## 4 Fault Localization Method
### Partitioning by the Stack  
The partitioning method by the stack involves partitioning the data section using itself and the stack data section. As shown in the flow chart of Figure 8, the files from a binary file (executable) about an ECU acquired by using the values set stored on the stack and binary utilities are utilized. For each file that is acquired, the configuration information of the memory section (section file (SEC)) and the function-call information (call file (CALL)) are acquired by the objdump program. The memory-allocation information of each symbol (symbol file (SYM)) is acquired by a gnu binary utility program [25]. The stack accesses the address values from bottom to top according to the default address-size of the system. Partitioning the data section by the stack is carried out in three stages. First, we partition the stack into control-section units using the value stored in the stack and the section file. Then, we identify each control section using the symbol and call files. Finally, we partition the data section used by each control section. An explanation of each of these steps is given by using the example of Figure 9.  
**Step 1**: Partitioning the stack section  
In this step, we partition the stack section into CS units (Figure 8(1)-(5)). The CS structure is in the form ((local variable) *, LVG *, RA, SP) (Here, * means that occurs over zero or more than once, LVG is  
Figure 8: Flowchart of partitioning the data section using the stack.  
Figure 7: Algorithm for partitioning the data section by memory map.  
local variable sheared with global, RA is return address, and SP is stack pointer). We now turn our attention to Figure 9. If we read the value of the stack (Figure 9a) with memory allocated from the bottom address, this can be represented by (address, value) pairs (Figure 9b). If we check the values from the bottom address based on the flow chart, the address 40004028 is a local variable because it does not correspond to the address range of the SEC file (Figure 9f; cf. Figure 8()). The next address 40004024 is the LVG. In this address, 40000F20 is included in the scope of the data section of the SEC file (Figure 9f; cf. Figure 8()). In the same way, address 40004020 is the RA (Figure 8()). However, the value in address 4000401C is 0000000, and address 4000401C is the SP because the first SP in the stack points to the starting address of the entire memory. If we find the SP depending on Figure 8(), the CS index is increased. If this process is repeated until the top address is reached, it is possible to partition the stack into CS units (Figure 8()), as shown in Figure 9c. In this way, the task of partitioning the stack into CS units is repeated during the total frame. Each CS with the same RA is considered an identical CS because it is judged to be used by the same function.  
**Step 2**: Identifying the control section  
We identify the information in each CS (Figure 8(),()). As we confirmed in the previous step, address 40004020 in Figure 9 is the RA, and its value is 0004A5E8. In the SYM file (Figure 9g), 0004A5E8 is included in the range of Func_A. Func_A is known to call Func_B in the CALL file (Figure 9h). In other words, Func_A is the function of the first CS and has Func_B as the caller. If this process is performed for each CS, it is possible to obtain a CS list as shown in Figure 9d.  
**Step 3**: Partitioning the data section  
Finally, the data section is partitioned by the LVG in each CS (Figure 8(),()). We make reference points for partitioning the data section using each LVG and CS in Figure 9e. If these reference points are sorted, the data section is partitioned as shown in Figure 9i. The LVG is the boundary for partitioning the data section. Therefore, the more LVGs stored on the stack, the more finely the data section can be partitioned. This process is represented as the algorithm in Figure 10.