Commercial Cyber-Physical System Development Tool Chain Bug Detecting via Diversity-Guided Fuzzing Test

Simulink is MathWorks’ commercial cyber-physical systems development tool, which enables engineers to do rapid prototyping of their systems through simulation and embedded code generation. When a Simulink model meets requirements, engineers can utilize embedded coder to convert it into embedded code (e.g., C source code) and deploy it in safety-critical applications such as automotive, aerospace, and healthcare. However, bugs or incorrect implementations in code generation may lead to unexpected behaviors in target applications, posing security risks. Therefore, it is crucial to eliminate such bugs in embedded code generation. To address this issue, we propose DESCO, a differential testing approach to test embedded code generation in Simulink. DESCO considers the functional correlation between Simulink blocks for partitioning, aiming to generate diverse and complex bug-triggering Simulink models to thoroughly exercise the embedded code generation. DESCO then detects bugs by analyzing the outputs of these Simulink models by differential testing. The experiments demonstrate that DESCO significantly outperforms existing approaches. In three months, DESCO reported 16 issues, including 12 confirmed as bugs by MathWorks Support.