  Model checkers provide algorithms for proving that a mathematical model of a
system satisfies a given specification. In case of a violation, a
counterexample that shows the erroneous behavior is returned. Understanding
these counterexamples is challenging, especially for hyperproperty
specifications, i.e., specifications that relate multiple executions of a
system to each other. We aim to facilitate the visual analysis of such
counterexamples through our HyperVis tool, which provides interactive
visualizations of the given model, specification, and counterexample. Within an
iterative and interdisciplinary design process, we developed visualization
solutions that can effectively communicate the core aspects of the model
checking result. Specifically, we introduce graphical representations of binary
values for improving pattern recognition, color encoding for better indicating
related aspects, visually enhanced textual descriptions, as well as extensive
cross-view highlighting mechanisms. Further, through an underlying causal
analysis of the counterexample, we are also able to identify values that
contributed to the violation and use this knowledge for both improved encoding
and highlighting. Finally, the analyst can modify both the specification of the
hyperproperty and the system directly within HyperVis and initiate the model
checking of the new version. In combination, these features notably support the
analyst in understanding the error leading to the counterexample as well as
iterating the provided system and specification. We ran multiple case studies
with HyperVis and tested it with domain experts in qualitative feedback
sessions. The participants' positive feedback confirms the considerable
improvement over the manual, text-based status quo and the value of the tool
for explaining hyperproperties.
