## 6 Conclusions  
To enhance the capability of SoS model verification and improve the robustness of SoS architecture design, we proposed an ATG method for an SoS with fault injection and model-based systems engineering as the foundations. An SoS was modeled as a UPDM artifact that contained formal models of accident events, fault occurrences, and hazardous states. The hazardous behaviors could be caused by three types of issues, including single design flaws within a single CS model or interactions between CSs, combinations of multiple flaws within a CS model, and the emergence of dangerous behaviors after the CSs were integrated into the SoS. It is the responsibility of the ATG to generate a set of meaningful test cases identifying such unsafe emergent behaviors and it is fundamental to impose assumptions on the occurrence of the events in order to derive meaningful test cases. The proposed ATG method involved both modeling and analysis activities, consisting of a two-phase ATG approach and a test generation algorithm. The first phase of the designed ATG approach was modeling, which produced UPDM models with faults' description, behaviors' effects, and FDI mechanisms. The second phase of the designed ATG approach was generation, which covered three envisioned generation scenarios, and an algorithm supported the test generation activity by deriving the fault injections that enabled the FDI process. This method was dedicated to automatically identify some input trajectories as test cases for design verification; specifically, the test cases were used to detect hazardous behaviors in CSs and SoS models. In order to show the applicability of the proposed method, a specific embodiment of the CAE use case, a simplified ER SoS, was described. By generating three scenarios as the test cases exposing different hazardous behaviors in this CAE SoS model, we demonstrated the feasibility of the ATG method proposed in this paper. Compared with a manual test case \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Test Case ID**} & \multirow{2}{*}{**Step No.**} & \multicolumn{5}{c}{**Events Sequence**} \\ \cline{3-6}  & & _heOnFire_ & _evCarFailure_ & _evGo_ & _evOnFire_ & _faComm_ \\ \hline SC-01 & 0 & Present & Absent & Absent & Absent & Absent \\  & 1 & Absent & Absent & Present & Present & \\  & 2 & Absent & Present & Present & & \\ \hline SC-02 & 0 & Present & Absent & Absent & Absent & Absent \\  & 1 & Absent & Absent & Absent & Present & Present \\ \hline SC-03 & 0 & Present & Absent & Absent & Absent & Absent \\  & 1 & Absent & Absent & Present & & \\  & 2 & Absent & Absent & & Present & \\  & 3 & Absent & Absent & & \\  & 4 & Absent & Absent & & \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Part of the scenarios automatically generated by the proposed ATG methodology as the test cases for the CAE. analysis and design, the proposed method improved the work efficiency. More importantly, our ATG method provided the ability to detect hazardous states in SoS design verification. More work is still required to refine the method to support constraints' adjustment for complex SoS models. In the current process, FDI mechanisms and SoS constraints are manually specified in the relevant models through the modeling phase. Our further research work will mainly focus on designing fault injection constraints as parameters and upgrading the designed ATG algorithm and approach to support tuning constraints' parameters. In addition, specific ATG methods and applications for different categories of SoS and modified ATG for more system languages are follow-up research directions that need more effort. Conceptualization, methodology, and software, Y.T. ; validation, Y.T. and D.J. ; formal analysis, investigation, and resources, Y.T. ; data curation, Y.T. ; writing--original draft preparation, Y.T. ; writing--review and editing, D.J. ; project administration and funding acquisition, Y.T. All authors have read and agreed to the published version of the manuscript.