一句话：提出基于自回归系统辨识的测试预言，自动判定控制CPS物理轨迹正确性，提升故障定位效果。
控制信息物理系统（Control-CPS）缺陷可能导致重大故障甚至伤亡，软件故障定位至关重要。现有定位工具需要大量带正确/错误标签的执行轨迹，但控制CPS物理轨迹的正确性边界模糊，人工测试预言成为瓶颈。本文提出基于自回归系统辨识（AR-SI）的测试预言：将含缺陷的控制CPS视为黑盒进行AR-SI辨识，用辨识结果判定轨迹正确性，并给出调试轨迹准备方法。在经典Control-CPS上注入真实与人工缺陷的评估显示，该方法在故障定位召回率、时延及预言假阳性/假阴性率上显著优于人工预言，并发现一个消费级Control-CPS中的新真实缺陷。
Control-CPS software fault localization (SFL, aka bug localization) is of critical importance as bugs may cause major failures, even injuries/deaths. To locate the bugs in control-CPSs, SFL tools often demand many labeled ("correct"/"incorrect") source code execution traces as inputs. To label the correctness of these traces, we must judge the corresponding control-CPS physical trajectories' correctness. However, unlike discrete outputs, the boundaries between correct and incorrect physical trajectories are often vague. The mechanism (aka oracle) to judge the physical trajectories' correctness thus becomes a major challenge. So far, the ad hoc practice of ``human oracles'' is still widely used, whose qualities heavily depend on the human experts' expertise and availability. This paper proposes an oracle based on the well adopted autoregressive system identification (AR-SI). With proven success for controlling black-box physical systems, AR-SI is adapted by us to identify the buggy control-CPS as a black-box. We use this identification result as an oracle to judge the control-CPS's behaviors, and propose a methodology to prepare traces for control-CPS debugging. Comprehensive evaluations on classic control-CPSs with injected real-life and artificial bugs show that our proposed approach significantly outperforms the human oracle approach in SFL accuracy (recall) and latency, and in oracle false positive/negative rates. Our approach also helps discover a new real-life bug in a consumer-grade control-CPS.
@inproceedings{HeCHWPY19,
title = {A System Identification Based Oracle for Control-CPS Software Fault Localization},
author = {Zhijian He and Yao Chen and Enyan Huang and Qixin Wang and Yu Pei and Haidong Yuan},
booktitle = {ICSE},
year = {2019},
doi = {10.1109/icse.2019.00029}
}