Azzeddine Benabbou
email: azzeddine.benabbou@gmail.com

Domitile Lourdeaux
email: domitile.lourdeaux@hds.utc.fr

Dominique Lenne
email: dominique.lenne@hds.utc.fr

Automated dilemmas generation in simulations

Keywords: Azzeddine Benabbou, Domitile Lourdeaux, Dominique Scenario generation, virtual environment, knowledge models, dilemmas

HAL is

INTRODUCTION

There is no consensual definition of what a "critical situation" is across the various disciplines. A first meaning of this notion refers to the severity or dangerousness of an event. Sometimes, it can also refer to the likelihood of an event [START_REF] Westrum | A Typology of Resilience Situations[END_REF]. In risk assessment, the classical approach consists in putting these two parameters together to calculate a criticality value: criticality = severity * the likelihood. More recent approaches have considered it to be related to different types of cognitive dissonances [START_REF] Vanderhaegen | Can Dissonance Engineering Improve Risk Analysis of Human-Machine Systems?[END_REF]. In a totally different meaning, a critical situation refers to situations where critical incidents occur in the context of the Critical Incidents Technique [START_REF] Flanagan | The Critical Incident Technique[END_REF]. The term here is not related to severity, but it refers to the fact that an incident makes a significant contribution to an activity. In a recent work, J-M. [START_REF] Burkhardt | Simulation and Virtual Reality-Based Learning of Non-Technical Skills in Driving: Critical Situations, Diagnostic and Adaptation[END_REF] brought these different meanings together and determined seven dimensions that characterise a critical situation: severity, unpredictability, dilemma, ambiguity, sociocognitive load, novelty and lack of skills. These dimensions are not only critical because they can lead to negative consequences, but also because they are essential for the development of technical and non-technical skills.

The occurrence of critical situations can have several explanations. However, since the 80's, the analysis of major incidents in aviation [START_REF] Helmreich | On Error Management: Lessons from Aviation[END_REF] stated that human factors play a major role in the occurrence of such incidents. Similarly, in healthcare, the study of adverse events on the patients revealed that they were not caused by a technical failure (lack of knowledge, technical skill failure), but mostly because of human factors and organizational issues [START_REF] Cooper | Critical Incidents Associated with Intraoperative Exchanges of Anesthesia Personnel[END_REF][START_REF] Newbower | Learning from Anesthesia Mishaps: Analysis of Critical Incidents in Anesthesia Helps Reduce Patient Risk[END_REF]. These factors cover a particular type of skills, which are the non-technical skills. [START_REF] Flin | Safety at the Sharp End: A Guide to Non-Technical Skills; Chapter 2[END_REF] define these skills as "the cognitive, social, and personal resource skills that complement technical skills, and contribute to safe and efficient task performance". In order to prevent negative consequences from happening, individuals need to be trained to use these skills, especially in critical domains such as healthcare and car driving. However, due to several factors such as dangerousness, costs, staff availability or ethical considerations, it is sometimes impossible to ensure training sessions in genuine situations. To address this problem, the use of virtual environments was considered in several domains [START_REF] Baker | Aviation Computer Games for Crew Resource Management Training[END_REF][START_REF] Reznek | Virtual Reality and Simulation: Training the Future Emergency Physician[END_REF][START_REF] Scott | Adaptive 3D Virtual Learning Environments-A Review of the Literature[END_REF][START_REF] Walker | Training and Learning for Crisis Management Using a Virtual Simulation/Gaming Environment[END_REF] as it comes with several features (Jean-Marie [START_REF] Burkhardt | La Réalité Virtuelle Pour l'apprentissage Humain[END_REF]. Besides, it fosters a situated and constructivist learning1 [START_REF] Chittaro | Web3D Technologies in Learning, Education and Training: Motivations, Issues, Opportunities[END_REF][START_REF] Huang | Investigating Learners' Attitudes toward Virtual Reality Learning Environments: Based on a Constructivist Approach[END_REF]. Our ultimate objective is to contribute to the design of a generic architecture intended to conceive a virtual environment for non-technical skills training. More specifically, our contribution in this architecture consists in the scenario generation engine that produces the critical situations. To be efficient, this engine has to meet several criteria that are detailed in the following paragraph.

In order to facilitate the transfer of the skills, it is necessary to vary the conditions (situations) in which a task is performed [START_REF] Tardif | Stratégie Pour Favoriser Le Transfert Des Connaissances[END_REF]. Thus, a generation engine has to be able to produce a large panel of situations. Also, to foster a constructivist and situated learning/training, the learners must have a freedom of action in order to experience the consequences of their acts. Thus, a generation engine has to be able to take into consideration all the possible deviations from the initial scenario. Moreover, in order to produce the best possible experience for the learners, the generation engine has to control the simulation. It means that it has to be able to select the most relevant situations and adapt them to the learners. As far as critical situations are concerned, it must be able to adjust the severity and/or the intensity of the situation according to the learner's profile. The main challenge of a generation engine is to conciliate the above objectives (variability of situations, learner freedom and control of the simulation). In classical approaches, the developers have to anticipate all the learner's actions beforehand, and propose the appropriate scenario adjustments for each case. In complex domains, this approach is doomed to fail due to the great number of entities and the complex relations between them. Indeed, writing all the possible scenarios will lead to an authoring bottleneck [START_REF] Spierling | Authoring Issues beyond Tools[END_REF]. To address this problem, an alternative approach would be to automatically generate these situations. In the literature, several works have adopted this approach, and used it to generate situations that are characterized by one or more of the seven critical dimensions stated earlier. However, most of these works focused on numerical dimensions and those that can be straightforwardly generated. In Death Kitchen for example, [START_REF] Lugrin | AI-Based World Behaviour for Emergent Narratives[END_REF] used a Danger Matrix to represent numerical values of severity in order to generate dangerous kitchen events. This same dimension was used by [START_REF] Barot | Scénarisation d'environnements Virtuels. Vers Un Équilibre Entre Contrôle, Cohérence et Adaptabilité[END_REF] along with an unpredictability-like value to model a scenario planner for risk-management training in virtual environments. Other dimensions such as the novelty and lack of skills were addressed in other models. In TAILOR for example, [START_REF] Carpentier | Dynamic Selection of Learning Situations in Virtual Environment[END_REF] attribute a degree of belief on the capacity of the learner to handle classes of situations. Using these beliefs along with a situations history, the system determines which situations have never been presented to the learner and which have not been mastered yet. However, we noticed that few works have addressed the other dimensions: socio-cognitive load, ambiguity and dilemma. Therefore, our work focused on these particular dimensions. Dilemma is the main subject of this paper. Should anyone need more detail about ambiguity generation, please refer to (Benabbou et al. 2018). Future work should address the remaining dimension.

In this paper, we focus on a particular type of critical situations, namely the dilemmas. According to the online Cambridge dictionary, a dilemma is "a situation in which a choice has to be made between possibilities that will all have results you do not want". Our interest in this dimension is twofold. First, our will is to tackle the challenge brought forward by the automated generation of a 'non-numerical' dimension; and second, because of the critical nature of the dimension itself. In fact, dilemmas are faced in a daily basis in several sensitive areas such as healthcare, hence the need to train the staff to handle them [START_REF] Lecomte | La Formation à l'éthique Des Étudiants En Soins Infirmiers (Belgique)[END_REF]. Also, dilemmas have widely been discussed with the emergence of autonomous cars, especially the case of unavoidable collisions [START_REF] Bonnefon | The Social Dilemma of Autonomous Vehicles[END_REF]. We believe that automated generation of dilemmas can benefit these two areas and can ease the development of virtual environments for non-technical skill training. We argue that confronting individuals with these situations improves their non-technical skills (J-M. [START_REF] Burkhardt | Simulation and Virtual Reality-Based Learning of Non-Technical Skills in Driving: Critical Situations, Diagnostic and Adaptation[END_REF]), and we make the hypothesis that it can be generated automatically. To validate this hypothesis, we designed KOBA: a scenario generation engine that automatically generates dilemmas without having to write them beforehand. This will contribute to creating dilemma scenarios with less authoring effort. Therefore, we are interested in the following research questions: how do we model dilemmas? How do we qualify them? and finally, how do we generate them automatically without having to write them beforehand?

This paper is organized as follows. In section 2, we expose some related work. In section 3, we present the global architecture in which KOBA is integrated. Section 4 details the dilemma generation process which is validated using a car driving simulation presented in section 5.

RELATED WORK

The trolley dilemma is one of the most famous dilemmas in the literature. It was stated for the first time by [START_REF] Foot | The Problem of Abortion and the Doctrine of Double Effect[END_REF]. The dilemma says: a runway trolley is moving toward five men working on the main track. The protagonist can use a lever to redirect the trolley onto the side track where there is only one man working. What should he do? This dilemma was widely discussed in the literature. It has been the subject of several studies that indicated that the vast majority of people agree that it is permissible to pull the lever [START_REF] Greene | An FMRI Investigation of Emotional Engagement in Moral Judgment[END_REF][START_REF] Hauser | A Dissociation between Moral Judgments and Justications[END_REF][START_REF] Valdesolo | Manipulations of Emotional Context Shape Moral Judgment[END_REF]. In 2012, [START_REF] Navarrete | Virtual Morality: Emotion and Action in a Simulated Three-Dimensional 'Trolley Problem[END_REF] investigated if the people would react similarly in an immersive environment. To do so, the authors exposed the participants to a 3D version of the trolley problem in a virtual environment, giving them the opportunity to pull the lever or not. Built on this study, a more advanced experiment was conducted by [START_REF] Skulmowski | Forced-Choice Decision-Making in Modified Trolley Dilemma Situations: A Virtual Reality and Eye Tracking Study[END_REF] who exposed the participants to different configurations of the same dilemma. The trolley dilemma and its variants were also transposed in several domains. In car driving for example, one could face a situation where he has to choose between sacrificing his own life or killing the pedestrians. Due to the emergence of autonomous vehicles, this kind of situations is more and more studied in order to investigate which behaviours are admissible in this case. [START_REF] Sütfeld | Using Virtual Reality to Assess Ethical Decisions in Road Traffic Scenarios: Applicability of Value-of-Life-Based Models and Influences of Time Pressure[END_REF], for example, conducted a study in which they exposed the drivers to various virtual situations of inevitable collisions. Dilemmas are also used in training simulations. For instance, the researchers of the Institute for Creative Technologies in Southern California use virtual environments to simulate complex military scenarios. In the most recurring scenario, the player plays the role of a lieutenant who faces a dilemma at a particular point of the simulation. He has to choose between achieving his initial mission which is helping a platoon in trouble, and securing a landing zone for a medevac helicopter in order to rescue a civilian boy injured by the platoon [START_REF] Rickel | Steve Goes to Bosnia: Towards a New Generation of Virtual Humans for Interactive Experiences[END_REF].

All the simulations presented above integrate the dilemmas in the initial scenario. They are scripted and planned in advance. Certain works such as [START_REF] Skulmowski | Forced-Choice Decision-Making in Modified Trolley Dilemma Situations: A Virtual Reality and Eye Tracking Study[END_REF][START_REF] Sütfeld | Using Virtual Reality to Assess Ethical Decisions in Road Traffic Scenarios: Applicability of Value-of-Life-Based Models and Influences of Time Pressure[END_REF] introduce some variability in the dilemmas. However, it is also pre-scripted and established in advance. This approach enables the authors to have a strong control on the simulation. Its use is relevant if the authors target a limited number of situations as it will not require a huge authoring effort. Otherwise, this approach is doomed to fail, especially in complex environments. To address this problem, an alternative approach would be to automatically generate dilemmas without having to script them beforehand. To our best knowledge there are only two systems in the literature that adopt such an approach.

GADIN is an interactive narrative engine designed by [START_REF] Barber | A User Model for the Generation of Dilemma-Based Interactive Narratives[END_REF] that unfolds a story based on a user's response to dilemma situations. The dilemma generation process takes into consideration the social relationship between the charactersfriends or enemiesand the utility of the actions. For example, the user could be confronted with a situation in which he has to decide whether to take or not an action which outcome would be positive for him but negative for his friend. According to the authors, this situation refers to a Betrayal dilemma. They identified a total of five dilemma categories according to the social relationship and the actions utility: Betrayal, Sacrifice, Greater Good, Take Down and Favour. GADIN is more oriented to generate a soap opera kind of stories. Thus, it does not cover some dilemma situations that can occur in real life. Indeed, the main limit of this system is that it fails to generate dilemmas when the decision-maker character has no social relationships with the others, or simply when he is the only character in the virtual environment. To address this problem, [START_REF] Harmon | An Expressive Dilemma Generation Model for Players and Artificial Agents[END_REF] proposes EGAD: a more expressive dilemma generation system. Each character in this system has a list of cherished values, a list of despised values and a list of values of unknown importance. These values can either be preserved of rejected by the user's action. In fact, when a choice is presented to the user, each option of the choice serves to preserve or reject a value or a set of value. There are three basic types of choice: help, harm, or ignore. A help choice supports one or more values. A harm choice reject one or more values. An ignore choice gives the user the opportunity to refuse all the presented choices. Using these three basic types of choices the system is able to generate a wide panel of dilemmas. Given two actions, an example of dilemma would be a choice in which the user has to choose which cherished (despised) value to preserve (harm). The system also produces forced scenarios in which the user has to choose which cherished (despised) value to harm (preserve). Although this system improves the expressiveness of GADIN, it is still not suitable for 3D virtual environments. The reason is that the exclusivity of the choicewhich is a main characteristic of a dilemmais guaranteed at the extradiegetic level. It means that it is handled in graphical/textual elements that belong to an external layer that is independent from scenario. Concretely, in both systems, the choice is presented in a textual menu. This latter is closed once the user selects an option. The exclusivity of the choice is guaranteed, but this breaks the immersion of the user if he is using a 3D virtual environment. Moreover, EGAD could benefit from more expressiveness by considering also the outcomes of not doing an action. Finally, to our best knowledge, the author only validated that the system was more expressive than GADIN, but no further evaluations were conducted to validate that the system truly generates dilemmas. To overcome these limits, we propose KOBA, a generic dilemma generation engine. The purpose of KOBA is to improve the state of the art expressiveness and to guarantee the exclusivity of the choice at the intradiegetic level. Moreover, since the objective is to conceive virtual environments for training, KOBA takes into account several pedagogical constraints in the generation process.

ARCHITECTURE AND MODELS

KOBA is a dilemma generation engine that is integrated in a more global architecture as depicted in Fig. 1. In this section, we expose this architecture and present the different knowledge models used by KOBA to generate dilemmas.

Global architecture

During a training/learning session, the learner is immersed in a virtual environment. This latter consists of a digital environment in which the learner navigates and interacts using standard (e.g. mouse and keyboard) or virtual reality (e.g. Vive headset2 ) devices. In this conceptual architecture, the virtual environment is an external and fully independent module. This modularity makes a clear separation between the semantic representation of the entities and their visual instantiation. It also enables the authors to design and orchestrate the scenario in a distinct layer without worrying about the visual and graphical aspects. In this virtual environment, the learner is exposed to a wide panel of critical and non-critical situations. His actions in these situations are observed by the learner diagnosis module [START_REF] Bourrier | A Multi-Layered Architecture for Analysis of Non-Technical-Skills in Critical Situations[END_REF]). This module is responsible of establishing the learner diagnosis by checking the level of acquisition of each targeted skill. In each iteration, once the diagnosis is established, the module constructs a pedagogical instruction which is sent to the scenario orchestration system (SOS). This instruction is composed of three elements:

 A pedagogical intention: verify, strengthen or destabilize a skill.

 The skill or the set of skills targeted by the pedagogical intention.

 A level of criticality This instruction guides the generation of the next situation. It goes without saying, that the generated situation varies according to the pedagogical intention of the instruction. For example, a situation which intention is to verify the state of knowledge of the learner is naturally different from a situation that aims to destabilize the learner [START_REF] Luengo | Les Rétroactions Épistémiques Dans Les Environnement Informatique Pour l'Apprentissage Humain[END_REF]). In the first case, the system tends to comfort the knowledge of the learner, while in the second case, the system tends to destabilize him in order to warn him about an invalid use of his knowledge. This instruction is received by the generation engine. This latter is responsible of automated scenario generation. It processes the pedagogical instruction and infer the properties that shall characterize the proposed situations. These properties include the critical dimension of the situations (dilemma, ambiguity, unpredictability, etc.). In our work, we cover the case when this property is set to dilemma 3 . This case is handled by KOBA, which is the submodule responsible of generating the dilemmas. It represents our main contribution and it is the core subject of this paper. KOBA uses knowledge models to extract the entities -characters, objects, actions, etc.-with properties that could produce a dilemma situation if put together. This is formulated as scenario goals that are sent to the planner. A scenario goal consists in a state of the world that the simulation needs to reach in order to produce the desired situation (in this case, a dilemma). The planner takes these scenario goals as inputs and tries to find a path to reach these goals without losing the scenario consistency. It uses directives to command the world manager to change the current world state. The world manager is responsible of managing the world model. It notifies the virtual environment when any change occurs in this model, and vice versa.

The knowledge models

The design of virtual environments for training is a collective task that involves several collaborators: domain experts, ergonomists, instructors, computer programmer, etc. These persons use different models according to their field of expertise. Ideally, each type of knowledge should to be represented in a separate model, or at least in a specific view of a central model. This modularity eases the use of the same knowledge in different contexts. In order to generate dilemmas, KOBA needs three types of knowledge. First, it needs the knowledge about the world in order to determine which entities (characters, objects, actions, etc.) can be involved in a dilemma. Second, it needs the knowledge about the activity in order to identify the potential incompatibilities between the actions and the semantic relations between them. Finally, it needs the knowledge about the causality in order to identify the actions that lead to negative consequences. In the following section, we describe the models used to represent these three types of knowledge.

The world model

The world model enables the experts to represent the knowledge related to the world entities, their properties and the relations between these entities. In the literature, there are several models that are used to represent the world knowledge [START_REF] Badawi | Autonomous Agents Interacting With Their Virtual Environments Through Synoptic Objects[END_REF][START_REF] Bille | Using Ontologies to Build Virtual Worlds for the Web[END_REF][START_REF] Chevaillier | {VEHA}, Un Métamodèle d'environnement Virtuel Informé et Structuré[END_REF][START_REF] Kallmann | Direct 3d Interaction with Smart Objects[END_REF]. In our work, for practical reasons, we used the WORLD-DL meta-model proposed by [START_REF] Carpentier | Scénarisation Personnalisée Dynamique Dans Les Environnements Virtuels Pour La Formation[END_REF]. However, any other model can be considered as long as it enables the experts to represent the entities and the semantic relations between them. In WORLD-DL, the entities with their properties are represented through ontology concepts and relations. This representation is not static since it is dynamically updated using operating rules. Fig. 2 illustrates an example of a fragment of a world model. In this example, the world is composed of a Concrete Object "TrafficLight_1" which is an instantiation of the concept TrafficLight. This latter is a subclass of a more general concept which is "TrafficSign" that also includes noentry and stop signs. Along with the cars, these concepts compose the concrete objects of the world. In addition to that, WORLD-DL also enables the authors to define abstract objects (AbstractObject) and agents (Agent) that are all subclasses of the main concept: "Entity".

The activity model

The activity model enables the experts to describe not only the prescribed activity, but also the actual activity as observed in the field. In the literature, there are several tasks models such as [START_REF] Amokrane | Suivi de l'apprenant En Environnement Virtuel Pour La Formation à La Prévention Des Risques Sur Des Sites {SEVESO}[END_REF][START_REF] Edward | Modélisation Décisionnelle de Personnages Virtuels Autonomes Évoluant Dans Un Environnement Pour La Présentation Des Risques Sur Les Sites {SEVESO}[END_REF][START_REF] Gerbaud | {GVT}: A Platform to Create Virtual Environments for Procedural Training[END_REF]Rouillé et al. 2008). In our work, we used the ACTIVITY-DL meta-model [START_REF] Barot | Scénarisation d'environnements Virtuels. Vers Un Équilibre Entre Contrôle, Cohérence et Adaptabilité[END_REF]) first for practical reasons, and second, because it integrates some useful features comparing to the state of the art. ACTIVITY-DL represents the tasks through a hierarchy. Each task has a set of preconditions and postconditions. The formers refer to the conditions that make the realization of a task relevant (contextual preconditions) and physically possible (nomological preconditions4 ). The latter refer to the conditions that have to be satisfied in order to consider that the task is achieved. These conditions consist in a set of assertions. Each assertion is represented by a triplet subjectpredicate-object. Moreover, each taskexcept the leaveshas a temporal constructor. This constructor informs about the temporal relation between the subtasks. It can be sequential, independent of parallel. Furthermore, the tasks can be tagged with any relevant information. To illustrate all these features, an example is presented in Table 1. This example defines a main task "Handle a red light" that is composed of two subtasks: "Slow down" and "Brake". These two subtasks have to be achieved sequentially as specified by the temporal constructor. Moreover, the realization of the task is only relevant if the color of the traffic light is red (precondition). When the task is achieved, the vehicle stops (postcondition). Finally, the task is tagged with two items. The first one informs the system that the person who achieves the task has a high degree of compliance with rules. The second one informs the system that this task may mobilize non-technical skills.

Causality model

The causality model enables the experts to represent the relevant causality links between the world events. CAUSALITY-DL (Barot 2014), for example, is a meta-model based on graphical risk assessment formalisms. Events and actions are represented through graph nodes. The nodes are linked by causality or subsumption links. Also, they can be connected by logical gates (AND or OR). A key element of this model is the notion of barrier. A barrier is an event (or action) that serves to prevent the consequences of an anterior event from happening. It can refer to a task of the activity model. Fig. 3 shows an example of a fragment of a causality model. This fragment describes the fact that there could be a highway code violation if the user runs a stop sign or a red traffic light. This can be prevented by activating the barriers: handle a stop and handle a red light.

AUTOMATED DILEMMA GENERATION

Approach

Our objective is to propose a generation engine that automatically generates dilemmas without having to write them beforehand. In a dilemma, all the possible actions (or not action) lead to negative consequences. We distinguish negative consequences in terms of severity, points loss and normative violations. This shall be detailed in 4.3. Also, we distinguish the prohibition dilemmas from the obligation dilemmas. This is not only a semantic distinction; it is also a structural distinction as the dilemma generation process is not the same. Besides, this prevents the generation engine from missing certain dilemmas due to the different ways in which the knowledge models are filled in by the experts. This shall be detailed in 4.2. Another specificity of our approach is that the exclusivity of the choice is inherent to the scenario and not handled at a graphical layer. To do so, KOBA uses the knowledge models to identify contradictory actions, that cannot be realized simultaneously. Finally, in order to propose the most relevant situation, KOBA takes into consideration a set of pedagogical and scenario constraints. These two last points shall be detailed in the generation process in 4.4.

Formalization of a dilemma

Our approach consists in generating automatically dilemmas using knowledge models that are not predestined, a priori, to model dilemmas. To do so, it is necessary first to represent formally a dilemma situation. This enables the generation engine to identify clearly what are the properties of a dilemma situation, and thus, to extract the elements that can produce the situations that meet these properties. Our formalization is based on the distinction made by [START_REF] Vallentyne | Two Types of Moral Dilemmas[END_REF] between obligation and prohibition dilemmas.

An obligation dilemma is a situation where all the possible actions are mandatory [START_REF] Vallentyne | Two Types of Moral Dilemmas[END_REF]). The necessary condition that have to be satisfied in this case in order to guarantee the dilemma is the following: the actions cannot all be done. In other words, the choice presented to the agent has to be exclusive. In fact, if the agent can realize all the actions, the dilemma is compromised. The challenge of a generation system in this case is to prescribe a state of the world that meets this necessary condition. Let us consider a situation with two actions. Let 𝑎 1 and 𝑎 2 be two actions that can be realized by an agent. For certain reasons, the agent has to do 𝑎 1 . In other words, not doing 𝑎 1 leads to negative consequences 𝑁𝐶 𝑎 1 . For other reasons, the agent has to do 𝑎 2 . In other words, not doing 𝑎 2 leads to negative consequences 𝑁𝐶 𝑎 2 . The necessary condition in an obligation dilemma is that the agent cannot realize both of the actions simultaneously. If it is not the case, the dilemma can still be guaranteed if the realization of both actions lead to negative consequences too. Given all this, an obligation dilemma is formalized as follows:

A prohibition dilemma is a situation where all the possible actions are prohibited. In this case, the necessary condition that has to be satisfied in order to guarantee the dilemma is the following: one action, at least, has to be done absolutely. The challenge of a generation engine is to push the agent to make a choice even if all the actions lead to negative consequences. When all the actions are prohibited, the only positive way out is to do nothing. In order to guarantee the dilemma, this option has to be removed. Thus, it is necessary that the non-choice leads to negative consequences too. Let us consider a situation with two actions. Let 𝑎 1 and 𝑎 2 be two actions that can be realized by an agent. For some reasons, the agent ought not to do 𝑎 1 . In other words, doing 𝑎 1 leads to negative consequences 𝑁𝐶 𝑎 1 . For other reasons, the agent has to do 𝑎 2 . In other words, doing 𝑎 2 leads to negative consequences 𝑁𝐶 𝑎 2 . The necessary condition in a prohibition dilemma is that the agent has to make a choice anyway. To do so, we prohibit the non-choice too. Given all this, a prohibition dilemma is formalized as follows:

Negative consequences

In the previous section, we detailed the formalization of the obligation and prohibition dilemmas. One of the key elements of this formalization is the negative consequences. In our model, we distinguish three types of negative consequences: the severity, points loss and normative violations. We shall detail these three types in the following paragraphs.

The severity corresponds to the degree of damage caused by an action or an event (e.g. hitting a pedestrian). In our model, it is a numerical value associated to the events. It varies from 0 to 10. We consider that an event is negative if this value is strictly greater than 0.

The second type of negative consequences is the point loss. In a simulation, a score can be attributed to the user. In general, it is a performance score that is increased if the user successfully achieves the tasks, and decreased otherwise. This score varies from one context to another. In car driving for example, it can correspond to the driving licence points. In video games, it could refer to life points or the quantity of resources. In our model, the points are numerical values associated to the events. They can refer to anything relevant to the context of the simulation. We consider that an event is negative if this value is strictly lesser than 0.

S(A,NC

) is an obligation dilemma situation if ∃ 𝑎 1 , 𝑎 2 ∈ 𝐴 such as:

¬𝑎 1 → 𝑁𝐶 ¬𝑎 1 ¬𝑎 2 → 𝑁𝐶 ¬𝑎 2 ((𝑎 1 ∨ 𝑎 2 ) ∧ ¬(𝑎 1 ∧ 𝑎 2 )) ∨ (𝑎 1 ∧ 𝑎 2 → 𝑁𝐶 𝑎 1 ∧ 𝑎 2 ) S(A,NC) is a prohibition dilemma situation if ∃ 𝑎 1 , 𝑎 2 ∈ 𝐴 such as: 𝑎 1 → 𝑁𝐶 𝑎 1 𝑎 2 → 𝑁𝐶 𝑎 2 ¬𝑎 1 ∧ ¬𝑎 2 → 𝑁𝐶 ¬𝑎 1 ∧ ¬𝑎 2 )
The last type of negative consequences is the normative violations. Each individual has his own hierarchy of human values. He cherishes some and despises others. In certain situations, realizing an action leads to the violation of one or more of these values. In our model, the values are tags associated to the events. We consider that an event is negative if the violated value is cherished by the user. This situation corresponds to what it is called a moral dilemma.

Dilemma generation process

Now that we have formally defined prohibition and obligation dilemmas, we shall detail in this section the whole process of automated generation. This process is illustrated in Fig. 4. First, depending on which type of dilemmas is concerned, KOBA delegates the fetching to the appropriate submodule. As far as obligation dilemma are concerned, KOBA constructs a list of barriers that lead to negative consequences (1.1). Then, it groups them in pairs if the corresponding actions are contradictory (2.1) or lead to negative consequences (2.2). As far as prohibition dilemmas are concerned, KOBA constructs a list of actions that lead to negative consequences (1.2). Then, it groups them in pairs if the corresponding barriers lead to negative consequences (2.3). At this stage, KOBA has two lists of pairs of actions: one for the obligation dilemmas and one for the prohibition dilemmas. First, it checks if the actions of each pair are compatible in terms of physical instantiation (3.1). Then, it verifies if there is no temporal incompatibility between the actions of each pair (3.2). Once these two verifications are done, KOBA ranks the pairs according to several criteria and selects the highest ranked one (4). Finally, it extracts a state of the world that is conducive to the realization of the pair of actions. All these steps shall be detailed in the following subsections.

Generation of obligation dilemmas

In order to generate obligation dilemmas, KOBA has to identify first the actions that lead to negative consequences if they are not realized. To extract this information, KOBA uses the causality model. An actionor an eventleads to negative consequences if there is a path between this action's node and at least one of the negative consequences nodes (severity, points loss or normative violations). But here, we are interested in the consequences if an action is not realized. Thus, rather than considering the "normal" nodes, KOBA examines the barriers. Let us recall that a barrier prevents its posterior events from happening. Thus, the process of identifying the action that leads to negative consequences if they are not realized, consists in identifying the barriers that lead to negative consequences. Let us take the example illustrated in the Fig. 5. The barrier 𝑏 2 is selected because there is a path between this barrier and the negative consequences node Severity. Likewise, the barriers 𝑏 3 and 𝑏 4 are selected because there is a path between each one of them and the negative consequences node Normative Violations. As for the barrier 𝑏 1 , it is discarded because there is no path between this barrier and any of the negative consequences node. At this stage of the process, KOBA possesses a list of barriers that lead to negative consequences.

According to the formalization, the necessary condition in an obligation dilemma is that the agent cannot realize both actions simultaneously. Thus, to ensure this condition, the actions that are proposed to the agent have to be contradictory. To identify such actions, KOBA uses the activity model. It scans by pairs the set of barriers selected previouslyi.e. actions that lead to negative consequences if they are not realized -, then, for each pair of actions, it examines the postconditions of its actions. If the postconditions are incompatible, then the pair of actions is contradictory. We consider that two conditions are incompatible if they have the same subject and predicate but a different object (e.g. "Vehicle is-stopped true" and "Vehicle is-stopped false"). This process can be compared to the rule-based system proposed by [START_REF] Vanderhaegen | A Rule-Based Support System for Dissonance Discovery and Control Applied to Car Driving[END_REF] that detects inconsistencies in knowledge bases. In this system, the conflict emerges if the conclusion of one rule is the opposite of the conclusion of the other (i.e. 𝑐𝑜𝑛𝑐(𝑅 1 ) = 𝑁𝑂𝑇(𝑐𝑜𝑛𝑐(𝑅 2 )) ). In our models, the NOT is not explicit. It is implied in the semantic of the action (i.e. "Slow down" implies not "to accelerate"). Thus, compared with the previous system, KOBA realizes the conflict detection in a deeper level.

Moreover, according to this same formalization, if the actions are not contradictory, it is still possible to produce a dilemma if the realization of both actions leads to negative consequences too. To identify such actions, KOBA uses the causality model. First, it scans by pairs the set of selected barriers and checks if they also exist as actions in the causality model. Then, it verifies if the actions have an AND gate as a common descendant. If it is the case, the pair is retained. Otherwise, it is discarded. Let us take the example illustrated in Fig. 6. Let us suppose that the selected barriers correspond to the actions 𝑎 1 , 𝑎 2 and 𝑎 3 . The pair {𝑎 2 , 𝑎 3 } is retained because its actions are connected by an AND gate that leads to a negative consequence. As for the pairs {𝑎 1 , 𝑎 2 } and {𝑎 1 , 𝑎 3 }, they are discarded because they are not connected by an AND gate.

Generation of prohibition dilemma

In order to generate prohibition dilemmas, KOBA has to identify first the actions that lead to negative consequences if they are realized. To extract this information, KOBA uses the causality model. It scans the set of actions and checks if there is a path between the action nodes and the negative consequences nodes. According to the formalization, the necessary condition in a prohibition dilemma is that the non-choice leads to negative consequences too. The non-choice here corresponds to not doing both actions. To identify such actions, KOBA uses the causality model. It scans by pairs the actions previously selected and retain the ones that exist also as barriers. Then for each pair, it verifies if the barriers have an AND gate as common descendant. Let us take the example illustrated in Fig. 7. In this example, the pair {𝑏 2 , 𝑏 3 } is retained because the two barriers lead to a negative consequence and are connected by an AND gate. As for the pairs {𝑏 1 , 𝑏 2 } and {𝑏 1 , 𝑏 3 }, they are discarded because 𝑏 1 does not lead to negative consequences.

Instantiation compatibility

At this stage, KOBA has two lists of pair of actions: one list for the obligation dilemmas and another one for the prohibition dilemmas. However, in order to be able to generate a situation that involves one of these pairs of actions, KOBA has to verify that these pairs are temporally and nomologically compatible.

Two actions are nomologically compatible if they can "physically" be instantiated in the same situation. For example, the actions Open a door and Close a door are nomologically incompatible because this would require the door to be physically open and closed in the same time, which is impossible. To identify such actions, KOBA uses the activity model. In particular, it checks the nomological preconditions of the actions. If they are compatible, the pair is retained, otherwisei.e. if the object is different for the same predicate and subjectit is discarded.

Moreover, the actions of the pair have to be temporally compatible. It means that the realization of an action has to be independent from the other. To identify such actions, KOBA uses the activity model. It identifies the actions that have a common ancestor which has a sequential temporal constructor. When two actions are related in some point of the hierarchy by a sequential temporal constructor, it means that the realization of one of them is only possible if the other is already done. Thus, KOBA retains only the pair of actions that are connected by an independent or parallel constructor. 4.4.4 Ranking and selecting a pair of actions At this stage, KOBA has two lists of pair of actions that are instantiable. However, in order to select the most relevant pair, the engine has to rank them. To do so, KOBA attributes a score to each pair according to several constraints. We define two categories of constraints: the pedagogical constraints and the scenario constraints. The formers refer to the properties that a situation has to verify in order to achieve the pedagogical objectives. In our work, we take into account the following constraints:

-The maximum severity of the situation. This constraint is specified if we want to set a limit of severity in order not to frustrate the user. -The minimum severity of the situation. This constraint is specified if we want to keep the situation challenging for the user -The difference of severity. This constraint is specified if we want to increase (decrease) the intensity of the dilemma. We believe that the more this difference is close to zero, the more intense a dilemma will be. -The type of negative consequences. This constraint is specified if we want to target a specific type of negative consequences. It is useful if we want to generate a moral dilemma for example. As for the scenario constraints, they refer to the condition that a situation has to meet in order to achieve the scenario objectives. In our work, we defined the following constraints:

-The probability of instantiation. It refers to the minimum degree of certainty that the generation engine must have regarding the possibility of instantiating a situation involving the pair of actions.

-The time of instantiation. It refers to the maximum theoretical time that the scenario engine can take to instantiateand/or direct the simulation toa situation that involves the pair of actions. The ideal pair of actions is the one that fully satisfies these constraints. However, in practice, there is hardly such a pair. Thus, it is interesting to be able to specify the importance of each type of constraint. In some cases, for example, we would like a dilemma that absolutely respect the pedagogical constraints even if it has little chances to be instantiated. On the contrary, in other cases, we would like a dilemma that has strong chances to be instantiated even if it does not satisfy completely the pedagogical constraints. In order to model such preferences, each type of constraints has a weight. KOBA uses these weights to calculate the global score for each pair of actions as follows:

𝑠 𝑡𝑜𝑡𝑎𝑙 = 𝑠 𝑝𝑐 * 𝜔 𝑝𝑐 + 𝑠 𝑠𝑐 * 𝜔 𝑠𝑐 with 𝑠 𝑝𝑐 being the score of satisfaction of the pedagogical constraints and 𝑠 𝑠𝑐 being the score of satisfaction of the scenario constraints. 𝜔 𝑝𝑐 and 𝜔 𝑠𝑐 are respectively the weight attributed the pedagogical and scenario constraints. 4.4.5 Extraction of a state of the world At this stage, KOBA has a ranked list of pairs of actions. It selects the pair with the highest score and prescribes a world state that is conducive to the realization of the actions of the pair. The prescribed world state corresponds to a partial description of the world in the form of an aggregate of assertions. Concretely, the prescribed world state 𝑤𝑠 corresponds to the aggregation of the preconditions of the actions of the pair: 𝑤𝑠 = 𝑃 𝑎 1 ∪ 𝑃 𝑎 2 , with 𝑃 𝑎 1 and 𝑃 𝑎 2 the respective preconditions of the actions 𝑎 1 and 𝑎 2 . The Fig. 8 illustrates an example of this extraction. In this example, the pair is composed of the following actions: <Handle an aquaplaning, Respect a red traffic light>. Each action has its own preconditions. To handle an aquaplaning, the vehicle has to be aquaplaning (?vehicle :isaquaplaning true). To respect a red traffic light, there must be a red traffic light (?trafficLight :is-active true AND ?trafficLight :has-colour :red). A world state that is conducive to the realization of these actions is described by the aggregation of their preconditions. In this case, it is a situation where there is an active red traffic light and where the vehicle is aquaplaning. This world state is then transmitted to the planner, which is in charge of directing the simulation towards this goal state.

EVALUATIONS AND RESULTS

As we said before, our ultimate objective is to train individuals to use their non-technical skills to handle critical situations, such as dilemmas. However, the purpose of this paper is not to validate that exposing individuals to dilemmas will improve their non-technical skills. We suppose that this assumption is true. The main objective of this work is to validate that it is possible to automatically generate dilemmas using knowledge models without having to write them beforehand. The use of this automated approach would be relevant for complex domains in which the authoring of all the possible situations is impossible.

In order to validate the capabilities of KOBA, it was necessary to realize an experiment in a virtual environment to investigate if the generated situations were perceived as dilemmas. The experiment consisted in exposing the participants to situations of different nature. We wanted to see if in the middle of these situations, the generated ones were perceived as dilemmas. More precisely, we wanted to check if the generated dilemmas were perceived in the same way as the scripted ones. Our hypothesis is that it is true: KOBA generates dilemmas. To validate this assumption, we divided it into three sub-hypotheses:

-𝐻 1 : the participants perceive that they have to choose between at least two options in both of the conditions (generated and scripted). -𝐻 2 : the participants perceive that there is no option without negative consequences in both of the conditions (generated and scripted). -𝐻 3 : the participants consider that they were confronted with a dilemma in both of the conditions (generated and scripted). In order to maximize the immersion, this experiment was conducted in a virtual reality room composed of three large screens. In the middle of the room, we put a Playseat and a Logitech racing wheel as shown in Fig. 9.

Protocol of the experiment

We recruited a total of 20 participants. This number might be relatively low due to the complexity of setting up the experiment and the difficulty in recruiting more participants in a short period of time. All of them played two preliminary scenarios to get familiar with the experiment setup. The preliminary scenarios were pretty simple. They consisted in car driving situations in which the participants have to brake and avoid some obstacles. After that, the participants were exposed to four scenarios: a generated dilemma scenario, a scripted dilemma scenario, a critical scenario and a normal scenario. The last two scenarios served as a camouflage for the others. All the scenarios started by exposing an objective to the participant. We detail below these four scenarios:

-Normal scenario: the player has to join a colleague at the end of the road. The triggered event in this scenario is a visible pedestrian who crosses the road from the pedestrian passage. -Critical scenario: the player has to pick up a colleague who is waiting for him just after the first stop sign.

The triggered event is a hidden pedestrian that suddenly crosses in the middle of the road. If the player does not slow down in time, there is a risk of collision. -Generated dilemma scenario: the player has to pick up a colleague waiting for him at the end of the road. In this scenario, the user is confronted to situations of inevitable collision. -Scripted dilemma scenario: the player has to follow his friend's car because he does not know the place of the rendezvous. In his way, his friend takes a non-entry road. The player has to choose between respecting the highway code and fulfilling his personal objective. The scenarios were presented to the participants in a random order. A scenario terminates if the participant fulfils his objective or if there is an accident. At the end of each scenario, the participants had to fill in a questionnaire, which purpose was to see how they perceived the situations. Its key items were:

-I had the choice between at least two options.

-There was an option without negative consequences.

-I faced a dilemma. These statements were evaluated by the participants by giving a quantitative value based on a seven-level Likert scale [START_REF] Likert | A Technique for the Measurement of Attitudes[END_REF]. Answering these items was only mandatory if the scenario was terminated by a negative consequence (collision, high way code violation or not fulfilling the objective). Once the participants played all the scenarios, we conducted a little session of debriefing in order to discuss their choices. The results of this evaluation are discussed in the following section.

Results

Fig. 10 presents the results associated to the generated and the scripted scenarios. We note that for the scripted scenario, we only have 17 answers out of 20. The three participants who did not answer these questions stated that they simply did not see the non-entry sign and that they would have acted differently if they had seen it. Thus, we did not retain these three participant's answers when comparing the generated and scripted scenarios. 10 shows the participants' answers to the three questions stated in section 5.2 for the scripted and the generated dilemma scenarios. The horizontal axis represents the Likert scale, while the vertical axis represents the number of participants. These results shall be discussed in section 5.3.

We recall that our purpose was to investigate if the generated dilemma scenario was perceived in the same way as the scripted scenario. In other terms, we wanted to verify if there was a significant difference between the answers of the generated and the scripted dilemma scenarios. To do so, we used the Wilcoxon signed-rank test [START_REF] Wilcoxon | Individual Comparisons by Ranking Methods[END_REF]. This test compares two measures of a quantitative variable carried out on the same subject. Concretely, it verifies the hypothesis that the average difference between the two measures is null. This hypothesis is rejected if the Just before the incident (collision, highway code violation or failing to achieve the objective), I had to choose between at least two options Generated Scripted p-value is lesser than 0.1. We used this test to compare the answers to the questions that serves to verify our three sub-hypothesis. The Table 2 gives a summary of the test results. The table shows the p-value related the test of the three hypothesis stated in section 5.

Results interpretation

For the generated dilemma scenario, 80% of the participants stated that they had to choose between at least two options. Thus, it may be deduced that, in absolute terms, KOBA managed to generate situations that present different options to the users. Besides, we compared this result with the scripted dilemma by using the Wilcoxon test. This latter returned a p-value of 0.41. Thus, there was no significant difference between the two scenarios. Therefore, the hypothesis 𝐻 1 is verified.

Moreover, 75% of the participants stated that in the generated dilemma scenario, there was no option without negative consequences. Thus, it may be deduced that, in absolute terms, KOBA managed to generate situations that lead to negative consequences no matter was the user action. Besides, we compared this result with the scripted dilemmas scenario by using the Wilcoxon test. This latter returned a p-value of 0.13. Thus, there was no significant difference between the two scenarios. Therefore, the hypothesis 𝐻 2 is verified.

Furthermore, 70% of the participants considered that they were confronted with a dilemma in the generated scenario. It may be deduced that, in absolute terms, KOBA managed to generate situations that are perceived as dilemmas. Besides, we compared this result with the scripted dilemmas scenario by using the Wilcoxon test. This latter returned a p-value of 0.68. Thus, that there was no significant difference between the two scenarios. Therefore, the hypothesis 𝐻 3 is verified.

All in all, in absolute terms, it may be deduced that KOBA managed to generate situations that present different options to the user. Also, it managed to generate situations that lead to negative consequence whichever is the option selected by the user. Besides, there was no significant differences between the generated dilemma scenario and the scripted one. Therefore, it may be deduced that KOBA managed to automatically generate dilemma situations without having to write them beforehand.

CONCLUSION

Our work is related to virtual environments for training. In particular, we were interested in generating critical situations in order to foster the development of non-technical skills. In this paper, we focused on a particular type of critical situations: the dilemmas. We argued that automated generation of these situations is a relevant approach to tackle the problem of "authoring bottleneck". Thus, we proposed KOBA: a generation engine that automatically produces dilemmas from knowledge models that are not intended, a priori, to model dilemmas. We distinguished two types of dilemmas: the prohibition dilemmas and the obligation dilemmas. For each one of them, we proposed a formalization that states the necessary conditions that need to be met in order to consider that a situation is a dilemma. Based on this formalization, we proposed KOBA, a generation engine that takes into consideration the pedagogical and the scenario constraints of the simulation. We validated this generation process with an experiment in car driving simulation. The results showed that there was no significant difference between how the generated dilemma and the scripted dilemma were perceived.

To enhance the current work, it would be interesting to improve how moral dilemmas are generated. As far as they are concerned, it is necessary to take into consideration the moral profile of the person. In our work, we proposed a simple representation of this moral profile based on the theory of universal value of [START_REF] Schwartz | The Refined Theory of Basic Values[END_REF]. This representation could be enhanced by using an uncertainty framework that quantify the uncertainty, the ignorance and also the conflict that the system has about each moral value. This will enable the system to identify which moral values it could be interesting to challenge. Also, in order to update this moral profile, this framework should provide the system with information fusion techniques. We believe that the theory of belief functions [START_REF] Shafer | 1 A Mathematical Theory of Evidence[END_REF]) would be a serious track to consider.

Fig. 1

 1 Fig. 1 Architecture

Fig. 2

 2 Fig. 2 Fragment of a world model using WORLD-DL

Fig. 3

 3 Fig. 3 Example of a causality model

Fig. 4

 4 Fig. 4 Dilemma generation process

Fig. 5

 5 Fig. 5 Searching for barriers that lead to negative consequences

Fig. 6

 6 Fig. 6 Search for actions that are connected with AND gate

Fig. 7

 7 Fig. 7 Search for barriers that are connected by and AND gate

Fig. 8

 8 Fig. 8 Extraction of a world state

Fig. 9

 9 Fig. 9 Virtual reality room

Fig. 10

 10 Fig. 10Results of the generated and scripted scenario Fig.10shows the participants' answers to the three questions stated in section 5.2 for the scripted and the generated dilemma scenarios. The horizontal axis represents the Likert scale, while the vertical axis represents the number of participants. These results shall be discussed in section 5.3.We recall that our purpose was to investigate if the generated dilemma scenario was perceived in the same way as the scripted scenario. In other terms, we wanted to verify if there was a significant difference between the answers of the generated and the scripted dilemma scenarios. To do so, we used the Wilcoxon signed-rank test[START_REF] Wilcoxon | Individual Comparisons by Ranking Methods[END_REF]. This test compares two measures of a quantitative variable carried out on the same subject. Concretely, it verifies the hypothesis that the average difference between the two measures is null. This hypothesis is rejected if the

Table 1 -Example of a task model

 1

	Task	Handle a red light
	Subtasks	Slow down
		Brake
	Constructor	Sequential
	Conditions Preconditions	(?light :has-color :red)
	Postconditions	(?vehicle :is-stopped true)
	Tags	Conformity: 5 (out of 5)
		Technical skill: true

Table 2 p

 2 -value result of the Wilcoxon

		𝑯 𝟏	𝑯 𝟐	𝑯 𝟑
	p-value	0.41	0.13	0.68

The constructivism is a learning theory that suggests that people construct their own understanding and knowledge, through experience and reflecting on those experiences[START_REF] Piaget | La Naissance de l'intelligence Chez l'enfant[END_REF][START_REF] Vygotsky | Mind in Society[END_REF]. Situated learning is a theory that suggests that learning is a function of the activity, context and culture[START_REF] Lave | Situated Learning: Legitimate Peripheral Participation[END_REF]

https://www.vive.com/fr/

According to[START_REF] Goel | Sketches of Thought[END_REF] "Nomological constraints are constraints dictated by natural law".