Model Checking for Automated Driving Test Data Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Generating test data for computer-implemented automated driving functions, particularly for rare and critical driving situations, is challenging due to the difficulty in simulating and provoking peripheral regions of the software, which are crucial for safety requirements but occur infrequently.
Innovation Solution
The method employs model checking to analyze software components by translating native program code into a model checker representation, limited by an environment model, to identify edge cases and generate test data based on formal requirements and boundary conditions, including those that vary in time and location, such as weather and road conditions, and the behavior of other road users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If simulation-based tests or replay HiL solutions are used to test automated driving functions, then test coverage can be achieved, but it is difficult and expensive to generate test data for rare critical situations (edge cases)
Solution Approach 1:
The model checking system automatically generates test data for edge cases without requiring manual simulation setup or real-world test drives. The system self-identifies critical situations through formal verification and automatically produces the corresponding test data, eliminating the need for laborious manual construction of test scenarios.
Solution Approach 2:
The model checking method performs preliminary analysis of the software component to identify potential edge cases before actual testing begins. By analyzing all possible sequences in the program code beforehand, the system prepares test data for critical situations in advance, avoiding the need for expensive and time-consuming real-world provocation during testing phases.
2Measurement precision
If model checking is applied to verify software correctness, then automatic proof of formal requirements can be obtained, but the program code must be translated into model checker representation which adds complexity
Solution Approach 1:
The patent introduces an intermediary translation process that converts native program code into model checker representation. This intermediary step acts as a bridge between the software component and the model checking system, enabling formal verification while managing the complexity through automated translation tools and environment model integration.
3Productivity
If the state space of the software component is limited by environment models with boundary conditions, then analysis becomes feasible, but some edge cases might be excluded from the analysis
Solution Approach 1:
The environment model is designed to be dynamic rather than static, allowing boundary conditions to adapt during the model checking process. This enables the system to adjust the state space limitations based on the analysis progress, ensuring that potentially critical edge cases are not prematurely excluded while maintaining analysis feasibility.
Data Source
AI summary
A computer-implemented method for generating test data for computer-implemented automated driving functions. The method includes: provision of a computer-implemented automated driving function in the form of a software component; specification of an environment model with boundary conditions that limit the state space of the software component; provision of a model checker representation of the software component that is limited by the environment model; specification of a formal requirement as an input for a model checking method; and application of the model checking method to the model checker representation to analyze the software component with respect to compliance with the specified formal requirement. If the specified formal requirement is not complied with, the model checking method provides the states and state transitions of the software component that contribute to non-compliance as edge case parameters. Based on the edge case parameters, test data are then generated.