日本ソフトウェア科学会第 37 回大会 (2020 年度) 講演論文集

Identifying Hazard-causing Parameters for
Automotive Driving Systems
Xiao-Yi Zhang, Paolo Arcaini, Fuyuki Ishikawa
Safety analysis of automotive systems is highly demanded, as failures in such systems can lead to dramaticconsequences. Usually, these systems are aﬀected by some variabilities, including the production parameters (e.g., the car power, or the braking force) and environmental parameters (e.g., dry or slippery road).
These variabilities may drastically aﬀect the system performance and hence the safety guarantees. In thispaper, we propose an approach to explore the relation of the variabilities in automotive systems with theoverall safety. Specifically, we take Spectra-Based Fault Localization (SBFL), a technique in the domain ofsoftware engineering as a baseline, and adapt it to the context of automotive driving systems based on thefuzzification of each system parameter. Through our approach, we can better understand which parameters
can be the factors in causing system hazards. Our approach has been experimented on a Simulink model
provided by our industrial partner. Critical factors that related to the hazard were identified and explained.
This paper is a summary of the work published in the proceeding of ICECCS 19.

nents is more challenging. Specifically, the follow-1 Introduction

ing issues should be addressed:

Cyber-physical systems (CPS), integrating both

1. how to characterize the system components

computational modules and physical phenomena,

whose output could be continuous values;

have been extensively developed recently. In our

2. how to quantify the system hazard;

project [2], driven by our industrial collaboration

3. how to calculate the proneness of each systemwith an automotive company, we consider auto-component in causing a hazard.

motive systems (having diﬀerent levels of automa-

In this paper, we adapt Spectra Based Fault Lo-tion). Errors in Cyber-Physical Systems (CPS), es-calization (SBFL) [4], a typical technique in thepecially in automotive driving systems, may lead todomain of software debugging to the context of au-

disruptive economic and social damages. There-

tomotive systems. SBFL aims to find the compo-fore, once some failures (e.g., collisions) are de-nents suspicious to cause program failures based

tected during the simulation of an automotive driv-on the execution information of a given test suite.

ing model. Then, making a hazard analysis to trace

Taking the advantages of SBFL, we propose an ap-

the most unsafe component is essential. However,proach to analyze the hazard of automotive systems

due to the complexity of the structure of automo-

involving diﬀerent variabilities.

tive systems, tracing the hazard-causing compo-

Currently, simulation-based validation (as falsification) checks a single automotive product oper-

Xiao-Yi Zhang, Paolo Arcaini, Fuyuki Ishikawa, 国立情 報 学 研 究 所 ア ー キ テ ク チャ科 学 研 究 系, Information Systems Architecture Science Research Division, National Institute of Informatics.

ated in some given environmental conditions undersome given driving inputs. Our work is inspiredby a real-life case study provided by our industrial

partner. It is a Simulink model of a vehicle col-sign each parameter p with a value v. If a concrete

lision avoidance system, which is also adopted asvalue v is given to each parameter p, an executable

the benchmark in our case study. Our approach

simulation instance, denoted by M(v1 , . . . , vn ) can

assumes the targeted system can be modeled bybe constructed. Then, we can run M(v1 , . . . , vn )Also, we take the model parameters,and obtain, as output, a signal over time o. Here,

which reflect the system variabilities (e.g., the car

we define a simulation instance t as the pair t =power and the braking force), as the system com-⟨(v1 , . . . , vn ), o⟩.

Simulink.

ponents to investigate.

Problem Statement. Given system model M

Specifically, given the Simulink model of the sub-and the set of simulation instances T in which eachject system, on the one hand, we repeatedly simu-t ∈ T has already been executed, assume M islate the system and, for each simulation instance,subjected to hazard (i.e., some simulations t ∈ T

we record the simulation data, including the values

can cause system failures). Then, the fundamentalof the investigated parameters and the hazard de-problem is:gree, indicating the degree of violating the safety requirement under consideration. On the other hand,

How to identify and analyze the parameters p ∈ Pthat are the major causes of system hazard?

we discretize the domain of each system parameter through fuzzification and describe each parti-

3 Approachtion as a fuzzy set associated with a concept (e.g.

Fuzzification of parameters. To character-“large” and “very small”, etc.). Finally, based onize system parameters, the concept fuzzy set bor-

the simulation results and the characterization ofrowed from fuzzy logic is introduced. Consider-the system variabilities (i.e., parameters), we use aing a parameter p defined in the domain D, let“metric” of spectrum analysis of SBFL to assign ap
F p = {f1p , f2p , . . . , fmp } denote the set of fuzzy setshazard impact degree to each fuzzy set, indicatingthat describe certain concepts of p. Each fuzzy

the proneness of that fuzzy set of being a hazard

set fip ∈ F p is defined by a membership function.

factor. From our analysis, we can infer which sys-Then, for each concrete value v of p, fip can assign

tem parameters are the factors in causing hazard

a membership degree within the range of [0, 1], i.e.,

and why these parameters can cause the hazard.

fip : D → [0, 1], indicating the degree that v belongs

This paper is a summary of our previous hazard
assessment framework published in ICECCS’19 [5].

to fip .
Fuzzy-set-based

coverage.

Suppose we

Our approach is experimented on an industrial arti-

have simulation instance t with parameter values

fact for automotive driving, and explainable results(v1 , . . . , vn ). Define the coverage of a specific pa-about system hazards are obtained.

rameter p with value v over simulation t as the vecp
tor C p,t = [f1p (v), f2p (v), . . . , fmp (v)], where for each

2 Problem Description

fuzzy set fip we have fip ∈ F p . Furthermore, de-System model. Let M be the model of thefine the term fuzzy-set-based coverage of the entire

hybrid automotive system under analysis. We as-model M over simulation t as C t = {C p,t |p ∈ P }.

sume that the components of M can be described

In this way, given a specific simulation instance t,

as a set of parameters P = {p1 , . . . , pn }, in which

we can quantify the degree each fuzzy set of each

each parameter pi has its own definition domain

system parameter covered by t.

Di . M is configurable. That is to say, we can as-Hazard degree. Considering a specified safetyrequirement φ of M, the satisfaction of φ over agiven simulation t can be quantified as γφ (t) within

表1System parameters

the domain of system falsification [6]. Then, we

Name
Unit Domain
T safesecond[0, 5]
Radius tire meter [0.3, 0.37]
Power maxkW
[70, 130]
Torque max
Nm[150, 450]
Weightkg[800, 1500]

calculate the hazard degree of t, denoted by h(t), as(a) Production

the interval [0, 1], indicating how strongly φ is satisfied. Note that the concept of φ is borrowed fromh(t) = 1 − γφ (t). Given a simulation instance t, byName
Unit Domain
T init second[1, 5]
A backG[0.1, 1]T behav second [0.5, 5]
V initkm/h [20, 160]
R gear
[2.5, 10]
Ay init[0, 0.5]
Myu road[0.2, 1]

calculating the hazard degree h(t), we can measure
how close that the result of executing simulation
instance t to the occurence of system failures (i.e.,the degree that t exposes the hazard).
Hazard assessment. Finally, we try to assign a(b) Enviromental

hazard impact score for each parameter p, indicating the relation of p to the hazard by means of thefip to the safety at t. Then we sum fip (v) · h(t)hazard degree. The basic heuristic of our work isfor each t to calculate ahi ; and, similarly, we sumsimilar to that of SBFL. Specifically, the ith fuzzy

fip (v) · (1 − h(t)) for each t to calculate asi . Fi-

set fip of parameter p is covered by more hazard-

nally, we use a metric, involving both asi and ahi

causing simulation instances; then, it is likely that(i.e., the Tarantula metric for SBFL [3]), to calcu-

fip is more likely to be the factor of system haz-late the final hazard impact score of the fuzzy set

ard. To do this, we introduce the scoring metrics

fip , denoted by Φ(fip ):fp

ffpp

fp

from SBFL and extend it to our context. Givenp

the model M and the set of simulation instancespp

Φ(f p ) = afh /(afh + afs )(3)

T , for each simulation t ∈ T , we know C and h(t).

Output of our approach. After hazard assess-Then, given a specific fuzzy set fip of parameter p,ment, we rank all the fuzzy sets of all the parame-i.e., fip ∈ F p , we use

ters according to their hazard impact scores Φ(fip )tpfiah∑ p=(fi (v) · h(t))(1)

in descending order and provide a rank list as theto measure the degree that fip is covered by hazard-

output of our approach. In the rank list of fuzzy

causing executions. Similarly, concerning systemsets, the fuzzy sets of parameters with higher ranks

safety, use

can have a strong relationship with the hazards,t∈Tpfias =∑fip (v) · (1 − h(t))(2)

t∈Tto measure the degree that fip is covered by non-whereas those with lower ranks are less related tothe hazard.

4 Case Study

hazard executions.
fp

fp

Note that ahi and asi represent the degrees thatfuzzy set fip of parameter p contributes to the hazard and safety, respectively. Specifically, if t covers fuzzy set fip at fip (v) degree, then we consider the term fip (v) · h(t) as the contribution of
fip to the hazard at t.

Oppositely, we consider

the term fip (v) · (1 − h(t)) as the contribution ofModel description. To examine the eﬀectiveness of our approach, we introduce the experimental results in [5]. The benchmark is a Simulink
model of a collision avoidance system of an automotive vehicle provided by our industrial partner. In the basic situation, the vehicle drives on astraight lane and spots an obstacle in front. Whenthe driver pushes the brake pedal, an active safetyand f (Ki ) = 1. Then, the seven fuzzy sets determine a regular fuzzy partition [1], i.e., they haveequidistributed kernel centers K1 . . . K7 , with Ki =Si−1 = Si+1 for i ∈ {2, . . . , 6}, K1 =dl , and K7 =du .
図1The membership functions of the fuzzy
sets of parameter t saf e

For example, for parameter T safe having domain
T safe[0, 5], fST safe (1) = 0.8 and fSS(1) = 0.2.

Definition of hazard degree. The basic safety
feature is triggered to decide whether and when torequirement φ of this model is described as follows:

shut down the engine if it is necessary to avoid an“The car should stop before dTh meters from the ob-accident. The system has both production parame-

stacle and, if not possible, it should stop as soon as

ters related to the type of the car and environmen-

possible before the obstacle.” The robustness sat-tal parameters related to the road condition andisfaction γφ gives a quantitative characterization

initial behavior of the car. All the model parame-of the satisfaction/violation of φ. The robustness

ters and their types are listed in Table 1.

that, the inter-vehicle can also be a static obstacle.

value of asimulation t is defined as follows:
0mindis(ot ) = 0Tht)
γφ (t) = d /3+mindis(o0 < mindis(ot ) < dTh
4dTh /31mindis(ot ) ≥ dTh(4)Upon spotting the obstacle, the driver will push thewhere mindis computes the minimum distance inbrake pedal after T behav, and the active safety

the output signal.

feature will shut down the engine after T safe.

of the safe distance. If the minimum distance is

The evasive backward acceleration is A back, andlarger than or equal to dTh , then t is consideredthe ratio between engine RPM and wheel RPM

as completely safety; in the experiments, dTh has

is R gear.

The vehicle has tires with a radiusbeen set to 30. If mindis(ot ) reaches 0, it indi-equal to Radius tire, an engine with the maxi-

cates that the collision occurred during simulation

mum horsepower and torque equal to Power max

and the robustness value will be 0.

The initial distance between the car and theobstacle is the product of the initial inter-vehicle
time T init and initial vehicle speed V init. NoteIn (4), dTh is the threshold

ThFinally, ifand Torque max, respectively, and weights Weight.

0 < mindis(ot ) < dMyu road describes the friction of the road, anddid not occur, but the vehicle was not completely

Ay init is the initial lateral force.

safe during the simulation. In order to distinguish, it means that the collision

Fuzzification of the systems parameters.

the cases of complete collision and close to collision,

For this benchmark model, since we do not have

we set the minimal robustness γφ of close to colli-extra domain knowledge, for each parameter psion to 0.25. Then, we calculate the hazard degree

having domain D=[dl , du ] (see Table 1), we de-of t by h(t) = 1 − γφ (t) as discussed above. Notepp
fined seven triangular fuzzy sets fVS, fSp , fSS,that γφ is normalized within [0, 1].

pppfM, fSL, fLp and fVL, indicating the concepts ofResult and Analysis. For the case study, we“Very Small”, “Small”, “Slight Small”, “Medium”,

run 10000 independent simulations and collected“Slight Large”, “Large”, and “Very Large”. A tri-the results in T . Then, we calculated the hazard

angular fuzzy set fip

impact score for each fuzzy set of each parameteris defined by a lower bound

Si , an upper bound Si , and a kernel center Ki
with Si < Ki < Si and fip (Si ) = fip (Si ) = 0(see Eq. (3)). The results are shown in Table 2.
The result is the rank list of diﬀerent fuzzy sets of表2

Hazard Impact Score – Ranked list R of parameters fuzzy sets

Rank Parameter Fuzzy setRankParameter Fuzzy set1T initVS16T behav

SL

2A back

VS

17Power maxSL

3V initVS

18R gearSL

4T safe

VL

19

T safeM

5T safeL

20

R gearL

6Weight

VS...

...

...

7

V initS

76

V initSL

8T safeSL77

T initSS

9

T behav

VL

78

V initVL

10

T behav

L

79

V initL

11

T initS

80

T safeVS

12Power max

VL

81

T initM

13Power maxL82

T initSL

14

A backS

83

T initVL

15

WeightS84

T initLdiﬀerent system parameters presented in Table 2.

tive driving systems. Our approach relies on a set

From these results, we can get an overall pictureof system simulations and attaches a hazard im-of the potential factors leading to the hazard ofpact score to each system parameter.

collision. For diﬀerent parameters and fuzzy sets,

can assess and explain the system hazard better

hazard impact scores are also diﬀerent. For ex-

based on the rank list according to these hazard

ample,

T initfuzzy set fVS

Then we(i.e., very small values ofimpact scores. Our approach is based on a lighted-T init) ranks the first, indicating that when theweighted technique, Spectrum-Based Fault Local-

initial inter-vehicle distance is “very small”, it isization (SBFL), to deal with the complex struc-more likely that the hazard (i.e., the collision) oc-

ture of automotive systems. Meanwhile, we intro-curs. In addition to this, from the rank list of fuzzy

duce fuzzy sets to characterize the various systemsets, we can observe that the collision may be po-parameters, which makes our results more under-

tentially caused also by the low ability of backward

standable and explainable. On the other hand, ourA backacceleration (i.e., when A back belongs to fVS),

work generalizes the SBFL technique itself to thethe very small initial velocity (i.e., V init belongs

domain automotive systems, which improves its ap-V init
to fVS), and the long time needed by the safety

plicability.

T safeequipment to activate (i.e., T safe belongs to fVL

or fLT safe ).

Acknowledgment The authors are supportedby ERATO HASUO Metamathematics for Systems
Design Project (No. JPMJER1603), JST. Funding

5 Conclusion

Reference number:In this paper, we introduce an approach to iden-ATO.

tify hazard-causing system parameters for automo-

10.13039/501100009024 ER-参 考 文 献[1] Guillaume, S., Charnomordic, B., and Loisel, P.:
Fuzzy partitions: A way to integrate expert knowledge into distance calculations, Information Sciences, Vol. 245(2013), pp. 76–95.
[2] Hasuo, I.: Metamathematics for Systems Design,
New Generation Computing, Vol. 35, No. 3(2017),
pp. 271–305.
[3] Jones, J. A., Harrold, M. J., and Stasko, J.: Visualization of test information to assist fault localization, Proceedings of the 24th international conference on software engineering (ICSE’02), ACM,
2002, pp. 467–477.
[4] Xie, X., Chen, T. Y., Kuo, F.-C., and Xu, B.:

A Theoretical Analysis of the Risk Evaluation Formulas for Spectrum-based Fault Localization, ACM
Trans. Softw. Eng. Methodol., Vol. 22, No. 4(2013),
pp. 31:1–31:40.
[5] Zhang, X.-Y., Arcaini, P., and Ishikawa, F.: Assessing the Relation Between Hazards and Variability in Automotive Systems, 2019 24th International
Conference on Engineering of Complex Computer
Systems (ICECCS), IEEE, 2019, pp. 190–199.
[6] Zhang, Z., Ernst, G., Sedwards, S., Arcaini, P.,
and Hasuo, I.: Two-Layered Falsification of Hybrid
Systems Guided by Monte Carlo Tree Search, IEEE
Transactions on Computer-Aided Design of Integrated Circuits and Systems, Vol. 37, No. 11(2018),
pp. 2894–2905.