## 5 Evaluation
### Testbed for Fault Injection  
For the evaluation, we have constructed the SUT with an NXP MC9S12X [25] family ECU and OSEK/VDX-based SW. Figure 9 shows the HiL environment used for testing. As shown in the figure, the environment consists of an SUT with three ECUs, a test executor, a test interface and a monitoring system that collects and stores memory. Consisting of three separate ECUs, the SUT has 10 unit functions that handle steering and forward functions (N1), communication and vehicle propulsion (N2) and peripheral sensing and rearward functions (N3). Therefore, the memory region used by each unit function is statically allocated to each node.  
Figure 8: Example of Finding the Faults in the “Adv Emergency Stop Signal”.  
The fault is injected by the mutation method [26]. Because the proposed method targets faults after a successful unit test is completed, the fault to be injected must pass the unit test but fail the integration test. In Table 2, the 80 C language mutation operators are classified according to their applicability to each function and the passage of the unit test is confirmed. Table 3 shows the faults injected for each function. In Table 3, we did not use VTWD and ORRN for fault injection. VTWD mutates the variable by adding or subtracting 1, so the result is similar to CGCR. ORRN mutates a relational operator in an \"if\" statement and behaves similarly to a STRI that forces the state in an \"if\" statement. Therefore, among all mutation operators, operators with similar operations are not applied. Table 4 summarizes the mutation operators used in the experiments [26].  
\begin{table}
\begin{tabular}{c c c c} \hline \hline \multirow{2}{*}{**Function**} & **Number of Unsuitable** & **Number of Unit Failure** & **Unit Pass Operators** \\  & **Operators** & **Operators** & **Unit Pass Operators** \\ \hline Turn Signal & 67 & 12 & OEBA * \\ AEBS & 47 & 30 & SSDL, VTWD, CGCR \\ Driving & 50 & 28 & STRI, ORRN \\ Mode & 61 & 18 & OCNG \\ Rear lamp & 51 & 26 & VTWD, CGCR, CGSR \\ \hline \hline \end{tabular}
* See the Table 4.  
\end{table}
Table 2: Mutation operator selection for fault injection.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline \multirow{2}{*}{**Index**} & **Node** & **Function** & **Mutation Operator** & **Fault** \\ \hline
1 & Front Turn Signal & OEBA * & Malfunction due to consecutive commands \\
2 & 1 & Head lamp & OCNG & Illumination change error \\
3 & & Steering & CGSR & Steering angle change error \\ \hline
4 & & & SSDL & Distance change error \\
5 & 2 & AEBS & CGCR & Operation in the reverse mode \\
6 & & & STRI & Mode change while accelerating \\
7 & & & STRI & Increase internal variable in the parking mode \\ \hline
8 & & Rear Turn Signal & OEBA & Malfunction due to consecutive commands \\
9 & & Brake lamp & CGSR & Malfunction due to accelerator pedal condition \\
10 & 3 & Emergency stop signal & CGCR & Operation in the reverse mode \\
11 & & Rear alert & OEBA & Distance change error \\
12 & & Adv. Emergency stop signal & OEAA & Malfunction due to the existing command state \\ \hline \hline \end{tabular}  
* See the Table 4.  
\end{table}
Table 3: List of fault injection by the selected mutation operators.  
Figure 9: HiL test environment.