## 3 Proposed Methodology  
This research focuses on proposing a model-based test case generation method for the analysis of the effects of predictable faults on the SoS functionality at the design stage, containing an algorithm to enhance the automation ability in the process. Therefore, our primary objective was not to maximize a given coverage metric, but rather to identify the minimum number of independent events that could cause a hazardous state in the SoS to be reached.  
In the context of an SoS, test case generation based on fault injection aims to increase stakeholders' confidence in the SoS robustness from a quality assurance perspective. The generated test suites can be used to simulate the behavior of the SoS in the presence of a specific sequence of faults evaluating the correct capability of detecting and tolerating faults.  
Evaluating the safety aspects of an SoS is of paramount importance due to the complex emergent and unexpected evolutions it may expose. In particular, an unsafe behavior may result as a consequence of the following SoS characteristics [38; 39; 40]:  
1. Evolutionary development: an initial design that is considered safe in a first development iteration can expose unsafe behaviors as a consequence of the addition of new services or the modification of existing functions in successive design iterations.
2. Operational and managerial independence: the integration of systems that are reliable and safe with respect to local hazard conditions can be unsafe from an SoS point of view due to the inherent independence of the CSs from both an operational and a managerial standpoint.
3. Emergent behavior: all potential unsafe behaviors should be detected and properly evaluated by the SoS designers. For an industrial SoS, it is difficult to avoid unsafe behaviors due to the loose coupling of the CSs and the evolutionary nature of their design. Hence, the identification of hazardous chain of events is fundamental to evaluating the safety of the entire SoS.  
The SoS test generation methodology is summarized in Figure 1. During the first phase, modeling, different models of the SoS are produced: (i) a first model of the SoS is produced using the Unified Profile for DoDAF and MODAF (UPDDM) standard; (ii) a model of error behaviors is then specified (SoS error model), which contains a description of faults that can affect the CSs and the effects of the faults on their behavior (failure modes), but the detection and protection mechanisms are not modeled; and (iii) the error model is further elaborated including the fault detection and isolation (FDI) mechanisms as well as recovery procedures.  
In the second phase, generation, three test generation scenarios are envisioned: (i) the error model is elaborated by a scenario generation that identifies how the SoS can evolve to a hazardous state specified as an external predicate by the user; (ii) the scenarios generated at the previous step are exploited to produce fault-injection-based test cases that can be  
Figure 1: SoS test case generation methodology designed with two phases, modeling and generation.  
used to exercise a fault-tolerant model of the SoS or as a driver for the effective robustness test of a new CS under development; and for each fault detection mechanism modeled as a monitor component, a specific fault injection test suite is produced automatically deriving the fault injections that enable the FDI process. The generation steps we designed are detailed in the following subsections.