures predicted within a future horizon (Giurgiu et al., 2019), or component-level predictions of eventual failing parts jointly with remaining useful life (Cohen et al., 2023). These works do not use the term EFE in the same formal sense, but they suggest a broader family of eventual-failure reasoning in which explanation shifts from observed failure toward earlier inevitability, actionable repair, or prognostic cause.

The automata-based EFE formalism also has clear limitations. EFE is not unique; many languages satisfy the consistency constraints. Its quality depends strongly on the choice of test model $T$8: if $T$9 is too broad, irrelevant behavior can remain in the explanation, while if $S$0 is too restrictive, the explanation can collapse into a trivial automaton. The framework also relies on regular approximation, whereas real bug conditions may involve non-regular data or counting dependencies. Finally, because EFE is defined via consistency with $S$1, it need not accept every eventually failing word. This suggests that EFE, as introduced here, is best understood not as an exact inevitability recognizer but as a compact explanatory abstraction over an inevitability relation.