ISO/DIS 26262, an automotive functional safety standard, provides stringent requirements and processes for a 'safety-oriented' software lifecycle and in particular on the veri cation and validation part. These strict and activitybased safety processes impose some important drawbacks, especially with the increasing complexity of software intensive safety critical systems. In this paper we report on a methodology for guiding the Model-based Functional Safety testing by generating valid test strategy models. We explicitly model test artifacts and process rules, which allows to automatically generate valid and optimized test strategies for Modelbased Functional Safety testing. A wellknown advanced driver assistance system, the adaptive cruise control, is used to demonstrate the proposed methodology. between software and physical elements[Lee08], it is also caused by the safety aspects of such systems. Safety engineering is a cross-cutting concern that is taken into account throughout the complete life-cycle. Safety engineering aims to show that the required system functionality is safe and reliable[Bellotti10]. This way, the quality and reliability of safety critical systems are highly dependent on both the implementation and proper system validation and veri cation. To cope with this complexity, engineers can adapt model-based engineering principles, enabling complex system analysis via system simulations. Simulations allow for a preliminary validation in very early stages of the development process, this reduces the risk of high redesign cost by detecting premature errors. Moreover, safety critical systems must adhere to functional safety norms like IEC 61508[IEC61508] and ISO/DIS 26262[ISO/DIS26262]. These standards pose stringent requirements for development of safety critical systems and also on the testing processes. Adhering to these standards can be di cult because the de ned activity-centric processes are rigid and some margin for appreciation can exist, so implementing an instantiation of the requirements outlined in ISO/DIS 26262 within a Model-Based Design requires special consideration[Conrad12]. Moreover, the veri cation and validation (V&V) processes, which contain not only testing activities but also e.g. (static) analysis, inspections and reviews, etc., are preferably application-speci c meaning that the instantiation of the V&V process is tted for the application in development, which can reduce the V&V overhead.
In our approach, we propose to focus on the artifacts instead of the xed process ows outlined in the ISO/DIS 26262. Artifacts are the products used by and/or generated from process activities and the resulting artifact-centric process models are de ned as acceptable states of the process without enforcing any speci c execution ow[Baresi16]. Process rules are used to formally capture the constraints of a valid process execution ow, enabling us to (semi-)automatically generate valid, optimized and customized test strategy processes for Model-based Functional Safety testing. Process rules can originate from various sources such as company-speci c process knowledge or safety-speci c knowledge captured in the functional safety standard. By applying these process rules at di erent steps in the work ow, we can truly make the test strategies application- and company-speci c, facilitating the usage of the test strategy processes and further reducing the V&V overhead.
The rest of the paper is organised as follows : Section 2 presents some essential background and related work on functional safety testing and the used artifactcentric approach. Section 3 discusses the basic concepts of the presented solution. Section 4 implements a case study and nally, Section 5 concludes the paper. 2
Safety is one of the key issues in future road vehicle development[Bellotti10] and despite the increasing complexity, caused by new complex driver assistance systems with e.g. accident prediction and avoidance capabilities and the associated complicated processes, car manufacturers have the basic obligation to only put safe products on the market. In safety critical systems, human safety depends upon the correct operation of those systems. This raises the need for development methods and processes that could lead to provable correct systems[Arc17]. Therefore, car makers as well as suppliers adhere to a functional safety standard, namely the ISO/DIS 26262. This standard gives stringent requirements for a 'safety-oriented' design and in particular on the veri cation and validation part. A high-level guidance to design proper safety functions is provided in the guidelines, together with processes to verify and validate these safety functions and prove their adherence to the standard. The aforementioned safety functions are functions implemented in a control system to prevent violation of the safety goals. These safety functions will assure safe operation of the system and will put the system in a safe state in case of an inevitable safety goal violation. A clear example of a safety function is a safe standstill function in road vehicles which will monitor the vehicles movement during standstill and will activate the park brake if an unintended movement occurs.
This guidance is activity-based, meaning that a chain of activities is provided and the control ow is well de ned and xed. This works very good for de ning the normal execution ow and the management of foreseen exceptions during execution of the processes but when unforeseen situations occur, the correct execution within the process de nition cannot be checked[Baresi16]. Artifact-centric processes could provide a good solution to handle these unforeseen situations as it provides a process de nition in terms of acceptable process states and not enforcing a speci c execution ow. [Yongchareon18] states that artifact-centric process modeling has been evidenced with higher exibility over traditional activity-centric process modeling and they used it to improve interorganizational business cooperation. [Kuhrmann14] also states that by focusing on the artifacts, which precisely de ne the desired outcomes, rather than on speci c methods, the processes are less generic and more tted for the organization. 3
This section introduces the proposed methodology of our approach, which is shown conceptually in Figure 1.
The result of our approach is a (semi-)automatically generated valid and optimized test strategy process compliant to the ISO/DIS 26262 functional safety standard. We start from an integration model(top-left in Figure 1), where a set of components are connected together to form a particular safety function. Each of these components and their integration need to be tested compliant the functional safety standard. These components can originate from di erent sources such as an internal software department or external suppliers and can already been tested partially or completely.
This knowledge about the level of test completion is captured for each component 1 within the artifact-view of the component. The corresponding artifact-view of the components are shown in the top-middle of Figure 1 as parallelograms with four squares at the bottom. These squares depict the di erent integration levels of the system under test (SUT) within the model-based testing of embedded systems, namely Model-in-the-Loop (MiL), Software1With 'component', we intend to denote the components of the integrated system and the integrated system itself
Next, we de ne process rules which will constrain the valid control ow of the model-based test activities and together with the artifact-view of each component, we automatically generate possible test strategy processes. Within these generated processes, each model-based test activity at a particular integration level can further be decomposed in V&V activities, e.g. functional safety behavior testing on MiL. For these V&V activities one or more ISO/DIS 26262 compliant testing method(s) needs to be selected. The selection or customization can in uence other parts of the process and the rules to de ne these dependencies are also explicitly modeled using the aforementioned process rules. The process rules are thus used at di erent stages of the work ow but are conceptually equal, so a generic modeling mechanism is used to de ne these process rules. After As stated before, the extra information about the level of model-based test completion needs to be captured for each of the components of the implementation model. We use an artifact-based approach where we explicitly model this extra meta-information in an artifact-view model. This artifact-view contains the necessary model-based test activities and their corresponding status in relation with the artifacts. The control ow between these activities is not de ned within this artifact-view. The meta-model of the artifact-view model and its dependencies is shown in Figure 2.
The meta-model contains two basic classes: Artifact class de nes an artifact, which represents an implementation of the component, e.g. the model or source code representing the functionality of the component. These serve as input for and output from the activities. Activity class de nes an activity. The status is a key element captured within this artifact-view.
In the scope of functional safety testing, where the possible V&V test methods are imposed by the ISO/DIS 26262 standard, the method attribute in the activity object enables the customization of the test strategy by selecting one or more available V&V test methods. The process rules on the other hand will have in uence on the activities, e.g. they can alter the available V&V test methods or omit an activity depending on other activities. The process rules will also de ne the control ow between the activities, deemed necessary to generate a valid test strategy process. Note that an artifact-view can contain links to other artifact-views, indicating that the artifact-view corresponds to an integration model of di erent components.
In our approach, the artifact-view model is a textbased model de ned with an extensive mark-up language (XML). This enables the model to be humanand machine readable, which is deemed necessary to process this model in the subsequent steps of the workow. 3.2
The key element of our proposed approach is the explicit modeling of process rules which enables the optimization and customization of the test strategy processes. These rules can be applied at di erent stages of the work ow, depending on the rules and their impact. As mentioned before, rules can e.g. originate from requirements posed by standards or company-speci c decisions. Important bene t of explicitly modeling these process rules is that all process rules or decisions are formally captured and can be used as well-documented evidence to prove process compliance to certain standards.
Figure 3 is a graphical example of a process rule where activity 13 and activity 14 induce a particular rule to activity 24.
Following rules can be applied:
V&V method selection forces V&V method for other activity
Note that these set of rules can easily be extended with extra process rules. An example of a more advanced process rule, originating from both the safety standard and company-speci c knowledge is de ned as follows: if the functional behavior of a component is tested via a requirements-based test method on model level(MiL), we force the V&V test method on software level(SiL), namely a back-to-back test method combined with an interface test method.
Up till now, we used a text-based model to de ne the process rules. This could be improved by de ning a graphical domain-speci c language (DSL), which eases the modeling of these process rules. 3.3
With the artifact-views and the process rules de ned, we can generate a set of valid test strategy processes. This transformation extracts the meta-information of all artifact-views and generates a process model where the appropriate process rules are taken into account. The generated process model can either be a directed graph or a Causal Block Diagram representing a (executable) process model. This process model can further be customized by selecting the proper V&V test methods and again applying the speci ed process rules. This will be further explained by means of a practical example in Section 4. 4
In this section, we use a safety critical adaptive cruise control system as academic use case to illustrate the proposed concepts of the previous section. The adaptive cruise control system is an advanced driver assistance system (ADAS) which is already widely available in commercial road vehicles but interesting as system under study because it is one of the precursors of fully autonomous vehicles[Nardi17]. For this use case, we will decrease the complexity by focusing on one safety function de ned in the implementation of the adaptive cruise control, namely the SafeDistance function. The safety chain for this SafeDistance safety function is shown in Figure 4.
This safety chain is decomposed in four components, each on a di erent level of abstraction. More speci cally, each component is unit tested up till a certain test integration level. This knowledge is formally captured in the corresponding artifact-view of each component. The artifact-view of the complete SafeDistance safety function is shown graphically in Figure 5. This de nes that the AccMonitor component, leftmost artifact-view in Figure 5 and highlighted in the red box in Figure 4, is unit tested up till the software integration level. To complete the unit test for this component, the tests on the processor and hardware integration level need to be performed. From this graphical representation, the artifacts are not explicitly de ned2 as they are implicit present in the activity names, namely:
of the AccMonitor
code of the AccMonitor
tifact is production code of the AccMonitor Besides the necessary knowledge about the test completion, we also de ne general process rules for a valid execution ow of the model-based test activities. We de ne that (i)SiL needs to be sequentially 2Artifacts are also not explicitly present in the processes performed after MiL, (ii)Pil and Hil need to be sequentially performed after SiL, (iii)Pil and HiL can be performed in parallel and (iiii) integration tests need to be sequential performed after the completion of the unit tests of all integrated components.
With the artifact-views and the process rules de ned, a valid test strategy process model can automatically be generated. This text-to-model transformation generates a directed graph, as shown in Figure 6, where the test activities are depicted as nodes and the control ow as links.
In this use case, we not only generate a directed graph, we also generate a process model in a Causal Block Diagram (CBD) formalism in Simulink c , which allows us to visually select the proper V&V test methods for the test activities, when necessary, to truly customize the test strategy process. An example of a test activity in CBD formalism is shown in Figure 7, where the selection of the V&V test methods, if applicable, is present for the sub-activities. The available V&V test methods and the possible test case derivation methods are compliant to the ISO/DIS 26262 as shown by the Speci edBy relation between the tables, originating from ISO/DIS 26262 - part 6, and the customizable CBD block.
At this level, process rules are de ned to capture the dependencies between the di erent test activities and their corresponding V&V test methods. The following list is a subset of the outcome of the applied process rules for this use case:
Requirements based test on MiL forces requirements based test and boundary values test on SiL
After selecting the proper V&V test methods3 and applying these process rules, a valid, optimized and customized test strategy model is automatically generated.
An example of a generated test strategy model is shown in Figure 8. In this generated test strategy process,the proper V&V test methods are selected and the above mentioned process rules are applied. To increase the readability and usability of the generated test strategy model, we grouped the sub-activities of each test activity at the particular integration level.
3The applied process rules have also in uence on the available/valid V&V test methods This paper presents a methodology to facilitate the model-based validation and veri cation of safety critical systems by (semi-)automatically generating valid, optimized test strategy processes compliant to the ISO/DIS 26262 functional safety standard using an artifact-centric approach. We applied this methodology to a well-known advanced driver assistance system, the adaptive cruise control, extended with the needed safety functions. This case study is small-scale and yet complex enough to be suited for future research.
In the future, we plan to extend the proposed methodology by introducing one or more design space exploration (DSE)algorithms to further optimize the generation of valid test strategy processes. By taking the resource constraints, such as shared real-time hardware platforms or human resources, into account, both a valid and optimized test strategy process and an optimized test scheduling can be generated, which is bene cially for the overall veri cation and validation processes.
Second, we want to extend the usage of the artifact-view by tightly coupling this artifact-view to the model information or meta-knowledge[Sirin14], enabling the use in design processes other than safetyrelated automotive development. More speci cally, we will include this information of the artifact-view within the validity frame[Denil17][Klikovits17] encapsulated with each component. This will increase the (re-)usability of the components within the design processes.
Lastly, we will compare our proposed methodology against more traditional activity-based processes to empirically assess the usability, correctness and scalability of our methodology. 6
This work has been carried out within the framework of Flanders Make's ICON project 'EnPower' (TCO optimal system design for Energy and Power storage in dynamic load applications, HBC.2016.0462) funded by the agency Flanders Innovation & Entrepreneurship (VLAIO) and Flanders Make. Flanders Make is the Flemish strategic research centre for the manufacturing industry. [Arc17]