Automatically Finding Bugs in Commercial Cyber-Physical System Development Tool Chains

Commercial Cyber-physical System (CPS) development tools (e.g. MathWorks' Simulink) are widely used to design, simulate and automatically generate artifacts which are deployed in safety-critical embedded hardware. CyFuzz, the state-of-the-art CPS tool chain testing scheme is inefficient, cannot generate feature-rich inputs and is ineffective in finding new tool chain bugs. To better understand various properties of publicly available CPS models, we conducted the first large-scale study of 391 publicly-available Simulink models. Next, we proposed an efficient CPS model-generation scheme capable of creating large, feature-rich random inputs. Our tool realization for testing Simulink which found 8 new confirmed bugs, along with the study-artifacts are publicly available.