Keynote presentation at SBST 2019 (https://sbst19.github.io/).

1. .lusoftware verification & validation
VVS
Testing Cyber Physical Systems via
Evolutionary Algorithms and
Machine Learning
Shiva Nejati
SnT, University of Luxembourg
SBST @ ICSE 2019
May 27, 2019
!1

2. About SnT
• ICT research centre to fuel the national innovation system
• Part of the University of Luxembourg
!2
40+ industry
partners
20 MEUR turnover
(70% external funding)
Acquired competitive
funding since launch
>100
M€
60% of PhDs and RAs
work on industry projects >300 employees 51 nationalities

3. Software Verification and
Validation Group (http://svv.lu)
!3
• Established in 2012
• Requirements Engineering, Security Analysis,
Design Verification, Automated Testing,
Runtime Monitoring
• 5 faculty members
(head: Lionel Briand)
• 11 research associates
• 13 PhD candidates
• 3 research fellows
• 10 current industry partnerships
• Budget 2018: ~2 M€

4. SVV Industry Partners
!4
SES and LuxSpace (Satellites)
Delphi and IEE (Automotive)
Government of Luxembourg
HITEC (Emergency systems)
BGL – BNP Paribas,
Clearstream (Banking)
Escent (MDE Coaching)
QRA (Quality Assurance)

5. SVV Industry Partners
!4
SES and LuxSpace (Satellites)
Delphi and IEE (Automotive)
Government of Luxembourg
HITEC (Emergency systems)
BGL – BNP Paribas,
Clearstream (Banking)
Escent (MDE Coaching)
QRA (Quality Assurance)

6. Mode of Collaboration
• Research driven by industry needs
• Realistic evaluations
• Combining research with innovation and technology transfer
!5
Adapted from [Gorschek et al. 2006]
Problem
Formulation
Problem
Identification
State of the
Art Review
Candidate
Solution(s)
Initial
Validation
Training
Realistic
Validation
Industry Partners
Research Groups
1
2
3
4
5
7
Solution
Release
8
6

7. Acknowledgements
!6
Raja
Ben Abdessalem
Reza
Matinnejad
Annibale
Panichella
Lionel
Briand

8. Cyber Physical Systems (CPS)
!7
Cyber Space
Physical
Sensing
Actuation
Information
Networks
Object
Domain
Real Space

9. CPS Challenge
!8
Computing
Physical
Dynamics

10. Model-based Development of CPS
!9
Integration of
SW and HW
Model in the Loop
(MiL)
Software in the Loop
(SiL)
Hardware in the Loop
(HiL)
Function
Modeling
Software
Modeling/
Development

11. Function Models
• are hybrid – capture both
discrete (algorithms) and
continuous (physical
dynamics) computations
• are executable
•capture uncertainty e.g.,
about the environment
!10
Model
Signal Signal
˙x(t) = ˙x(0) + 1
M
R t
0
F(⌧)d⌧
Hybrid Automaton
State space: Bm × Rn
Dynamics: initial condition + state transitions
+ differential equations
Thermostat:
x0
off
on
t
off
x’ = -K·x
on
x’ = K·(H-x)
x ≤ 19 x ≥ 21
x ≤ 23
x ≥ 17
Dynamic
System
Signal Signal

12. Software Models
• capture software architecture and
real-time constraints
• specify performance, security
and timing requirements
• are in charge of integrating
different components
• are heterogeneous
!11

13. Software Model
Benefits of CPS Modelling
!12
Function Model
Simulation/
Prediction
Certification
Early Testing
Verification
Automated Code
Generation
CPS Models

14. Software Model
Benefits of CPS Modelling
!12
Function Model
Simulation/
Prediction
Certification
Early Testing
Verification
Automated Code
Generation
CPS Models

15. Fundamental Questions
• What are the useful and realistic models of CPS?
• What requirements should CPS satisfy to meet their safety
standards?
• What are the main challenges in developing scalable and
effective testing techniques for CPS?
!13

16. Simple Controller
!14
Controller Actuator
Commands
Electronic dryer controller
Plant

17. Adaptive Controller
!15
Controller Actuator
Commands
Sensors Plant
feedback
Cruise control system, Satellite controller

18. Autonomous Controller
!16
Controller Actuator
Commands
Sensors Plant
feedback
Perception &
Decision
Sensors/
Camera
Environment
Automated Driving, Unmanned Aerial Vehicle, Smart IoT

19. Temporal/Real Time
Requirements
• ``As soon as braking is requested, the contact between
Caliper and Disk shall occur within 20ms’’
• ``The system shall respond within 32ms’’
!17

20. Controller Requirements
• Stability
• Smoothness
!18
Stability
Violation
Stability
Violation
Responsiveness
Violation

21. Autonomous Systems
• Perception and decision requirements
• ``The car shall detect all obstacles ahead
of the vehicle within 100m distance.’’
• ``An unintended braking manouvre by
the Automated Emergency Braking shall
be prevented.’’
• Behavioral Safety
• Driving Behavior Comfort
• Energy Efficiency
• ….
!19
Stopping sight distancr
Percep1on distance

22. CPS Verification Challenge
• Analytical techniques and exact solvers cannot be applied to
CPS models due to
• non-linear, non-algebraic computations
• continuous dynamic behaviours
• heterogeneity
!20

23. CPS test input spaces are large and multi-dimensional
commands
commands +
plant states sensor data
over times
plant states +
environment
On/Off
On/Off

24. Metaheuristic Search
• Stochastic optimisation, e.g., evolutionary computing
• Efficiently explore the search space in order to find good (near
optimal) feasible solutions
• Applicable to any search space irrespective of the size
• Flexible and can be combined with different optimisation methods
• Amenable to analysis of heterogeneous models
• Applicable to many practical situations, including SW testing
!22

25. Our Approach in a Nutshell
!23
Test Input
Generation
Guided
Search
Optimisations
via Machine Learning

26. Structured Test Inputs
!24
xe
0 xl
0xp
0
y0, y0
0
✓p
xts
~vp
0
~v0 ~v0
yp
0
Y
X
• Domain models
• Vectors and constraints

27. Genetic Algorithms
!25
Search algorithms inspired by the theory of evolution

28. Genetic Algorithms
!25
Search algorithms inspired by the theory of evolution
Initial test inputs

29. Genetic Algorithms
!25
Search algorithms inspired by the theory of evolution
Initial test inputs
Fitness computation (which test
is more likely to reveal faults?)

30. Genetic Algorithms
!25
Search algorithms inspired by the theory of evolution
Initial test inputs
Fitness computation (which test
is more likely to reveal faults?)
Select the most critical tests (the ones
more likely to reveal faults)

31. Genetic Algorithms
!25
Search algorithms inspired by the theory of evolution
Initial test inputs
Fitness computation (which test
is more likely to reveal faults?)
Select the most critical tests (the ones
more likely to reveal faults)
Bread (generate new tests using
Genetic operators)

32. Genetic Algorithms
!25
Search algorithms inspired by the theory of evolution
Initial test inputs
Fitness computation (which test
is more likely to reveal faults?)
Select the most critical tests (the ones
more likely to reveal faults)
Bread (generate new tests using
Genetic operators)

33. Why Do We Need Additional
Optimizations?
• Few objective function evaluations are possible because
executing/simulating CPS function models is expensive
• They should be executed for a long enough time duration
• They capture, in addition to software/controllers, models of
hardware and environment
• Several local-optima
• Large and multi-dimensional search input spaces
!26

34. Machine Learning and Search
!27
Find critical test inputs
in the entire search space
- Learning where the most critical
regions are
- Learning fitter solutions instead of
breading them
- Predicting fitness values instead of
computing them
- Selecting effective search algorithms
and tuning their parameters
- …
Search
Machine
Learning

35. Industrial Research Projects

36. Testing Automated Driving
Systems

37. Autonomous Car Features
!30
Automated Emergency Breaking
(AEB)
Traffic Sign Recognition
(TSR)

38. Sensor/
Camera
Data
Autonomous
Feature
Actuator
Command
- Steering
- Acceleration
- Braking

39. Testing Models of Automated
Driving Systems
!32
Physics-based
Simulators
SUT
Sensor/
Camera
Data
Autonomous
Feature
Actuator
Command

40. Testing Models of Automated
Driving Systems
!32
Physics-based
Simulators
SUT
Sensor/
Camera
Data
Autonomous
Feature
Actuator
Command
Time Stamped Vectors

41. Testing Models of Automated
Driving Systems
!32
Physics-based
Simulators
SUT
Sensor/
Camera
Data
Autonomous
Feature
Actuator
Command
Time Stamped Vectors
We use PreScan, a
commercial physics-
base simulator

42. Test Inputs/Outputs
!33
- intensity: Real
SceneLight
Dynamic
Object
1
- weatherType:
Condition
Weather
- fog
- rain
- snow
- normal
«enumeration»
Condition
- field of view:
Real
Camera
Sensor
RoadSide
Object
- roadType: RT
Road
1 - curved
- straight
- ramped
«enumeration»
RT
- v0: Real
Vehicle
- x0: Real
- y0: Real
- θ: Real
- v0: Real
Pedestrian
- x: Real
- y: Real
Position
1
*
1
*
1
1
- state: Boolean
Collision
Parked
Cars
Trees
- simulationTime:
Real
- timeStep: Real
Test Scenario
AEB
- certainty: Real
Detection
1
1
11
1
1
1
1
«positioned»
«uses»
1 1
- AWA
Output
Trajectory
Environment inputs
Mobile object inputs
Outputs

43. System Safety Requirements
• Req1: “Automated Emergency Braking (AEB) shall detect
pedestrians in front of the car and stop the car when there is
a risk of collision”
• Req2: “An unintended manoeuvre by AEB shall be prevented”
• Fitness functions estimate how close AEB is into violating its
requirements (e.g., by having a collision)
!34

44. Guided Test Generation
!35
xe
0 xl
0xp
0
y0, y0
0
✓p
xts
~vp
0
~v0 ~v0
yp
0
Y
X
Test Input
Characterisation
• Select best tests
• Generate new tests (Genetic Operators)
• Simulate every (candidate) test
• Compute fitness functions
Fitness
values
Tests revealing
requirements violations
Test input generation
Evaluating test inputs

45. Guided Test Generation
!35
xe
0 xl
0xp
0
y0, y0
0
✓p
xts
~vp
0
~v0 ~v0
yp
0
Y
X
Test Input
Characterisation
• Select best tests
• Generate new tests (Genetic Operators)
• Simulate every (candidate) test
• Compute fitness functions
Fitness
values
Tests revealing
requirements violations
Test input generation
Evaluating test inputs

46. Guided Test Generation
!35
xe
0 xl
0xp
0
y0, y0
0
✓p
xts
~vp
0
~v0 ~v0
yp
0
Y
X
Test Input
Characterisation
• Select best tests
• Generate new tests (Genetic Operators)
• Simulate every (candidate) test
• Compute fitness functions
Fitness
values
Tests revealing
requirements violations
But, simulations are
expensive to run!
Test input generation
Evaluating test inputs

47. Surrogate Models
• It takes 8 hours to run our search-based test generation (≈500
simulations)
➡We use surrogate models developed based on machine
learning to reduce the number of fitness computations
• We first train a model based on a large number of simulations
• We use this model during the search to predict fitnesses
instead of actually computing them, but …
!36

48. Guided Test Generation
!37
xe
0 xl
0xp
0
y0, y0
0
✓p
xts
~vp
0
~v0 ~v0
yp
0
Y
X
Test Input
Characterisation
• Select best tests
• Generate new tests (Genetic Operators)
• Simulate every (candidate) test
• Compute fitness values
Fitnesses
Tests revealing
requirements violations
Test input generation
Evaluating test inputs

49. Test Generation with Surrogates
!38
xe
0 xl
0xp
0
y0, y0
0
✓p
xts
~vp
0
~v0 ~v0
yp
0
Y
X
Test Input
Characterisation
• Select best tests
• Generate new tests (Genetic Operators)
• Predict the fitness and the error (surrogate)
• If the test is likely to be selected
• Simulate the test
• Compute the fitness
Fitness
values
Tests revealing
requirements violations

50. Archive (A)
New Population (P)
simulated
not simulated

51. Archive (A)
New Population (P)
Simulate and
compute fitnesses F
A + P
simulated
not simulated

52. Archive (A)
New Population (P)
Simulate and
compute fitnesses F
A + P
Rank
1
2 3
simulated
not simulated

53. Archive (A)
New Population (P)
Simulate and
compute fitnesses F
A + P
Rank
1
2 3
Select
simulated
not simulated

54. A
P
simulated
not simulated

55. A
P
Predict
fitnesses
A + P
simulated
not simulated
̂F ± error

56. Pessimistic
Rank
Optimistic
Rank 1 2 3
1 2 3
̂F − error
̂F + error
A
P
Predict
fitnesses
A + P
simulated
not simulated
̂F ± error

57. Pessimistic
Rank
Optimistic
Rank 1 2 3
1 2 3
̂F − error
̂F + error
A
P
Predict
fitnesses
A + P
simulated
not simulated
Selected
Archive
̂F ± error

58. Pessimistic
Rank
Optimistic
Rank 1 2 3
1 2 3
̂F − error
̂F + error
A
P
Predict
fitnesses
A + P
simulated
not simulated
Selected
Archive
1. Select best simulated elements from Optimistic
Rank
2. Select best not-simulated elements from Pessimistic
Rank, simulate them and compute their fitnesses
3. Re-rank and re-iterate
̂F ± error

59. Pessimistic
Rank
Optimistic
Rank 1 2 3
1 2 3
̂F − error
̂F + error
A
P
Predict
fitnesses
A + P
simulated
not simulated
Selected
Archive
1. Select best simulated elements from Optimistic
Rank
2. Select best not-simulated elements from Pessimistic
Rank, simulate them and compute their fitnesses
3. Re-rank and re-iterate
̂F ± error

60. Pessimistic
Rank
Optimistic
Rank 1 2 3
1 2 3
̂F − error
̂F + error
A
P
Predict
fitnesses
A + P
simulated
not simulated
Selected
Archive
1. Select best simulated elements from Optimistic
Rank
2. Select best not-simulated elements from Pessimistic
Rank, simulate them and compute their fitnesses
3. Re-rank and re-iterate
̂F ± error

61. Pessimistic
Rank
Optimistic
Rank 1 2 3
1 2 3
̂F − error
̂F + error
A
P
Predict
fitnesses
A + P
simulated
not simulated
Selected
Archive
1. Select best simulated elements from Optimistic
Rank
2. Select best not-simulated elements from Pessimistic
Rank, simulate them and compute their fitnesses
3. Re-rank and re-iterate
̂F ± error

62. Pessimistic
Rank
Optimistic
Rank 1 2 3
1 2 3
̂F − error
̂F + error
A
P
Predict
fitnesses
A + P
simulated
not simulated
Selected
Archive
1. Select best simulated elements from Optimistic
Rank
2. Select best not-simulated elements from Pessimistic
Rank, simulate them and compute their fitnesses
3. Re-rank and re-iterate
̂F ± error

63. Pessimistic
Rank
Optimistic
Rank 1 2 3
1 2 3
̂F − error
̂F + error
A
P
Predict
fitnesses
A + P
simulated
not simulated
Selected
Archive
1. Select best simulated elements from Optimistic
Rank
2. Select best not-simulated elements from Pessimistic
Rank, simulate them and compute their fitnesses
3. Re-rank and re-iterate
̂F ± error

64. Pessimistic
Rank
Optimistic
Rank 1 2 3
1 2 3
̂F − error
̂F + error
A
P
Predict
fitnesses
A + P
simulated
not simulated
Selected
Archive
1. Select best simulated elements from Optimistic
Rank
2. Select best not-simulated elements from Pessimistic
Rank, simulate them and compute their fitnesses
3. Re-rank and re-iterate
̂F ± error

65. Pessimistic
Rank
Optimistic
Rank 1 2 3
1 2 3
̂F − error
̂F + error
A
P
Predict
fitnesses
A + P
simulated
not simulated
Selected
Archive
1. Select best simulated elements from Optimistic
Rank
2. Select best not-simulated elements from Pessimistic
Rank, simulate them and compute their fitnesses
3. Re-rank and re-iterate
̂F ± error

66. Pessimistic
Rank
Optimistic
Rank 1 2 3
1 2 3
̂F − error
̂F + error
A
P
Predict
fitnesses
A + P
simulated
not simulated
Selected
Archive
1. Select best simulated elements from Optimistic
Rank
2. Select best not-simulated elements from Pessimistic
Rank, simulate them and compute their fitnesses
3. Re-rank and re-iterate
̂F ± error

67. Pessimistic
Rank
Optimistic
Rank 1 2 3
1 2 3
̂F − error
̂F + error
A
P
Predict
fitnesses
A + P
simulated
not simulated
Selected
Archive
1. Select best simulated elements from Optimistic
Rank
2. Select best not-simulated elements from Pessimistic
Rank, simulate them and compute their fitnesses
3. Re-rank and re-iterate
̂F ± error

68. Pessimistic
Rank
Optimistic
Rank 1 2 3
1 2 3
̂F − error
̂F + error
A
P
Predict
fitnesses
A + P
simulated
not simulated
Selected
Archive
1. Select best simulated elements from Optimistic
Rank
2. Select best not-simulated elements from Pessimistic
Rank, simulate them and compute their fitnesses
3. Re-rank and re-iterate
̂F ± error

69. Pessimistic
Rank
Optimistic
Rank 1 2 3
1 2 3
̂F − error
̂F + error
A
P
Predict
fitnesses
A + P
simulated
not simulated
Predicted values are only used to bypass simulations for unfit individuals
Selected
Archive
1. Select best simulated elements from Optimistic
Rank
2. Select best not-simulated elements from Pessimistic
Rank, simulate them and compute their fitnesses
3. Re-rank and re-iterate
̂F ± error

70. Comparing Search w/ and w/o
Surrogate
!41
0.00
0.25
0.50
0.75
1.00
Time (min)
Hypervolume
50 100 15010
NSGA2 (mean)
NSGA2-SM (mean)
Search with
surrogate models
generates higher
quality solutions
than search
without surrogate
models

71. Comparing Search w/ and w/o
Surrogate
!41
0.00
0.25
0.50
0.75
1.00
Time (min)
Hypervolume
50 100 15010
NSGA2 (mean)
NSGA2-SM (mean)
Search with
surrogate models
generates higher
quality solutions
than search
without surrogate
models
A worst case scenario example

72. Guided Test Generation
!42
xe
0 xl
0xp
0
y0, y0
0
✓p
xts
~vp
0
~v0 ~v0
yp
0
Y
X
Test Input
Characterisation
• Select best tests
• Generate new tests (Genetic Operators)
• Simulate every (candidate) test
• Compute fitness values
Fitnesses
Tests revealing
requirements violations
Test input generation
Evaluating test inputs

73. Test Generation Guided by
Classification
!43
• Build a classification tree
• Select/generate tests in the fittest regions
xe
0 xl
0xp
0
y0, y0
0
✓p
xts
~vp
0
~v0 ~v0
yp
0
Y
X
Test Input
Characterisation
• Simulate every (candidate) test
• Compute fitness values
Fitnesses
Tests revealing requirements violations +
Failure Explanations

74. Genetic Evolution Guided by
Classification
!44
1. Initial Inputs
2. Fitness Computation
3. Classification
4. Selection
5. Breeding

75. Genetic Evolution Guided by
Classification
!44
1. Initial Inputs
2. Fitness Computation
3. Classification
4. Selection
5. Breeding

76. Genetic Evolution Guided by
Classification
!44
1. Initial Inputs
2. Fitness Computation
3. Classification
4. Selection
5. Breeding
Fitnesses:
F1. Min distance between pedestrian and
the car
F2. Speed of the car at the time of collision

77. Genetic Evolution Guided by
Classification
!44
1. Initial Inputs
2. Fitness Computation
3. Classification
4. Selection
5. Breeding
Label:
(F1 < threshold1) (F2 > threshold2)^<latexit sha1_base64="fN2vLjkdGPW+23P0LWTflayq2iM=">AAAB73icbVDLTgJBEOzFF+IL9ehlIph4Irt40CPRi0dM5JHAhszO9sKE2Yczsxqy4Se8eNAYr/6ON//GAfagYCWdVKq6093lJYIrbdvfVmFtfWNzq7hd2tnd2z8oHx61VZxKhi0Wi1h2PapQ8AhbmmuB3UQiDT2BHW98M/M7jygVj6N7PUnQDekw4gFnVBupW+0/oT/E6qBcsWv2HGSVODmpQI7moPzV92OWhhhpJqhSPcdOtJtRqTkTOC31U4UJZWM6xJ6hEQ1Rudn83ik5M4pPgliaijSZq78nMhoqNQk90xlSPVLL3kz8z+ulOrhyMx4lqcaILRYFqSA6JrPnic8lMi0mhlAmubmVsBGVlGkTUcmE4Cy/vEra9ZpzUavf1SuN6zyOIpzAKZyDA5fQgFtoQgsYCHiGV3izHqwX6936WLQWrHzmGP7A+vwBT+KPfA==</latexit>

78. Genetic Evolution Guided by
Classification
!44
1. Initial Inputs
2. Fitness Computation
3. Classification
4. Selection
5. Breeding
Label:
(F1 < threshold1) (F2 > threshold2)^<latexit sha1_base64="fN2vLjkdGPW+23P0LWTflayq2iM=">AAAB73icbVDLTgJBEOzFF+IL9ehlIph4Irt40CPRi0dM5JHAhszO9sKE2Yczsxqy4Se8eNAYr/6ON//GAfagYCWdVKq6093lJYIrbdvfVmFtfWNzq7hd2tnd2z8oHx61VZxKhi0Wi1h2PapQ8AhbmmuB3UQiDT2BHW98M/M7jygVj6N7PUnQDekw4gFnVBupW+0/oT/E6qBcsWv2HGSVODmpQI7moPzV92OWhhhpJqhSPcdOtJtRqTkTOC31U4UJZWM6xJ6hEQ1Rudn83ik5M4pPgliaijSZq78nMhoqNQk90xlSPVLL3kz8z+ulOrhyMx4lqcaILRYFqSA6JrPnic8lMi0mhlAmubmVsBGVlGkTUcmE4Cy/vEra9ZpzUavf1SuN6zyOIpzAKZyDA5fQgFtoQgsYCHiGV3izHqwX6936WLQWrHzmGP7A+vwBT+KPfA==</latexit>

79. Genetic Evolution Guided by
Classification
!44
1. Initial Inputs
2. Fitness Computation
3. Classification
4. Selection
5. Breeding

80. Failure Explanation
• A characterisation of the input
space showing under what
conditions the system is likely to fail
• Path conditions in the decision tree
• Visualized by decision trees or
dedicated diagrams
!45
radius in
[15m..40m]
30m22m
10m
26m
vehicle speed > 36 km/h
pedestrian speed
> 6 km/h
road sidewalk
θ
curved road

81. Results
• Does the decision tree technique help guide the evolutionary
search and make it more effective?
• Search with decision tree classifications can find 78% more
distinct, critical test scenarios compared to a baseline search
algorithm
• Does our approach help characterize and converge towards
homogeneous critical regions?
• The generated critical regions consistently become smaller,
more homogeneous and more precise over successive tree
generations
!46

82. Usefulness
• The characterisations of the different critical regions can help
with:
(1) Debugging the system or the simulator
(2) Identifying hardware changes to increase ADAS safety
(3) Identifying proper warnings to drivers
!47

83. Sensor/
Camera
Data
Autonomous
Feature
Actuator
Command
Sensor/
Camera
Data
Autonomous
Feature
Actuator
Command
Sensor/
Camera
Data
Autonomous
Feature
Actuator
Command
…
…
- Steering
- Acceleration
- Braking
Actuator Commands:

84. Sensor/
Camera
Data
Autonomous
Feature
Actuator
Command
Sensor/
Camera
Data
Autonomous
Feature
Actuator
Command
Sensor/
Camera
Data
Autonomous
Feature
Actuator
Command
…
…
- Steering
- Acceleration
- Braking
Actuator Commands:
Conflicts

85. Sensor/
Camera
Data
Autonomous
Feature
Actuator
Command
Sensor/
Camera
Data
Autonomous
Feature
Actuator
Command
Sensor/
Camera
Data
Autonomous
Feature
Actuator
Command
…
…
- Steering
- Acceleration
- Braking
Actuator Commands:
Feature Interaction Problem
Conflicts

86. Sensor/
Camera
Data
Autonomous
Feature
Actuator
Command
Sensor/
Camera
Data
Autonomous
Feature
Actuator
Command
Sensor/
Camera
Data
Autonomous
Feature
Actuator
Command
…
…
- Steering
- Acceleration
- Braking
Actuator Commands:
Undesired Feature Interactions
Conflicts

87. Using search-based testing to detect
undesired feature interactions among
function models of self-driving systems
!49

88. Our Fitness Function
• A combination of three heuristics
• Coverage-based
• Failure-based
• Unsafe overriding
!50

89. Coverage-based Objective
!51
Goal: Exercising as many decision rules as possible
F1
F2
Fn
…
Decision
Logic
SUT
if (condition)
F1

90. Failure-based Test Objective
!52
Goal: Revealing violations of system-level requirements
Example:
- Req: No collision between pedestrians "
and cars
- Generating test cases that minimize"
the distance between the car and the "
pedestrian
F1
F2
Fn
…
Decision
Logic
SUT

91. Feature Interaction Test Objective
!53
Goal: Finding failures that are more likely to be due to faults in the
integration component rather than faults in the features
F1
F2
Fn
…
Decision
Logic
SUT

92. Feature Interaction Test Objective
!53
Goal: Finding failures that are more likely to be due to faults in the
integration component rather than faults in the features
Braking-F1
0
.3
.3
.6
.8
1
1
Braking - Final
F1
F1
F2
F2
F3
F3
F1
0
.3
.2
.2
.3
.3
1
F1
F2
Fn
…
Decision
Logic
SUT

93. Feature Interaction Test Objective
!53
Goal: Finding failures that are more likely to be due to faults in the
integration component rather than faults in the features
Braking-F1
0
.3
.3
.6
.8
1
1
Braking - Final
F1
F1
F2
F2
F3
F3
F1
0
.3
.2
.2
.3
.3
1
F1
F2
Fn
…
Decision
Logic
SUT

94. Feature Interaction Test Objective
!53
Goal: Finding failures that are more likely to be due to faults in the
integration component rather than faults in the features
Braking-F1
0
.3
.3
.6
.8
1
1
Braking - Final
F1
F1
F2
F2
F3
F3
F1
0
.3
.2
.2
.3
.3
1
F1
F2
Fn
…
Decision
Logic
SUT

95. Feature Interaction Test Objective
!53
Goal: Finding failures that are more likely to be due to faults in the
integration component rather than faults in the features
Braking-F1
0
.3
.3
.6
.8
1
1
Braking - Final
F1
F1
F2
F2
F3
F3
F1
0
.3
.2
.2
.3
.3
1
Reward failures that could have been avoided if another feature had
been prioritised by the decision rules
F1
F2
Fn
…
Decision
Logic
SUT

96. On Hybrid Fitness Function
!54
One hybrid test objective for every rule j and every requirement l
⌦j,l
if (cnd)
F

97. On Hybrid Fitness Function
!54
One hybrid test objective for every rule j and every requirement l
⌦j,l
if (cnd)
F
⌦j,l(tc) > 2 tc does not cover Branch j

98. On Hybrid Fitness Function
!54
One hybrid test objective for every rule j and every requirement l
⌦j,l
if (cnd)
F
⌦j,l(tc) > 2 tc does not cover Branch j
2 ⌦j,l(tc) > 1 tc covers branch j but F is not
unsafely overriden

99. On Hybrid Fitness Function
!54
One hybrid test objective for every rule j and every requirement l
⌦j,l
if (cnd)
F
⌦j,l(tc) > 2 tc does not cover Branch j
2 ⌦j,l(tc) > 1 tc covers branch j but F is not
unsafely overriden
1 ⌦j,l(tc) > 0
tc covers branch j and F is
unsafely overriden but req l is
not violated

100. On Hybrid Fitness Function
!54
One hybrid test objective for every rule j and every requirement l
⌦j,l
if (cnd)
F
⌦j,l(tc) > 2 tc does not cover Branch j
2 ⌦j,l(tc) > 1 tc covers branch j but F is not
unsafely overriden
1 ⌦j,l(tc) > 0
tc covers branch j and F is
unsafely overriden but req l is
not violated
⌦j,l(tc) = 0 A feature interaction failure is likely detected

101. Search Algorithm
• Goal: Computing a test suite that covers all the test objectives
• Challenges:
• The number of test objectives is large:
• Computing test objectives is computationally expensive
• Not a Pareto front optimization problem
• Objectives compete with each others, e.g., cannot have, in a single test
scenario, a car that violates the speed limit after hitting the leading car
!55
# of requirements × # of rules

102. MOSA: Many-Objective Search-
based Test Generation
!56
Objective 1
Objective 2
Not all (non-dominated) solutions
are optimal for the purpose of testing
Panichella et. al.
[ICST 2015]

103. MOSA: Many-Objective Search-
based Test Generation
!56
Objective 1
Objective 2
Not all (non-dominated) solutions
are optimal for the purpose of testing
These points are
better than others
Panichella et. al.
[ICST 2015]

104. 4 80 2 6 10 12
Time (h)
(a) SafeDrive1Numberoffeatureinteractionfailures
0
2
8
10
4
6
(b) SafeDrive2
0
2
8
10
4
6
Hybrid (mean)
Fail (mean)
Cov (mean)
Hybrid
Coverage-based
Failure-based

105. 4 80 2 6 10 12
Time (h)
(a) SafeDrive1Numberoffeatureinteractionfailures
0
2
8
10
4
6
(b) SafeDrive2
0
2
8
10
4
6
Hybrid (mean)
Fail (mean)
Cov (mean)
Hybrid
Coverage-based
Failure-based
Hybrid test objectives
reveal significantly more
feature interaction
failures (more than
twice) compared to
baseline alternatives

106. Feedback from Domain Experts
• The failures we found were due to undesired feature
interactions
• The failures were not previously known to them
• We identified ways to improve the decision logic (integration
component) to avoid failures
!58
Example Feature Interaction Failure

107. Luxembourg Emergency
Management System
• Goal: Monitoring emergency
situations and providing a robust
communication platform for
disaster situations
• Requirements
• Resilience
• Maintaining an acceptable
level of quality of service in the
face of emergency situations
!59
Radiation

108. Concluding Remarks

109. Search-Based Testing
• Versatile
• Can be applied to complex systems (non-linear, non-algebraic,
continuous, heterogeneous)
• Can be used when systems have black box components or rely on
computer simulations
• Scalable, easy to parallelize
• Can be combined with: Machine learning, Statistics, Solvers, e.g., SMT
and CP
!61

110. Conclusions
• Contextual factors influence both the significance of a problem and the shape
of the solution
• Our context: function models capturing CPS continuous dynamics, functional
requirements and simulators capturing environment and hardware
• Focus on system-level testing
• Not just on the perception layer (DNN) or the decision layer or the control
layer
• We have to deal with computational complexity, heterogeneity and very large
input spaces
!62

111. • Raja Ben Abdessalem, Shiva Nejati, Lionel C. Briand, Thomas Stifter,``Testing vision-
based control systems using learnable evolutionary algorithms’’, ICSE 2018: 1016-1026
• Raja Ben Abdessalem, Annibale Panichella, Shiva Nejati, Lionel C. Briand, Thomas
Stifter, ``Testing autonomous cars for feature interaction failures using many-objective
search’’, ASE 2018: 143-154
• Raja Ben Abdessalem, Shiva Nejati, Lionel C. Briand, Thomas Stifter, ``Testing advanced
driver assistance systems using multi-objective search and neural networks’’, ASE
2016: 63-74
• Annibale Panichella, Fitsum Meshesha Kifetew, Paolo Tonella, ``Reformulating Branch
Coverage as a Many-Objective Optimization Problem’’, ICST 2015: 1-10
• Nejati et al., “Evaluating Model Testing and Model Checking for Finding Requirements
Violations in Simulink Models”, arXiv:1905.03490, 2019
!63

112. We are hiring!
Talk to me if you are interested in research positions in any of the
following areas: Applied Machine Learning, Applied Natural Language
Processing, Automated Verification and Validation, Information
Retrieval, Model-driven Engineering, Program Analysis, Requirements
Engineering, Software Security, Software Testing