Cyber-Physical Doping Tests

We are confronted with a growing number of cases where device manufacturers equip their products with embedded software that includes functionalities that are not in the owner's interest. Examples include customer lock-in strategies in inkjet printers and as a prominent case the diesel emissions scandal in the automotive industry. This software doping phenomenon is turning more widespread as software is embedded in ever more devices of daily use. In this work we present a formal characterization which can distinguish clean and doped reactive programs, based on a contract that is assumed to exist between the end user of a cyber physical device and the manufacturer of the control software embedded therein. We further discuss our current work on combining this characterization with the theory of model-based testing, so as to arrive at a formal basis upon which it will be possible to perform efficient doping tests in practice.