Critical Scenario Identification Concept: The Role of the Scenario-in-the-Loop Approach in Future Automotive Testing

Innovative testing and validation methods are prerequisites concerning Connected, Cooperative, and Automated Mobility (CCAM), as the high number of cooperating participants and concurrent processes critically increase the probability of adverse safety and security incidents. The proposed new approaches deal with this increasing complexity of not currently having generally accepted validation mechanisms. The paper introduces a novel, mathematical model based, scenario identification methodology, facilitating the selection of critical road vehicle traffic scenarios, taking into account different testing objectives, such as maximizing the safety risk of the analyzed system. The presented results verify that applying specific decision models and quantifiable indicators related to the system elements of highly automated mobility systems can significantly contribute to the systematic identification of unsafe corner cases in connected and cooperative autonomous systems.


I. INTRODUCTION
Testing and validation tasks are becoming crucial in Connected, Cooperative, and Automated Mobility (CCAM) since their complexity radically increases the probability of critical safety-and security-related unfavourable events [1].
Recently developed new validation approaches try to address this increased complexity [2]; on the other hand, these mechanisms are far from being standardised. For example, Artificial Intelligence (AI) based solutions can efficiently contribute to specific operations [3]; however, their behaviour cannot always be predicted and guaranteed due to their black box characteristics. There might be dangerous input/output intervals where we should ignore their application [4], [5]. Beyond AI, for certain highly complex decision-making situations, particularly for vehicular functions based on the The associate editor coordinating the review of this manuscript and approving it for publication was Giovanni Merlino . interaction between the environment and the vehicle, there are still several problems to be solved to ensure the overall safe operation of the vehicle [6], [7]. Compared to the traditional functional safety approach, the safety of intended functionalities (SOTIF) reflects the challenges of evaluating complex interactions between the system and the environment [8], [9], [10], including also humans [11], [12].
Furthermore, it is important to emphasize that the complexity of testing and validating the system-of-systems concept based CCAM solutions requires applying many hybrid solutions. For instance, Adaptive Cruise Control (ACC) systems or Automated Emergency Braking (AEB) systems can be characterised as less complex Advanced Driver Assistance Systems (ADAS); at the same time, they are already almost inexhaustible repositories of unanswered pending testing and validation questions [13], [14].
The development of a sufficiently comprehensive assessment and evaluation method is extremely complex.  [20].
Especially when there are no general guidelines for the required behaviour characteristics of ADAS functions, while this would be necessary to ensure future transportation safety [15]. In addition to safety-related aspects [16], energyefficient transportation also receives more attention during future testing and validation processes [17].
The findings of our previous research support that the increasing complexity of testing tasks results in an enormously high number of potential situations, thus covering and implementing the required number of tests during the type approval process is physically impossible [18]. Consequently, we are forced to apply inverse logic during future test procedures compared to the classical approach. Instead of being able to state that the system is safe under all conditions in a specific operational domain, we can only state that the system was not unsafe in the input/output variables' investigated intervals. This also leads to the concept that proving ground tests have to be combined with different hybrid simulation solutions to validate future CCAM systems [19].
Following the aforementioned considerations, the future type approval process will surely include simulation, proving ground tests, and public road tests. The only question is to what extent the various test layers should take part in the type approval procedure. Beyond legislation, one should also not forget the cost-saving potentials of hybrid solutions since they can also be much more efficient in most cases than single methods. As previously introduced, the number of test runs is expected to decrease from the bottom to the top of the pyramid layers ( Fig.1) due to the time-and cost-intensive nature of automotive testing processes. Vice versa, the degree of abstraction increases from the top to the bottom of the pyramid layers (from open public road testing to virtual testing) [20].
These considerations are supported globally by novel assessment concepts for Automated Driving System (ADS) type approval [21], suggesting that the new legislation will already require three layers of the previously introduced testing and validation pyramid [22], [23]. This is a solid positive affirmation that our initial ideas were and are still valid and that our research is heading in the right direction.
Physical testing is a time-consuming and expensive activity [24], [25]. Therefore, selecting the minimum but most relevant test cases and scenarios for the physical tests is essential [26], [27]. Through the circumstances analysis, notable test scenes can be identified as edge cases or corner cases [28], [29], [30]. If an extreme (maximum or minimum) operating parameter results in an issue, we define it as an edge case. If multiple parameters are simultaneously at extreme levels, and the user is put at a corner of the configuration space, we define it as a corner case.
Identifying these situations and scenes within scenarios is not straightforward [31], [32]. They can be derived from traffic accidents that have already occurred [33], [34], [35], [36], from near-misses through the real-time analysis of everyday traffic based on risk triggers [37], such extreme cases can also be invented heuristically, but in engineering practice, a set of scenarios produced by a systematic method would be the most reassuring answer [38], [39], [40]. This article introduces a novel methodology in which, as a result of the simulation [41], we can systematically identify and select scenes within each scenario that may be critical [42] and thus should be picked out for physical testing and validation.
Beyond emphasizing the importance of virtual testing, we also need to pay special attention to combining virtual testing with physical testing, which opens new horizons in system evaluation and assessment. There are several attempts to combine simulation and reality [43], [44], [45]; in addition, there are specific approaches towards closed proving grounds [46] or dedicated ADAS functions [47]. These mixed-reality-based testing solutions connect reality and the virtual environment by implementing the digital-twin concept [48], [49]. The system has to provide a real-time connection between the physical, virtual, and controlling components during the test. Simulation and physical reality are connected by Ultra Reliable Low Latency Communication (URLLC), which could be provided through 5G or DSRC (Dedicated Short Range Communications) communication channels [50], [51]. The combination of this complex cyber-physical framework forms the so-called Scenario-inthe-Loop (SciL) validation approach, developed through a series of research carried out at ZalaZONE [52].
The identification of the appropriate testing and validation procedure can be characterised as a complicated decision-making problem [53]. When selecting the applicable test methods, it is further reasonable to consider the safety impact of the function-under-test, the number of distinguished scenarios, the fit of the testing model and reality, the reproducibility, and of course, the costs of the potential test procedures [54]. The complexity of choosing the appropriate test procedure is further increased because the different procedures are not equally capable of examining certain factors affecting the system being tested [55].
As future vehicle systems will no longer only assist the human driver as an ADAS does but will also make sovereign decisions and perform actions as we expect from an ADS, the parallel development of the testing and validation methodology is a fundamental task. For this reason, the Operational Design Domain (ODD) determined during the design process strongly influences the circumstances of the investigated automated function and significantly affects the conditions of the tests [56], [57], [58].
Accordingly, this article introduces a novel, mathematical model based, automated scenario identification framework, which enables experts to select critical traffic scenarios for road vehicles, considering different testing objectives, such as maximising safety risk or minimising the controllability of the analysed system.
The research gap this article seeks to fill is the lack of objective metrics-based models for selecting relevant traffic scenarios for automotive testing. The main contributions of the paper are listed below: • Composition of an end-to-end framework for scenario classification and critical scenario selection The paper is structured as follows: Section II starts with the evolution of the X-in-the-Loop (XiL) testing methodology, continues with the introduction of new scenario elements, provides an insight into the attribute-based identification of critical scenarios and proposes a mathematical model for describing the scenarios' decision problems. Section III presents the results and findings through a simplified example of test scenario generation as an interaction of the simultaneously updated decisions of a pedestrian and a vehicle. Finally, Section IV concludes the paper.

A. RELATED WORK AND TESTING CONCEPTS
Systematic identification of corner cases will become especially important when testing and validation of automated vehicle systems shift from ADAS to ADS. Several scientific papers have recently addressed the challenging topic of critical scenario identification. Beyond scenario mining, to extract critical scenarios from real traffic accidents, Cai et al. focused on a data-driven scenario generation for AV testing and compared different methodologies from various studies [32]. Riedmaier et al. suggested five different methods for scenario selection [25] and also worked out a methodology for their safety verification [27]. Safety metrics and traffic quality metrics were combined for evaluation in the research of Hallerbach et al. [41]. Nalic et al. introduced temporal and spatial distance based safety metrics for the scenario assessment [26], while Fremont et al. successfully demonstrated a formal simulation-based approach for identifying relevant real-world test scenarios for AVs [31]. These approaches are all beneficial and essential steps in determining critical scenarios; however, the end-to-end framework presented below is a step forward by systematically identifying corner cases and mathematically calculating their safety risk based on the probability and the severity of a potential accident.
A successful system or process operation requires appropriate control based on the information influencing its output. While developing complex systems or processes, assuring their reliability can be complicated and costly, as the tests must be repeated many times during the evaluation process. The V-model of automotive development pairs the different levels of requirements with their level of verification and validation throughout the entire development process, applying XiL methodology [59]. XiL simulations are used for system components, subsystems and systems according to the development's maturity [60], [61]. They should focus on replacing the external information sources with a simulation framework that provides and receives the same signals and behaves in the same way as the input signals' source component [62]. The design and composition of a proper XiL simulation environment require a deep understanding of the multidisciplinary characteristics of the domain. The delicate adjustment of the fidelity or credibility of the simulation is a key issue because it determines the balance between the resource requirements and the accuracy of the result.
The XiL concept can be generalised and can be extended to broader system complexity. Utilizing this concept for a specific system component, subsystem, or system, the interfaces of the tested entity must be clearly defined: the input signals affecting the decision-making, the output signals influencing the operation process and the objective function, and the constraining factors describing the behaviour of the specific entity. This way, the precise definition of the boundary between the system under test and the environment is of utmost importance. Thus, the system description task becomes critical and strongly determines the feasibility of further investigations.
This generalisation can be applied from conventional systems, such as specific vehicle modules or vehicle functions, through complex systems, like a complete vehicle, up to a system-of-systems complexity, such as cooperative, connected, and automated mobility. However, this extension only partially covers the essence of the previously introduced SciL testing and validation concept, which goes even beyond.
Following this, we can describe Software-in-the-Loop (SiL) and Hardware-in-the-Loop (HiL) systems. As a result, the simulation process can be well illustrated, where an external simulation framework provides the signals and information necessary for the hardware (HiL) or software (SiL) module responsible for the execution. Where, for example, the input of the module under test (Fig.2) can be the spatial distance (d) of the front vehicle, and the output of the module can be the position of the accelerator pedal (Pos acc_ped ).
This analogy can be simply extended to Vehicle-in-the-Loop (ViL) systems since we can model the operations  performed by highly automated vehicles as responses to signals and environmental information (Fig.3).
Subsequently, the simulation framework must generate signals and information arrived from the environment and processed by the vehicle systems, taking into account the time-dependent decisions of the vehicle, where the input of the Vehicle Under Test (VUT) for example can be the speed and position of the front vehicle and the VUT (v f , lat f , lon f , v VUT , lat VUT , lon VUT ) while the output of the vehicle can be the acceleration or deceleration (a VUT ).
As the next step of the evolution process, we arrive at the SciL concept. To adapt the introduced approach to the SciL concept, it seems reasonable to describe scenarios as entities to which we can assign objectives, constraints, and specific decision problems. We must digress from classical testing and validation approaches for this step. A detailed description of the differences between classical in-the-loop and SciL concepts is presented in the next subsection. For instance, the input of the scenario under test can be the primary parameter values of the scenario, such as the speed and position of the participating components (e.g. v (i,t 0 ) , lat (i,t 0 ) , lon (i,t 0 ) ∀i, where i is the series number of the participating system component). The output of the scenario can be a specific quality level indicator for the test case, for example, safety or controllability (Fig.4). In case the investigated quality indicator describes the safety level of the investigated scenario, we indicate it by (SL).

B. KEY DIFFERENCES -TESTING FRAMEWORK COMPLEXITY
A core element of the SciL concept is managing scenarios as independent entities. Therefore, the scenario is considered to be the system under test when applying the SciL concept [52]. Accordingly, all inputs, outputs, the objective and constraint functions must now be assigned to the traffic scenario.
Per the definition of the SciL concept, it is not enough to examine the vehicle alone during the test process. There are other road users, cyclists and pedestrians around, there are infrastructure elements, buildings, road furniture and traffic control, to mention a few elements that need to be considered during the composition of a realistic traffic scenario. Therefore we must consider the scenario itself as the system under investigation and accordingly specify the input and output signals set, the objective function and the relevant constraints. Thus, the input signals that determine the scenario's outcome as an independent entity change the output signals, affecting the input signals and the subsequent output of the scenario.
In other words, we need to reinterpret the classic automotive definition of the scenario and identify or determine which elements can modify their behaviour in response to changes in the input signals, affecting the output of the scenario. Furthermore, we need to introduce the objective function and the related constraints describing the behaviour of the scenario. This reacting characteristic of SciL makes it reasonable to describe, on the one hand, the active internal components of the scenarios and, on the other hand, to introduce the external factors that the scenario can influence during the decisionmaking processes. Therefore, in the next step, the actors of the automotive scenarios are classified and characterised to present the evolution from passive scenario components to active scenarios, explaining the alterations from classic inthe-loop to advanced SciL methods. Then the next section interprets the automotive scenarios' potential objective functions and constraining factors.

1) STATIC OBJECTS
When considering the evolution of automotive test scenario objects and the related technology, the simplest components used in a test scenario are certainly static (Fig.5). A static test object does not move but standstill at a critical spatial point of the scenario (such as a parking target vehicle (TV ), v (TV ,t) = 0, v (VUT ,t 0 ) > 0 ). Accordingly, there is no change in its state of motion, nor it makes any decision.

2) DYNAMIC OBJECTS
The next evolution level of objects used in test scenarios are the dynamic objects, which -depending on their function related to the specific scenario -are capable of changing their state in time (such as spatial location); however, they still do not make any decision (Fig.6). This type of object can be illustrated, for instance, by an accelerating target vehicle (TV ), a TV > 0, v (VUT ,t 0 ) > 0.

3) INTERACTING OBJECTS
Following this, it is reasonable to complement the definition of dynamic objects with the capability of making decisions related to the scenario conditions. This object category enables the consideration of realistic decisions for scenario actors (such as pedestrians, cyclists, or different infrastructure-related components like traffic control systems) depending on the relevant scenario properties and the behaviour of the other components [63]. In this case, the target vehicle can make its own decision, and its behaviour can be characterised by an objective function (f (obj_TV ) ) describing the mathematical representation of the specific scenario component's decision process (Fig.7).
If the scenario comprises interacting objects, we can define test cases closer to the real operational characteristics. This development phase provides a significant advantage when we investigate the sensitivity of the tested system to known risks. However, if an almost unlimited complexity characterises a system, the main goal of the system validation process is to define the critical scenarios, primarily focusing on identifying scenarios that previously unknown risk factors can characterise.

4) REACTING SCENARIOS
Taking the logic one step further, there is an opportunity to develop the methodological framework of reacting scenarios, capable of making decisions related to the relevant scenario influencing factors (Fig.8). In other words, we can build an architecture that enables the system to modify the scenario settings to move the scenario parameters in certain directions, for instance, where the safety indicators under consideration take on critical values.

C. TEST IMPLEMENTATION
Before selecting suitable test objects, we must clarify a fundamental question in the scenario identification process; whether we want to perform physical tests, simulations, or hybrid methods. Beyond the previously mentioned factors, such as reliability, reproducibility, or cost efficiency, we need to consider another relevant aspect: test automation. To efficiently identify critical scenarios, we need an automated framework to move the scenario settings into the gradient of the applied safety indicators or other relevant scenario properties such as controllability or predictability.
The test automation level influences the tests' reproducibility, reliability and realistic behaviour. Undeniably, if mathematical models describe the behaviour of individual test participants, we reduce the realism of the participants' behaviour. On the other hand, using behavioural models significantly improves the test results' reproducibility. Furthermore, applying mathematical models enables a higher automation level for the test implementation process since we can derive the results of numerous test cases without physical execution by simply solving the equation system of the specific scenario.

D. CRITICAL SCENARIO IDENTIFICATION CONCEPTS
Based on the reacting scenario approach, we can identify critical scenarios considering the impact of input data, such as the position and the behaviour of the scenario participants on the scenario output, like the value of the level of safety. However, we can select other scenario properties to describe the scenarios' nonconformity, like predictability, controllability or cybersecurity [64].

1) SAFETY ATTRIBUTES OF AUTOMOTIVE SCENARIOS
Safety means a system state in which the probability of the system causing personal injury or property damage is acceptably low. Consequently, safety can be quantified through factors directly affecting the probability of injury or property damage [65]).
Several indicators can be used to characterise the safety level of automotive scenarios. For example, we may define as a performance indicator the mean of each scenario component's velocity deviation, the deviation of each scenario component's velocity means, the sum of reciprocals of minimum time distances between each scenario component, or the mean of each scenario component's average deceleration [66]. We may also consider other critical parameters to characterise the safety of a scenario, such as visibility or friction.

2) PREDICTABILITY ATTRIBUTES OF AUTOMOTIVE SCENARIOS
By system predictability, we mean the quantitative level of accurate identification of the future states of the systems [67]. This definition may seem straightforward enough, but defining a method for characterising the predictability of test scenarios is still not easy. The technique of Yang et al. was chosen from several potential options, which describes the predictability of driving behaviour at unsignalised intersections [68]. Based on their research results, the following parameters can be considered relevant for characterising the predictability of different test scenarios: the two components' relative x and y velocity, the distance of the scenario components, and the distance between the components and the intersection point.

3) APPROVAL ATTRIBUTES OF AUTOMOTIVE SCENARIOS
If the predictability of a system's proper operation decreases or the safety parameter values deteriorate, system approval probability will also decrease. Therefore, the indicator that describes whether the system can be approved or not must be proportional to the indicators characterising the system's safety and predictability. Thus the purpose of a highly automated vehicle function's test procedure is to identify as many unsafe and unknown (Fig. 9) system outputs as possible, depending on the combination of system inputs [69].
The system can only be approved for input combinations with known and safe outputs. With the results of such testing procedures, the development process may extend the approved (known and safe) operating range step-by-step, as specific safety mechanisms can be implemented for unsafe or unknown ranges (Fig. 10).

4) CYBERSECURITY ATTRIBUTES OF AUTOMOTIVE SCENARIO
For the cybersecurity attributes of an automotive scenario, we need to examine factors related to advanced vehicle functions that can critically affect the severity or probability of an unsafe event on the one hand and can be significantly influenced through the communication network of vehicle systems on the other hand [70]. These factors can typically be the latency, the packet delivery ratio or the assumed level of data compromised [71].

E. MODEL DEVELOPMENT
Different decision problems are presented about a pedestrian crossing scenario to demonstrate the novelty of the developed testing concept. The mathematical representation of specific decision problems can help us to understand the concept of utilising interacting testing objects in reacting scenarios [72]. Furthermore, solving the problems can result in a novel method for establishing a new generation of automotive simulation frameworks.
The mathematical model representation of the participants' decision problem has limitations for general interpretation. The calculations can be further developed by more detailed modelling of the actors' realistic behaviour (e.g. closed-loop control).
During the pedestrian's decision problem, starting from the edge of the sidewalk, the pedestrian needs to consider the time plan of the crossing process (Fig. 11). The goal is to determine the trajectory (Y (ped,t) ) of the pedestrian, in other words, to identify the value of the optimisation variable (Y (ped,t) ) in the given t step timestep when the other external variables are considered to be known. The objective function (f ped ) is to maximise the reduction in the distance from the target position of the pedestrian (Y (ped,Dest) ). The constraint of the nonlinear task is the maximum speed of the pedestrian (v ped ). The decision is furthermore influenced by the estimated time horizon of the decision, the estimated behaviour of the vehicle on the road surface, mainly the predicted time-dependent position of the vehicle: X 1 (veh,t) , X 2 (veh,t) and the starting and target positions of the components involved in the given scenario. The simplified decision problem of the pedestrian assumes that the pedestrian moves in a vertical direction (parallel to the vertical axis) at the pedestrian crossing (Fig. 11), and the intersecting vehicle travels in a horizontal direction (only the x coordinate changes) can be represented as follows.
The following inequality represents the first constraint describing the expected maximum speed of the pedestrian.
The second constraint represents pedestrians' safety aspects, which can be identified by the following formula, assuming that the pedestrian aims to avoid approaching the vehicle closer to a safe distance.
To solve the nonlinear optimisation problem with multiple constraints, the Karush-Kuhn-Tucker (KKT) method [73], [74] is proposed. First, the gradients of the above functions must be derived to do this.
Following this, the dual feasibility conditions can be introduced.
Based on the gradients of the constraining inequalities, the complementary slackness equations can be utilized.
Finally, the primal feasibility conditions are adapted. VOLUME 11, 2023 Authorized licensed use limited to the terms of the applicable license agreement with IEEE. Restrictions apply.  Solving the equation system defined by the KKT condition leads us to the pedestrian's expected decision to cross the road surface in the shortest time, considering the maximum possible walking speed and the safety risk of intersecting the vehicle's trajectory.

2) THE DECISION PROBLEM OF THE VEHICLE
During the vehicle's decision problem (Fig. 12), starting from the entering point of the road section, the vehicle needs to consider the time plan of the crossing process [75]. Accordingly, the goal is to determine the trajectory of the vehicle (X veh,t ), in other words, to identify the value of the optimisation variable (X veh,t ) in the given timestep (t) when the other external variables are considered to be known. The objective function (f veh ) aims to maximise the reduction in the distance from the target position of the vehicle (X veh,Dest ). The constraint of the nonlinear task is the maximum speed of the vehicle (v veh ). The decision is further influenced by the estimated time horizon of the decision, the estimated behaviour of the pedestrian on the road surface (mainly the predicted time-dependent position of the pedestrian (Y ped,t ) and the starting and target positions of the components involved in the given scenario.
The simplified decision problem of the vehicle assumes that the vehicle moves in a horizontal direction (parallel to the horizontal axis) at the pedestrian crossing, and the intersecting pedestrian walks in a vertical direction (only the y coordinate changes) can be represented as follows.
The following inequality represents the first constraint describing the expected maximum speed of the vehicle.
The second constraint represents the safety aspects, which can be identified by the following formula, assuming that the vehicle aims to avoid approaching the pedestrian closer to a safe distance (sd).
The third constraint describes the acceptable deceleration limit of the vehicle.
To solve the nonlinear optimisation problem with multiple constraints, the KKT method is applied based on the gradients of the above functions.
Following this, the dual feasibility conditions are introduced.
Based on the gradients of the constraining inequalities, the complementary slackness equations are defined.
Finally, the primal feasibility conditions are adapted.
Solving the equation system defined by the KKT condition leads us to the vehicle's expected decision to cross the investigated road section in the shortest possible time, considering the maximum possible driving speed and the safety risk of intersecting the pedestrian's trajectory.

3) THE DECISION PROBLEM OF THE REACTING SCENARIO
To be able to describe a particular scenario, the interaction of the participants (separate decision processes) needs to be modelled simultaneously. For this, the previously introduced optimisation problems have to be solved simultaneously, supplemented with an assumed prediction of the scenario actors representing the expected behaviour of the other components.
Let us assume that the pedestrian estimates the vehicle's behaviour based on the applied velocity of the last two time-steps of the vehicle. So the pedestrian expects the vehicle's velocity to be the mean velocity of the previous two time-steps: Based on the estimated velocity of the vehicle in the t-th time-step, the pedestrian can predict the vehicle's expected position. (33) Similar to the pedestrian decision model, it is assumed that the vehicle also estimates the expected velocity of the pedestrian based on the pedestrian speed detected in the previous two time-steps.
And similarly, based on the estimated velocity of the pedestrian in the t-th time-step, the vehicle can also predict the expected position of the pedestrian.
The safety indicator describing the scenarios should refer to the potential accident risk [76]. Accordingly, it should be based on estimating the probability and severity of the potential collision. The collision probability can be approximated by the Temporal Distance of the actors involved in the scenario (TD t ).
The severity of an accident is directly proportional to the kinetic energy [77]. The so-called Energy Equivalent Speed (EES) value describes the direct relationship between the vehicle speed and the energy consumed during the vehicle body deformation in a traffic accident.
In our case, with a significant simplification, it is estimated by the square of the vehicle speed (v veh,t ). Consequently, the Scenario Risk Indicator (SRI ) can be defined as the timestep-based sum of the product of actual vehicle speed and the temporal distance of the actors (where N is the number of time-steps). To select the most hazardous scenarios, we need to identify those cases which maximise the SRI function. Accordingly, we need to maximise the following objective function.

III. RESULTS AND DISCUSSION
In contrast to previous approaches, the SRI-based evaluation provides new opportunities. Riedmaier et al. [25] also searched for critical cases; however, they focused on physically measurable metrics like distance to represent safety. Fremont and colleagues applied similar considerations [31]. Instead, this paper aims to handle safety risks in a more complex manner by multiplying the severity and occurrence of unexpected events. Bolte et al. [28] investigated the video-signal processing system related corner-case detection; however, they did not propose a general, functionindependent methodology. This chapter presents a simplified example where the test scenario is generated as an interaction of the simultaneously updated pedestrian and vehicle decisions. A scenario can be characterised by a risk indicator, which allows the modification of external variables to identify more dangerous 82472 VOLUME 11, 2023 Authorized licensed use limited to the terms of the applicable license agreement with IEEE. Restrictions apply.  scenarios. The following calculations only illustrate the practical applicability of the methodology presented so far. The model parameters (e.g. speed) used in the calculations are realistic but not necessarily representative of the scenario.

A. AVERAGE-SPEED SCENARIO
In the average-speed scenario (Fig. 13), the vehicle approaches the pedestrian crossing at 50km/h. The initial distance of the vehicle from the pedestrian crossing is 50 meters. The assumed width of the vehicle is 2.5 meters, including the safety distance. Furthermore, the pedestrian wants to cross two lanes, which means an 8-meter-long section. The considered maximum speed of the pedestrian is 1.5 m/s. By simultaneously solving the above-mentioned decision problem, based on the identified scenario, the decision process of the pedestrian and the vehicle can be described with the following spatial locations. During the decision process, the components consider a time horizon of 9 seconds. The considered safety radius is 0.25 meters, which means that the vehicle and the pedestrian try to avoid any cases where they might get closer to each other than this distance during their motion.
We can observe in this scenario that due to the expected behaviour of the pedestrian, the vehicle does not slow down but approaches the pedestrian crossing at a constant speed. Table 1. illustrates the time horizon of 9 seconds with the calculated first 3 iteration steps. In this case, the vehicle predicts that the pedestrian can pass through the crossing without increasing the walking speed above the average level. The vehicle also follows this decision plan in the following steps, as it seems clear that the pedestrian can cross the road without entering the vehicle's safety radius.
At the same time, due to the estimated behaviour of the vehicle, the pedestrian does not reduce his walking speed but paths through the pedestrian crossing at a constant speed ( Table 2). In this case, the pedestrian expects the vehicle not to reach the crossing at its perceived speed. The pedestrian also follows this decision plan in the following steps since it seems clear that the vehicle does not reach the cross-section of the pedestrian crossing.  In the average-speed scenario, the calculated value of the risk indicator is SRI = 37.9.

B. HIGH-SPEED SCENARIO
In the high-speed scenario, the vehicle approaches the pedestrian crossing at a maximum speed of 110km/h. All other parameters are the same as in the average-speed scenario (departure distance: 50m, pedestrian's velocity: 1.5 m/s, etc.). Similarly, considering a time horizon of 9 seconds, performing the same calculations on this new parameter set, the decision process of the pedestrian and the vehicle changes as described in Fig. 14.   FIGURE 14. Illustrating a high-speed scenario. VOLUME 11, 2023   Due to the vehicle's high speed, the vehicle cannot stop safely before the pedestrian despite braking with maximum deceleration (Table 3). Accordingly, in this case, the vehicle expects the pedestrian to stop in front of the crossing. The vehicle follows this decision plan in the following steps, as the pedestrian does not appear to cross the road.
At the same time, due to the estimated behaviour of the vehicle, the pedestrian reduces his walking speed and stops until the vehicle passes through the pedestrian crossing ( Table 4). The pedestrian also follows this decision plan in the following steps since it is clear that the vehicle cannot stop before the cross-section of the pedestrian crossing.
In the high-speed scenario, the calculated value of the risk indicator is SRI =186.5.
The presented results demonstrated that applying specific decision models and quantifiable indicators related to the system components of highly automated transport systems could significantly contribute to identifying unsafe corner cases in connected and cooperative autonomous vehicle systems. Based on the performed literature review, this approach can be further extended to involve specific indicators in the model from the field of predictability or cybersecurity.

IV. CONCLUSION
The paper presented a new end-to-end framework for classifying co-simulation environments, focusing on the ability of the participating objects to interact with each other and react to specific external and internal effects or conditions.
Beyond the classical taxonomy of simulation approaches covering solutions such as SiL, HiL, and ViL, new classification groups were introduced depending on the complexity of the testing environment, such as static objects, dynamic objects, interacting objects, and reacting scenarios. Besides classification, a novel concept was proposed to search for corner cases where critical test scenarios can be identified based on specific indicators describing the investigated scenario's predictability, safety, or security level. The presented mathematical model illustrates the decision problems of the scenario participants, involving highly automated and human actors as well. Applying this model to simplified test cases justified the practical operation of the critical scenario identification concept. The presented results showed that applying specific decision models and quantifiable indicators related to the system elements of highly automated transport systems could significantly contribute to systematically identifying unsafe critical scenarios related to connected and cooperative autonomous systems. Following the reviewed literature, this approach can be improved by including additional indicators in the model focusing on predictability or cybersecurity. Further research could also focus on identifying nominal SRI values that can separate corner cases from ordinary cases. Finally, it has to be emphasised that the presented model is the proof-of-concept of the theory. The practical application requires defining precise case-sensitive model parameters (such as safety radius, walking speed, and decision time frame) or applying more realistic physical parameters (such as lane width or maximum acceptable deceleration). The presented framework, with these model refinements, enables a more realistic representation of real-life scenarios and the inclusion of multiple scenario actors while still maintaining the reliability of the results.