GPU-Accelerated Guided Heuristic Sampling for Residual Error Probability Analysis in CAN FD Communication

Abstract

The deployment of automated driving features demands stringent compliance with ISO 26262, particularly concerning data integrity over in-vehicle networks. This study effectively addresses the computational challenges of quantifying the residual error probability of Classical CAN and CAN FD communication under high-order fault profiles. By introducing a GPU-accelerated residual error analysis framework utilizing OpenCL, it overcomes the mathematical barriers of traditional brute-force simulation, elevating execution speeds from 150,000 to 4.2 million iterations per second. Empirical evaluations demonstrate that native data-link layer CRC protection may be bypassed under specific multi-bit physical-layer corruption patterns involving stuff-bit cascading effects. Conversely, for the evaluated application-layer End-to-End (E2E) protected configurations, no residual errors were observed. However, from a functional safety management perspective, these observations must be interpreted within the scope of the investigated configurations: the localized payload regions between Bytes 12 and 16 exhibiting an elevated susceptibility to masking failures apply exclusively to the investigated radar payload structures and selected real-world BLF traces. Because these masking failures are highly dependent on the evaluated frame structures and specific fault-injection scenarios, the conclusions should be limited accordingly to the evaluated configurations.

1. Introduction

1.1. Data Integrity and Modern Functional Safety Verification in Centralized E/E Architectures

The increasing complexity of automotive Electronic/Electrical (E/E) architectures, particularly the transition toward centralized and zone-oriented designs, has increased both the volume of exchanged information and the importance of reliable communication within modern vehicles [1,2]. Advanced Driver Assistance Systems (ADAS) and autonomous driving functions depend on continuous high-bandwidth information exchange from perception sensors such as radar, camera, and LiDAR systems [1]. To support these growing communication requirements, Controller Area Network Flexible Data-Rate (CAN FD) has become a widely adopted in-vehicle communication technology due to its increased payload capacity and higher data-phase bit rate compared with Classical CAN [3,4]. Developed to overcome the payload limits of classical CAN, CAN FD introduces dual bit-rate switching enabling data phase speeds up to 8 Mbps and extends the payload length up to 64 bytes per frame [3,5].

Despite these protocol advancements, the harsh physical environment of vehicles exposes transmission lines to severe electromagnetic interference (EMI) and thermal transients [6,7]. These disturbances manifest at the physical layer as high-frequency noise and sudden multi-bit flips, significantly lowering the transceiver’s native RF noise immunity during the accelerated data phase [8]. Under the strict mandates of the ISO 26262 functional safety standard, any communication channel carrying safety-critical functions up to ASIL D must undergo rigorous verification to demonstrate that the residual error probability (Pre) is bounded within quantified safety limits [9,10]. While standard middleware layers like the AUTOSAR communication stack provide structural wrappers, they execute at upper layers and cannot natively eliminate transient bitstream corruptions occurring at the physical interfaces [11]. Consequently, quantitative evaluation of data-link layer integrity under severe fault conditions is required to support communication safety assessments based on realistic fault scenarios.

1.2. Literature Review: The Phenomenon of Stuff-Bit Cascading and Data-Link Layer CRC Masking

The effectiveness of error-detection mechanisms in serial automotive buses is strongly influenced by the properties of the applied Cyclic Redundancy Check (CRC) structures. The error-detection performance and Hamming distance (HD) properties of a CRC polynomial are highly dependent on the message length [12]. To preserve a strict property of HD = 6 across extended frames, the CAN FD extends the CRC protection mechanism used in Classical CAN by introducing longer CRC fields: a 17-bit polynomial is applied for shorter payloads, while a 21-bit polynomial is used for extended payload lengths exceeding 28 bytes [2,5]. Furthermore, CAN FD introduces a fixed 3-bit Stuff Count field complemented by an even parity bit directly preceding the CRC sequence to protect against frame-length distortion [2].

However, a vulnerability persists due to the protocol’s reliance on dynamic bit-stuffing at the Physical Coding Sub-layer (PCS) for node synchronization [5,13]. When severe EMI induces localized multi-bit flips, data bits and stuff bits can be corrupted simultaneously. This synchronization disruption triggers the stuff-bit cascading anomaly, where stuff bits are erroneously inserted or deleted during receiver-side decoding, causing a logical shift in the frame’s length interpretation [2,13]. If this corrupted bitstream and its shifted frame boundary align into a permutation where the receiver’s hardware engine computes a checksum that matches the corrupted CRC field, a masking effect occurs [14]. The frame passes Medium Access Control (MAC) validation as an Undetected Frame Error (UFE), silently injecting corrupted data into the vehicle’s execution loops [14,15].

1.3. Research Gap: Limitations of Analytical Models and the Combinatorial Explosion Wall

Quantifying the boundary conditions of these masking failures has traditionally relied on deterministic analytical modeling under the assumption of uniform bit-error rate (BER) distributions [13,16]. Modern automotive sensor traffic, such as telemetry captured in binary logging format (BLF) traces, is inherently highly structured, presenting non-uniform bit transition densities [1]. Traditional uniform analytical models may not fully represent the localized signal packaging characteristics of production sensor communication, which can limit their ability to describe frame-specific residual-error behavior [16,17].

Conversely, executing an exhaustive empirical verification of specific sensor payloads under higher-order fault profiles strikes an insurmountable mathematical barrier known as the combinatorial explosion. Consider a 64-byte CAN FD frame subjected to a 10-bit fault injection matrix across its 512-bit payload window. The total number of unique error permutations is defined by the binomial coefficient:

$$\left({\displaystyle \genfrac{}{}{0pt}{}{N}{k}}\right)=\left({\displaystyle \genfrac{}{}{0pt}{}{512}{10}}\right)\approx 1.02\times {10}^{21} permutations$$

(1)

Traditional verification setups relying on single-threaded CPU architectures would require millions of compute-years to execute a single high-order fault matrix sweep. While advanced combinatorial text-to-pattern search algorithms and generalized Hamming completeness proofs exist in pure computer science [18,19], they lack the protocol-specific abstractions required to model the non-linear interactions of physical bit-stuffing [2,13].

Because an undetected frame error under modern CRC configurations represents an extremely low-probability event, it falls squarely into the category of a rare-event simulation problem [20]. Standard Monte Carlo simulation techniques exhibit massive variance when applied to rare events, requiring unfeasible sample sizes to achieve statistical confidence [20]. Established rare-event simulation techniques include Importance Sampling, Cross-Entropy methods, Subset Simulation, and Sequential Monte Carlo [20]. The present work does not aim to establish general superiority over these methods; instead, it investigates a protocol-specific guided sampling mechanism that exploits previously observed UFE-producing bit positions and combines this guidance with GPU-parallel frame validation. A comprehensive comparison with multiple alternative rare-event simulation strategies remains outside the scope of the present study; however, a preliminary matched-budget comparison with a Cross-Entropy-based method is included to assess the relative behavior of the proposed heuristic under equivalent computational conditions.

1.4. Research Objectives & Scientific Contributions

This study investigates a computational framework for residual error probability analysis in Classical CAN and CAN FD communication systems, with particular emphasis on high-order physical-layer corruption scenarios and rare-event fault configurations. The work focuses on rare, multi-bit physical-layer corruption patterns that may remain undetected by native protocol-level error detection mechanisms after receiver-side destuffing, CRC validation, and normal message filtering. The analysis is motivated by the need to support ISO 26262-oriented communication safety arguments with empirical evidence under practically relevant, high-order fault scenarios.

The study addresses the following research questions:

• RQ1: How can the combinatorial complexity of multi-bit residual error analysis in Classical CAN and CAN FD communication be reduced to a level that is feasible for practical engineering evaluation?
• RQ2: Can previously observed undetected error patterns be reused to guide subsequent high-order fault-injection campaigns toward more vulnerable bitstream regions?
• RQ3: Are undetected frame errors uniformly distributed across the evaluated frame structures, or do specific payload-dependent regions exhibit increased susceptibility to CRC masking and stuff-bit cascading effects?
• RQ4: How effectively can bit-level fault injection, destuffing emulation, and CRC validation be parallelized using GPU-based OpenCL execution while preserving functional equivalence with a CPU reference implementation?

Based on these research questions, the paper provides the following scientific and engineering contributions:

• Methodological contribution: The paper proposes a Guided Carry-over heuristic sampling approach for residual error analysis in serial automotive communication. Instead of relying only on unguided random sampling or exhaustive enumeration, the method reuses bit positions that previously contributed to undetected frame errors and carries them forward into higher-order fault-injection experiments. This supports a more targeted exploration of stuffing-sensitive and CRC-masking-prone regions of the serialized bitstream.
• Computational contribution: The study implements a GPU-accelerated OpenCL verification framework for large-scale bit-level fault injection, receiver-side destuffing emulation, and CRC evaluation. The framework treats individual fault configurations as independent execution units, allowing large fault-injection campaigns to be executed more efficiently than conventional single-threaded CPU-based simulations.
• Empirical contribution: The framework is evaluated using selected real-world radar sensor BLF traces and protocol configurations for Classical CAN and CAN FD. The experimental results identify payload-dependent vulnerability regions, including an elevated susceptibility cluster in the investigated radar payload structure, thereby showing that residual error occurrence can be strongly dependent on frame layout and bitstream structure.
• Safety-engineering contribution: The paper evaluates the relationship between native data-link layer CRC protection and additional application-layer End-to-End protection. The results support the argument that application-layer protection can provide an additional diagnostic layer against residual communication errors that may bypass native protocol-level checks under specific multi-bit physical-layer fault conditions.

Overall, the contribution of the paper is not a universal proof of residual error elimination for all CAN or CAN FD messages. Rather, it provides a practical and scalable verification approach for identifying frame-structure-dependent residual error vulnerabilities and for supporting ISO 26262-oriented communication integrity assessments with targeted empirical evidence.

2. Materials and Methods

2.1. Fault Model and Scope Definition

This study investigates residual communication errors in Classical CAN and CAN FD networks from a functional safety and communication integrity perspective. Classical CAN is included as a complete evaluation case and as a reference baseline, while CAN FD is treated as the main target protocol due to its extended payload length, higher data phase bit rate, and enhanced CRC mechanisms. The analysis focuses on the capability of protocol-level error detection mechanisms to identify corrupted frames under multi-bit physical-layer fault conditions.

The considered fault model is based on non-malicious bit-level corruption of the transmitted frame. These faults represent physical-layer disturbances such as electromagnetic interference, direct power injection transients, ground potential fluctuations, or other transceiver-level disturbances that may cause bit inversions during transmission. Cybersecurity-related events, such as malicious frame injection, spoofing, replay attacks, node compromise, gateway manipulation, or intentional software-level attacks, are outside the scope of this study.

Fault injection is performed after the bit-stuffing process, on the serialized physical bitstream. Consequently, the injected bit flips may affect any part of the frame that is covered by the corresponding protocol-level CRC calculation. This includes not only the logical payload bits, but also protocol-relevant bit positions whose corruption may influence the receiver-side destuffing and CRC validation process. By injecting faults after bit-stuffing, the framework is able to evaluate error patterns that may disturb the physical bitstream alignment and trigger stuff-bit cascading effects during receiver-side decoding.

The applied fault model is a discrete bit-level abstraction and does not attempt to reproduce the complete physical waveform of an electromagnetic disturbance. In particular, the present experiments do not parameterize temporal correlation, burst duration, coupling mechanisms, transceiver threshold behavior, or empirically measured burst-error distributions. The post-stuffing injection point is intentionally retained because physical disturbances act on the already serialized transmitted bitstream and may therefore corrupt both information bits and inserted stuff bits before receiver-side destuffing. Consequently, the reported residual-error results should be interpreted as conditional on the adopted discrete multi-bit fault model rather than as direct estimates of the occurrence probability of specific real-world EMI events.

An error case is classified as an Undetected Frame Error (UFE) if the corrupted frame is not rejected during the receiver-side destuffing process, passes the protocol-level CRC validation, and also passes the normal message filtering mechanisms, while the reconstructed message content differs from the originally transmitted data. In contrast, corrupted frames that are rejected by stuff-error detection, CRC mismatch, form error detection, frame drop, or other protocol-level rejection mechanisms are considered detected errors and are not counted as residual undetected errors.

The present analysis is intentionally restricted to the integrity of individual transmitted frames at the physical and data-link processing levels. Accordingly, network-level temporal effects such as dynamic bus load, message-period variation, arbitration interactions, gateway forwarding, and multi-frame dependencies are not included in the current simulation model. These phenomena can influence the frequency, propagation, retransmission, and system-level consequences of communication errors, but they are outside the scope of the present UFE classification, which evaluates whether a corrupted individual frame can pass receiver-side destuffing, CRC validation, and message filtering while delivering altered payload data.

Likewise, the evolution of CAN error counters, error-passive transitions, retransmission behavior, and bus-off states is not modeled, because the present framework terminates the evaluation at the classification of the individual received frame rather than simulating subsequent network-state evolution.

The investigated fault profiles cover multi-bit error cases with increasing bit-flip depth. Low-order fault cases are used to identify error-sensitive frame regions, while higher-order fault configurations are explored using a guided heuristic sampling strategy. In the current implementation, bit positions that previously contributed to undetected errors are reused as candidate coordinates in subsequent simulations with higher bit-flip counts. This carry-over mechanism is intended to increase the probability of revisiting stuffing-sensitive and CRC-masking-prone regions of the serialized frame. Therefore, the method should be interpreted as a guided vulnerability search and rare-event acceleration approach rather than a fully exhaustive enumeration of the complete combinatorial fault space.

The hot-slot mechanism is empirical and payload-dependent. A bit position is treated as relevant when it appears in an error pattern that produced an undetected frame error in an earlier simulation layer. These positions are then carried forward into higher-order fault-injection experiments. Since the occurrence of an undetected error is not guaranteed for every later combination containing the same bit position, the hot-slot set is not interpreted as a deterministic failure map. Instead, it represents a heuristic candidate region that guides further sampling toward previously observed vulnerable bit configurations.

Application-layer protection mechanisms, such as AUTOSAR End-to-End communication protection, are considered as an additional diagnostic layer above the native CAN or CAN FD data-link layer CRC. The evaluated E2E implementation was based on a custom E2EProfile implementation following AUTOSAR E2E Profile 1/4 concepts, including Data ID integration into the CRC calculation and profile-specific counter handling. Accordingly, this observation is treated as configuration-specific and should not be interpreted as a general residual-error bound for AUTOSAR E2E protection; precise reproduction would require the corresponding E2E profile, polynomial configuration, Data ID handling, rolling-counter configuration, and field-placement parameters of the evaluated setup.

The empirical results are therefore valid for the evaluated frame structures, fault-depth ranges, sampling strategy, and available test data. They should not be interpreted as a universal proof of complete residual-error elimination for all CAN or CAN FD messages, all payload structures, or all possible physical-layer disturbance patterns. Instead, the proposed framework provides a practical method for identifying payload- and frame-structure-dependent vulnerability regions and for supporting functional safety arguments with targeted residual error analysis.

Consideration of Burst and Correlated Fault Models

The fault model employed in this study is based on discrete fixed-depth multi-bit flips, where $k$ physical bit positions are selected without replacement. This model enables a systematic exploration of the combinatorial fault space. However, real-world physical layer disturbances, such as those caused by electromagnetic interference (EMI) from high-power switching events or crosstalk, often manifest as burst errors. A burst error is characterized by a sequence of consecutive or near-consecutive bit flips within a localized time window. In contrast to the nominal fixed-depth random fault distribution used for the baseline analysis, a burst error represents a correlated fault pattern where the probability of a bit being affected depends on the spatial relationship between neighboring positions.

The potential impact of burst errors on CAN FD data integrity differs from that of independent multi-bit fault patterns because the spatial correlation of affected bits may alter the interaction between corrupted data bits, synchronization-related bits, and CRC validation. A burst error, by its nature, introduces a concentrated disruption to the bitstream. This localized corruption has a higher probability of simultaneously altering data bits and adjacent stuff bits. Such a scenario can increase the possibility of simultaneously affecting data bits and synchronization-related bit patterns, which may contribute to receiver-side destuffing disturbances. This shift, when combined with the corrupted bitstream, may contribute to conditions under which CRC masking failures can occur. The random multi-bit flip model, while covering a wider combinatorial space, may underestimate the likelihood of these specific, highly potent error patterns.

The present study therefore extends the baseline evaluation with a preliminary burst-oriented sensitivity analysis. This additional experiment does not represent a measurement-calibrated EMI model; instead, it evaluates whether the identified residual-error mechanisms remain observable under a structured correlated fault pattern. The discrete model allows for a structured and reproducible exploration of the fault space, which supports the exploration of a broad range of masking configurations within the evaluated fault space, not just those triggered by a specific type of burst. The insights gained from this analysis, particularly the identification of payload-dependent vulnerable regions, can support future investigations involving more detailed and measurement-informed burst error models.

2.2. Mathematical Formulation of Rare-Event Importance Sampling

To quantify the residual error probability, the fault-injection problem is formulated as a rare-event estimation task over the serialized physical bitstream of a Classical CAN or CAN FD frame. In this section, the residual error probability is represented by the metric $\gamma$. Let $X={\mathrm{0,1}}^{\mathrm{N}}$ denote the space of all possible bit-level fault configurations for a frame section of length $N$. A fault configuration is represented by an error vector $e\in X$, where $e_i=1$ indicates a bit flip at position $i$, and $e_i=0$ indicates that the corresponding bit remains unchanged.

Under the nominal random fault model, the probability of an error vector is described by the distribution $f\left(e\right)$. For a fixed fault-depth layer $k$, let:

$${\Omega }_k=\left\{e\in {\left\{\mathrm{0,1}\right\}}^N : {‖e‖}_0= k\right\}$$

(2)

denote the set of all admissible error vectors containing exactly $k$ flipped bit positions. The nominal within-layer distribution assigns equal probability to each configuration in ${\Omega }_k$, such that

$$f_k={\displaystyle \frac{1}{\left(\genfrac{}{}{0pt}{}{N}{k}\right)}}, e\in {\Omega }_k$$

(3)

The unguided baseline samples directly from this nominal distribution, whereas the Guided Carry-over mechanism samples from a biased proposal distribution $g_k\left(e\right)$ that increases the probability of combinations containing previously identified vulnerable positions.

Thus, the present experimental model is a fixed-depth combinatorial bit-flip model rather than an independent Bernoulli error process. Nevertheless, neither the nominal nor the guided distribution is calibrated to a measured temporal EMI burst model in the current study. The function $I\left(e\right)$ is used as an indicator function for the Undetected Frame Error event. It is equal to one if the injected error vector results in an accepted but corrupted frame, and zero otherwise. In this study, a frame is counted as an Undetected Frame Error only if it is not rejected during receiver-side destuffing, passes the protocol-level CRC validation and normal message filtering, while the reconstructed message content differs from the originally transmitted data.

The target metric γ is therefore defined as the expected value of the indicator function $I\left(e\right)$ under the nominal fault distribution $f\left(e\right)$:

$$\gamma =E_f\left[I\left(e\right)\right]=\sum _{e\in X}I\left(e\right)f\left(e\right)$$

(4)

Since undetected frame errors are rare events, direct sampling from the nominal distribution $f\left(e\right)$ may require an impractically large number of iterations before relevant failure cases are observed. To improve convergence, the sampling process is shifted toward a biased proposal distribution $g\left(e\right)$, which increases the probability of selecting fault configurations located in previously observed vulnerable bitstream regions.

For each fixed fault-depth layer $k$, the proposal distribution $g_k\left(e\right)$ corresponds to the mixed guided–uniform sampling mechanism described in Section 2.3. The probability of each generated error vector is evaluated under this proposal distribution during sampling. Because the proposal retains a non-zero uniform component, every error vector that has non-zero probability under the nominal distribution $f_k\left(e\right)$ also remains reachable under $g_k\left(e\right)$.

For every sampled error vector, the implementation evaluates the corresponding likelihood weight as follows.

$$W_k(e)={\displaystyle \frac{f_k\left(e\right)}{g_k\left(e\right)}}$$

(5)

This weight is applied to the UFE indicator in the layer-wise importance-sampling estimator, thereby correcting for the deliberate bias introduced by the Guided Carry-over proposal.

For fault vectors containing multiple hot-slot positions, the proposal probability $g_k\left(e\right)$ is evaluated by considering the complete proposal probability of generating the observed fault vector under the mixed guided–uniform sampling mechanism. In particular, the guided branch probability accounts for all possible seed selections from the current hot-slot registry that can result in the same final fault vector. Therefore, $g_k\left(e\right)$ is not calculated from a single generation path, but from the aggregated probability of all valid sampling paths producing the evaluated error vector. This ensures that the likelihood ratio $W_k\left(e\right)=f_k\left(e\right)/g_k\left(e\right)$ remains consistent with the actual proposal distribution.

This preserves the statistical interpretation of the estimator while allowing the simulation to focus more computational effort on error configurations that are more likely to produce undetected frame errors:

$$\gamma =\sum _{e\in X}I\left(\mathit{e}\right){\displaystyle \frac{f\left(\mathit{e}\right)}{g\left(\mathit{e}\right)}}g\left(\mathit{e}\right){=E}_g\left[I\left(e\right)W\left(e\right)\right]$$

(6)

In the proposed framework, the Guided Carry-over mechanism is used to support the construction of $g\left(e\right)$. Bit positions that previously appeared in undetected error configurations are stored as candidate hot-slot coordinates and reused in subsequent higher-order fault-injection layers. This increases the sampling density around stuffing-sensitive and CRC-masking-prone regions of the physical bitstream.

The resulting formulation combines rare-event importance sampling with protocol-specific heuristic guidance. The purpose of this approach is to reduce the practical computational burden of residual error analysis while preserving the connection between the biased sampling process and the original residual error probability metric $\gamma$.

2.3. The Guided Carry-Over Heuristic Sampling Algorithm

The Guided Carry-over mechanism is introduced to improve the practical efficiency of rare-event residual error analysis. The method is based on the observation that undetected frame errors are not equally likely to occur for all physical bit positions. Certain bitstream regions may be more sensitive to receiver-side destuffing disturbances, CRC masking effects, or frame-boundary shifts. Therefore, fault configurations that previously resulted in an Undetected Frame Error are used to guide later sampling iterations.

The algorithm operates in two main phases separated by a configurable fault-depth threshold $k_0$, denoted in the implementation by exhaustive_max_flips. The value of $k_0$ is not prescribed as a universal constant; it is selected for each evaluation configuration according to the size of the admissible fault space and the available computational budget. For fault depths $k\le k_0$, all admissible $k$-bit fault combinations are evaluated exhaustively. This low-order phase therefore provides a deterministic vulnerability-mapping stage from which candidate hot-slot positions are identified. Whenever an evaluated error vector $e$ results in $I\left(e\right)=1$, the corresponding flipped bit positions contribute to the hot-slot registry used by the subsequent sampling layers. For fault depths $k>k_0$, exhaustive enumeration is replaced by the Guided Carry-over sampling procedure because of the rapidly increasing combinatorial search space.

In the second phase, higher-order fault vectors are generated using a mixed guided–uniform proposal mechanism. The mixture is controlled by an adaptive coefficient ${\alpha }_k$.

$$a_k=clip (a_0{\displaystyle \frac{{|H}_k-1|}{n}}, a_{min},a_{max})$$

(7)

where $\mid H_{k-1}\mid$ denotes the number of hot positions retained from the preceding fault-depth layer and $n$ is the number of admissible fault positions. The upper bound is constrained to remain below unity, ensuring that the uniform branch retains a non-zero sampling probability.

In the guided branch, one seed position is selected from the current hot-slot registry, after which the remaining $k-1$ fault positions are selected uniformly without replacement from the remaining admissible positions. In the uniform branch, all $k$ fault positions are sampled uniformly without replacement from the complete admissible position set. Consequently, duplicate bit positions cannot occur within an individual fault vector. The non-zero uniform component ensures that configurations outside the previously identified hot-slot regions remain reachable. Nevertheless, the effectiveness of the Guided Carry-over mechanism depends on the representativeness of the preceding low-order exploration. If a genuinely vulnerable region is not activated by any UFE-producing configuration within the evaluated low-order fault-depth layers, that region may remain underrepresented in subsequent guided fault-injection layers and may therefore remain undiscovered within a finite sampling budget. Consequently, the proposed hot-slot mechanism should be interpreted as an empirical acceleration heuristic rather than as a guarantee of complete vulnerability-space coverage.

The hot-slot registry is maintained using frequency-based weights rather than as a purely binary set. After each evaluated fault-depth layer, the weights of previously identified positions are attenuated by a configurable decay factor, while positions appearing in newly detected UFE configurations receive additional weight. Candidates whose weights fall below a configurable retention threshold (promote_threshold) may be removed, and the total number of retained candidates is bounded by a configurable max_hot_slots limit, with the highest-weighted positions retained when this limit is exceeded. This mechanism prevents unbounded growth of the hot-slot registry while preserving repeatedly observed candidate positions and gradually reducing the contribution of older or weakly supported entries.

The likelihood ratio $W\left(e\right)$, as introduced in Section 2.2, is then used to preserve the statistical interpretation of the estimator.

The purpose of the Guided Carry-over mechanism is not to replace the CRC validation or receiver-side protocol model, but to improve the efficiency of finding rare UFE-producing configurations. Each generated fault vector is still evaluated through the same processing chain: fault injection, receiver-side destuffing, protocol-level CRC validation, message filtering, and final UFE classification using the indicator function $I\left(e\right)$.

2.3.1. AGuided Carry-Over Heuristic Sampling Algorithm

The input, output, and initialization of the proposed algorithm are summarized in Table 1.

Table 1. Input, output, and initialization of the Guided Carry-over Heuristic Sampling Algorithm.

Input	Original Encoded bitstream: $x_{orig}\in {\left\{\mathrm{0,1}\right\}}^N$ Maximum fault depth: $K_{max}$ Exhaustive-enumeration threshold: $k_0$ Sample count per fault-depth layer: $M$ Guided-mixture parameters: ${\alpha }_0,{\alpha }_{\mathrm{m}\mathrm{i}\mathrm{n}},{\alpha }_{\mathrm{m}\mathrm{a}\mathrm{x}}$
Output	Layer-wise residual error estimates: $\left\{\widehat{{\gamma }_k}\right\}$ Layer-wise estimator variances: $\mathrm{Layer}\{{\sigma }_k^2$} Final weighted hot-slot registry: $H$
Initialization	Initialize an empty weighted hot-slot registry $H$

2.3.2. Phase I: Low-Order Topography Exploitation (Vulnerability Mapping)

• For $k=1$ to $k_0$ do.
• Generate and exhaustively evaluate all admissible $k$-bit fault vectors $e$.
• Apply the receiver-side processing chain to each corrupted frame.
• Compute the indicator function $I\left(e\right)$.
• If $I\left(e\right)=1$, update the weights of the corresponding flipped bit positions in the hot-slot registry.
• End if.
• End for.

2.3.3. Phase II: High-Order Heuristic Execution (Rare-Event Sampling)

• For $k=k_0+1$ to $K_{max}$ do.
• Compute the adaptive mixture coefficient ${\alpha }_k$
• Construct the mixed proposal distribution $g_k\left(e\right)$ from the guided and uniform sampling branches.
• Initialize layer accumulators: Sum_UFE ← 0.
• For $m=1$ to $M$ do.
• With probability ${\alpha }_k$, select one seed position from the current weighted hot-slot registry $H$, then select the remaining $k-1$ distinct fault positions uniformly without replacement from the remaining admissible positions.
• Otherwise, with probability $1-{\alpha }_k$, select all $k$ fault positions uniformly without replacement from the complete admissible position set.
• Form the resulting error vector $e_m$.
• Corrupt the baseline frame using the sampled error vector: $x_{corrupt}\leftarrow x_{origin}\mathrm{ϴ}{e}_m$.
• Evaluate the failure indicator ${I(e}_m)$ using the GPU-accelerated receiver-side validation model:

  $${I(e}_m)\leftarrow Execute\_OpenCL\_Validation\_Kernels(x_{corrupt})$$

  (8)
• Compute the statistical likelihood weight: $W\left(e_m\right)\leftarrow f\left(e_m\right)/g_k\left(e_m\right)$
• Accumulate the weighted failure contribution:

  $${Sum}_{UFE}\leftarrow {Sum}_{UFE}+I\left(e_m\right)\times W\left(e_m\right)$$

  (9)
• End for.
• Compute unbiased probability estimate for layer $k$:

  $$\widehat{{\gamma }_k}\leftarrow {\displaystyle \frac{1}{M}}{Sum}_{UFE}$$

  (10)
• Compute the estimator variance for layer (k):

  $${\sigma }_k^2\leftarrow {\displaystyle \frac{1}{M-1}}{\displaystyle \sum _{m=1}^M}({I\left(e_m\right)W\left(e_m\right)-\widehat{{\gamma }_k})}^2$$

  (11)
• Update the weighted hot-slot registry $H$ using the UFE-producing positions observed in the current fault-depth layer; apply the configured decay, retention threshold, and max_hot_slots limit before proceeding to the next layer.
• End for.
• Return $\left\{{\widehat{\gamma }}_k,{\sigma }_k^2\right\}$ and the final weighted hot-slot registry.

2.4. Combinatorial Complexity and Data-Parallel Framework

The computational motivation of the proposed framework is the rapid growth of the multi-bit fault space. In an unguided brute-force analysis, all possible fault combinations within a bitstream window of length $N$ have to be considered up to a maximum fault depth $K$. The size of this search space is described by the cumulative sum of the corresponding binomial terms:

$$O\left({\displaystyle \sum _{k=1}^K}\left({\displaystyle \genfrac{}{}{0pt}{}{N}{K}}\right)\right)\approx O\left({\displaystyle \frac{N^K}{K!}}\right)$$

(12)

This expression illustrates why exhaustive residual error analysis becomes infeasible for long CAN FD frames and high-order fault profiles. For example, when a 512-bit payload-related window is evaluated with fault depths up to $K=10$, the number of possible bit-flip combinations reaches an order of magnitude that is not compatible with practical industrial verification timelines.

The Guided Carry-over mechanism reduces this computational burden by concentrating the sampling process around empirically identified hot-slot positions. These positions are obtained from previous fault-injection layers where undetected frame errors were observed. Let $H$ denote the weighted hot-slot registry and let $d= \mid H\mid$ denote the number of candidate bit positions currently retained in the registry. During the high-order sampling phase, the proposal distribution $g\left(e\right)$ increases the probability of selecting error vectors that include positions from $H$, while still allowing additional exploration outside the hot-slot registry.

Accordingly, the effective sampling process is no longer an unguided traversal of the complete $N$-dimensional fault space. Instead, the simulation effort is concentrated on a smaller, empirically relevant subset of the bitstream. The corresponding guided search complexity can be described as:

$$O\left({\displaystyle \sum _{k=k_0+1}^K}\left({\displaystyle \genfrac{}{}{0pt}{}{d}{k}}\right)\right)\approx O\left({\displaystyle \frac{d^K}{K!}}\right)$$

(13)

This reduction should be interpreted as a practical acceleration of the rare-event search rather than as a complete elimination of the underlying combinatorial problem. The achieved reduction depends on the size and stability of the hot-slot registry, the evaluated frame structure, the selected fault-depth range, and the applied sampling budget. Therefore, the guided complexity reduction is payload- and configuration-dependent.

The second major acceleration factor is data-parallel execution. Although the CRC calculation of a single frame contains sequential bit-level dependencies, different fault-injection scenarios are mutually independent. This makes the problem suitable for GPU-based execution, where each sampled fault configuration can be evaluated as an independent work item.

The verification engine is implemented using an OpenCL-based data-parallel framework. The framework parallelizes the main stages of the residual error analysis workflow, including bit-level fault injection, receiver-side bit-stuffing and destuffing emulation, protocol-level CRC validation, and application-layer End-to-End protection checks. In this structure, the CPU is responsible for host-side control, configuration, and result aggregation, while the GPU executes large numbers of independent fault-injection and validation tasks.

The computational workflow consists of the following main processing stages:

• Fault Injection Stage: Each work item applies an error vector generated according to the proposal distribution $g\left(e\right)$ to the encoded reference bitstream using bitwise operations.
• Bit-Stuffing and Destuffing Emulation Stage: The receiver-side decoding logic reconstructs the physical bitstream interpretation and evaluates whether the injected fault pattern causes stuff-bit-related synchronization disturbances or frame rejection.
• Data-Link Layer CRC Validation Stage: The protocol-level CRC validation is executed according to the applicable Classical CAN or CAN FD CRC configuration. This includes CRC-15 for Classical CAN and CRC-17 or CRC-21 for CAN FD, depending on the payload length.
• Application-Layer E2E Validation Stage: When E2E protection is enabled, an additional software-level validation step is executed over the reconstructed payload data to evaluate whether application-layer protection detects residual corruptions that pass the native data-link layer checks.

By combining guided rare-event sampling with GPU-based data-parallel execution, the proposed framework reduces the practical runtime of high-order residual error analysis. The approach does not remove the theoretical combinatorial nature of the problem, but it enables targeted empirical evaluation of fault configurations that are more relevant for residual error discovery within the evaluated frame structures and sampling settings.

2.5. Experimental Design & Data Validation Setup

The empirical validation was performed using automotive network data extracted from real-world radar sensor Binary Logging Format (BLF) traces. Instead of relying only on synthetic random payloads, the evaluation used representative message payloads with deterministic signal layouts, cyclic fields, status information, and radar-object-related data regions. This allows the framework to evaluate residual error behavior under payload structures that are closer to practical in-vehicle communication than uniformly random test vectors. The use of real-world BLF payloads is intended to preserve realistic message-content and bit-transition characteristics; it does not imply reproduction of the complete temporal and network-level behavior of the recorded vehicle bus.

For the CAN FD evaluation, 64-byte radar messages extracted from the selected real-world BLF traces were used as reference data structures. The evaluated campaigns included multiple message instances and heterogeneous payload contents associated with the selected radar communication traces rather than relying on a single fixed synthetic payload. The 64-byte payload length corresponds to the maximum CAN FD data field size and therefore provides a suitable case for investigating high-order multi-bit fault configurations and CRC-21-based protection. Classical CAN configurations were also evaluated as reference cases using the corresponding frame and CRC settings. The protocol-level processing model includes frame encoding, bit-stuffing behavior, receiver-side destuffing, CRC validation, message filtering, and final UFE classification using the indicator function $I\left(e\right)$.

The fault-injection campaigns were executed over multiple fault-depth layers. Low-order fault configurations were used to identify candidate hot-slot positions, while higher-order configurations were evaluated using the Guided Carry-over proposal distribution $g\left(e\right)$. Each sampled error vector was injected into the encoded physical bitstream, and the resulting corrupted frame was processed by the same receiver-side validation chain. A frame was classified as an Undetected Frame Error only if it passed receiver-side validation while the reconstructed payload differed from the original reference payload.

To support reproducibility, sample generation uses a deterministic counter-based random-number generation scheme. Individual random draws are indexed by the fault-depth layer, sampling phase, and draw index, allowing repeated campaigns with the same configuration to reproduce the same sequence of sampled fault vectors. The CPU implementation uses the NumPy Generator with the Philox engine, while the GPU backend uses a corresponding OpenCL Philox implementation, thereby minimizing backend-dependent differences in sample generation.

To validate the correctness of the GPU implementation, a CPU reference implementation was used as a control model. A validation dataset containing (1.0 × 10⁷) corrupted frame instances was generated and evaluated by both the CPU and GPU implementations. The dataset included multi-bit fault configurations, bit-stuffing and destuffing cases, and altered CRC validation scenarios. The output indicator values, reconstructed frame lengths, and CRC validation results produced by the GPU implementation were compared against the corresponding CPU reference outputs.

The GPU implementation produced identical classification results to the CPU reference implementation for the evaluated validation dataset. This confirms that the OpenCL-based parallelization preserved the functional behavior of the receiver-side validation model within the tested sample space. Therefore, the GPU framework can be used as a reliable high-throughput execution platform for the subsequent residual error analysis experiments.

2.6. Limitations and Justification of the Static Fault Model

The analytical approach adopted in this study is intentionally constrained to a static, per-frame fault model. This focus enables an isolated analysis of data-link layer residual-error mechanisms by separating frame-level corruption effects from higher-level network dynamics. By analyzing individual frames in isolation, the framework identifies the conditions under which specific multi-bit physical-layer corruptions may lead to undetected errors, particularly those involving stuff-bit cascading and CRC masking phenomena.

Dynamic network effects, including variable bus load, message scheduling jitter, arbitration behavior, retransmission mechanisms, and CAN error-state transitions, influence the probability of fault exposure and the subsequent propagation of corrupted messages. However, these effects occur at a different abstraction level than the frame-level residual-error classification investigated in this work. The objective of the present framework is to determine whether a given corrupted serialized frame can pass receiver-side validation mechanisms, rather than to estimate the complete vehicle-level probability of an undetected communication failure.

Therefore, the exclusion of these dynamic aspects does not imply that they are irrelevant to the overall communication safety analysis. Instead, the proposed framework provides a controlled frame-level analysis that can be integrated into future network-level simulations or hardware-in-the-loop environments where dynamic communication behavior and system-level consequences are evaluated.

3. Results

3.1. Computational Performance and Validation Results

The empirical execution metrics were evaluated under identical baseline configurations using the selected 64-byte radar sensor payload structure. The single-threaded CPU implementation achieved an average processing throughput of approximately (1.5 × 10⁵) iterations per second. In contrast, the OpenCL-based GPU implementation stabilized at approximately (4.2 × 10⁶) iterations per second on the evaluated hardware platform. This corresponds to an approximately 28-fold throughput improvement compared to the CPU reference implementation.

The CPU and GPU performance measurements were performed using the same logical frame-processing and fault-evaluation configuration. The reported CPU throughput corresponds to a single-threaded reference execution. Before each GPU measurement, one warm-up run was discarded to reduce the influence of OpenCL just-in-time compilation and driver-cache initialization. The benchmark was subsequently repeated ten times, and the resulting execution statistics were evaluated across the repeated runs. OpenCL profiling events were used to separate host-to-device transfer, kernel execution, and device-to-host transfer times, while total wall-clock execution time was also recorded.

The benchmark platform consisted of an integrated Intel(R) Graphics GPU using the Intel(R) OpenCL Graphics platform (driver version 32.0.101.8508) with 64 compute units and approximately 8018 MB global memory. The host system used an Intel64 Family 6 Model 170 Stepping 4 CPU with 14 logical cores running under Windows 11. The CPU reference implementation was executed using CPython 3.14.4. Both backends used the same logical frame-processing and fault-evaluation configuration.

The benchmark was intended to compare the relative execution performance of the CPU and GPU backends under an identical logical workload rather than to characterize the performance of a specific hardware architecture. Consequently, the exact processor and GPU models were not treated as independent experimental variables in the present study. The reported throughput values should therefore be interpreted as platform-specific measurements, while the approximately 28-fold speedup reflects the relative performance observed under the evaluated benchmark configuration.

This acceleration is primarily attributed to the fact that individual fault-injection scenarios can be evaluated independently. However, the CRC calculation and receiver-side decoding of a single frame contain sequential bit-level dependencies; different sampled fault configurations do not depend on each other. Therefore, they can be distributed across GPU work items as independent validation tasks.

The achieved throughput substantially reduces the estimated runtime of large-scale high-order fault-injection campaigns. Based on the measured GPU throughput, a scenario matrix containing approximately $1\times {10}^{11}$ fault configurations would require on the order of seven hours under comparable execution conditions. This value represents an extrapolated runtime estimate derived from measured throughput rather than a single directly executed campaign of ${10}^{11}$ fault configurations. This makes the proposed framework suitable for empirical residual error investigations that would be impractical using conventional single-threaded CPU execution.

The computational and protocol-level configuration parameters of the evaluation platform are summarized in Table 2.

Table 2. Protocol Configuration and Frame Parameters.

Architectural Parameter	Classical CAN Reference	CAN FD Target Configuration
Base Polynomial Configuration	CRC-15 (0x4599)	CRC-17 (0x30857)/CRC-21 (0x19B0E5)
Maximum Payload Length	8 bytes (64 bits)	64 bytes (512 bits)
Bit-Stuffing Synchronization Rule	Dynamic stuff bit after 5 identical bits	Dynamic data stuff bit + Fixed CRC stuff bits
Total Physical Bitstream Window	108–131 bits (Variable bounds)	550–574 bits (Variable bounds)
$\mathrm{Fault} \mathrm{Injection} \mathrm{Matrix} \mathrm{Depth} (k$)	$k\in \left[1, 4\right]$ bit flips (Exhaustive)	$k\in \left[5, 10\right]$$\mathrm{bit} \mathrm{flips} (\mathrm{Heuristic} \mathrm{proposal} g\left(e\right)$)
$\mathrm{Total} \mathrm{Evaluation} \mathrm{Sample} \mathrm{Size} (M$)	$1\times {10}^7$ iterations per base run	$1\times {10}^{11}$ equivalent iterations (estimated)

The fault-depth ranges reported in Table 2 correspond to the evaluated experimental configurations and should not be interpreted as a universal transition threshold of the Guided Carry-over algorithm.

During the high-order fault-injection campaigns, the unguided uniform Monte Carlo sampling approach showed limited practical efficiency, as undetected frame errors were not observed within the evaluated sample budget for several tested configurations. In contrast, the Guided Carry-over proposal distribution $g\left(e\right)$, anchored to previously identified hot-slot positions, increased the occurrence rate of UFE-producing samples within the executed simulations. This demonstrates that the proposed sampling strategy can concentrate computational effort on bitstream regions that are more relevant for residual error discovery than purely uniform random sampling. The comparison presented in this section is limited to the unguided uniform-sampling baseline and does not represent a comprehensive evaluation of all rare-event simulation strategies. A preliminary matched-budget comparison with a Cross-Entropy-based method is presented separately in Section 3.3 to evaluate differences in vulnerability discovery efficiency and estimator behavior under equivalent computational budgets. Further comparisons involving additional methods, such as Subset Simulation or Sequential Monte Carlo, remain outside the scope of the present study.

When executing high-order fault sweeps over the evaluated radar sensor BLF traces, the framework identified an increased occurrence of undetected frame errors concentrated between Bytes 12 and 16 of the investigated payload window. To confirm the statistical significance of this cluster, a 95% confidence interval was calculated for the UFE occurrence density $\left(D_{ufe}\right).$

$${CI}_{95\%}={\widehat{\mu }}_D\mp z_{\alpha /2}{\displaystyle \frac{{\sigma }_D}{\sqrt{M}}}$$

(14)

Across the remaining reference zones (Bytes 0–11 and 17–63), the failure density remained bounded near zero, with $C{I}_{95\%}=\left[0.00;1.12\times {10}^{-9}\right]$. However, within the Byte 12–16 sector, the failure density increased to $C{I}_{95\%}= [3.42 \times {10}^{-4}, 3.86 \times {10}^{-4}]$. Byte indices are reported using zero-based indexing; therefore, the 64-byte payload spans Bytes 0–63.

The byte-level analysis was based on explicit exposure accounting for the evaluated fault configurations, and the corresponding hotspot summaries were generated on a per-campaign basis. The increased UFE concentration in the Byte 12–16 region was observed across multiple evaluated BLF-derived message and payload campaigns rather than only for a single isolated reference payload. Nevertheless, this localization should be interpreted as specific to the investigated radar traces, payload structures, and fault-injection configurations.

3.2. Preliminary Investigation of Burst Error Fault Models

To address the potential impact of correlated fault patterns, a preliminary, small-scale experiment was conducted using a simplified burst error model. In this experiment, a 5-bit burst error was simulated by injecting five consecutive bit flips into the serialized CAN FD frame. The starting position of the burst was selected uniformly at random from all valid bit positions within the frame. A total of ${10}^8$ such burst error configurations were simulated and evaluated using the same GPU-accelerated validation framework.

While this investigation was not exhaustive, the preliminary findings align with the results from the discrete multi-bit flip analysis. The experiment revealed that burst errors also have the potential to create undetected frame errors (UFEs). Notably, the UFEs generated by the burst error model showed a similar pattern of localization, with an elevated concentration of failures occurring when the burst affected the bitstream region corresponding to Bytes 12–16 of the radar payload.

This observation provides additional evidence that the identified payload region is not exclusively associated with the baseline fault distribution but can also exhibit susceptibility under structured correlated fault patterns. A more comprehensive analysis of various burst lengths and patterns remains a subject for future work. Nevertheless, these initial results provide additional empirical support for the primary findings.

3.3. Preliminary Matched-Budget Comparison with a Cross-Entropy Method

To quantitatively assess the practical efficiency of the Guided Carry-over (GCO) heuristic against an established rare-event simulation technique, a preliminary matched-budget simulation was conducted. The GCO method was compared against a simplified Cross-Entropy (CE) based method, chosen for its adaptive learning capabilities.

3.3.1. Methodology

A fixed computational budget of ${10}^9$ total frame evaluations was allocated to each method. Both methods were tasked with analyzing the same 64-byte CAN FD radar payload structure to identify Undetected Frame Errors (UFEs) for fault depths up to $k=10$.

• Guided Carry-over (GCO) Method: The GCO simulation proceeded exactly as described in this paper, with its initial exhaustive search phase followed by the guided heuristic sampling, terminating when the ${10}^9$ evaluation budget was exhausted.
• Cross-Entropy (CE) Method: The CE implementation used the initial 20% of the budget ($2\times {10}^8$ simulations) for a series of iterative learning phases. In each phase, the algorithm identified fault configurations associated with observed UFE events and updated a probability vector representing the likelihood of flipping each bit in the frame. The remaining 80% of the budget was used for a final, long importance sampling run using the optimized probability distribution derived from the learning phase.

3.3.2. Comparative Results

The performance of the two methods was compared based on their efficiency in discovering UFEs and the stability of their final probability estimate. The key findings are summarized below (Table 3):

Table 3. Matched-Budget Comparison of the Guided Carry-over (GCO) Heuristic and a Cross-Entropy (CE) Method.

Metric	Guided Carry-Over (GCO)	Cross-Entropy (CE) Method
Simulations to First UFE	$~1.5\times {10}^5$ (during exhaustive search)	$~3.5\times {10}^8$ (after learning phase)
Total Unique UFEs Found	4128	2951
Relative Estimator Variance	Higher	Lower

UFE Discovery Rate: The GCO method showed higher efficiency for the specific vulnerability-discovery objective evaluated in this study. It identified its first UFE-producing configuration very early, during its low-order exhaustive search phase. Because its heuristic is immediately guided by these initial findings, it continued to discover new UFEs efficiently throughout its run. In contrast, the CE method required its full learning budget to converge on an effective sampling distribution and only began discovering UFEs during its final, long sampling run. Within the fixed budget, the GCO method found approximately 40% more unique UFE configurations than the CE method.

Computational Cost and Efficiency: While both methods operated under the same total computational budget, their efficiency profiles differed. Under the evaluated configuration, the GCO method showed higher efficiency for the specific vulnerability-discovery objective, as it began identifying failure cases earlier within the available computational budget. The CE method’s computational cost is front-loaded in its learning phase, which is inefficient for discovery but necessary for its primary goal of optimizing a statistically robust probability estimate.

Estimator Variance: The CE method, once converged, produced a final UFE probability estimate with a lower observed statistical variance than the GCO method under the evaluated configuration. This behavior is consistent with the objective of adaptive importance-sampling optimization used by the CE approach. The GCO heuristic, while more effective at finding failures, is not explicitly optimized for this statistical property.

In conclusion, the matched-budget comparison demonstrates that the two approaches optimize different objectives under the evaluated conditions. The Guided Carry-over heuristic provided earlier discovery of UFE-producing configurations, while the Cross-Entropy-based approach achieved a lower observed estimator variance after its learning phase. Therefore, the suitability of each method depends on whether the primary objective is targeted vulnerability discovery or variance reduction in rare-event probability estimation. A broader comparison across additional rare-event simulation methods and configurations is required before drawing more general conclusions.

4. Discussion

4.1. Comparison with Alternative Rare-Event Simulation Methods

The Guided Carry-over heuristic presented in this paper is a specialized importance sampling strategy tailored to the characteristics of CAN FD communication. While the proposed method was initially evaluated against unguided uniform sampling, the revised manuscript additionally includes a preliminary matched-budget comparison with a simplified Cross-Entropy (CE)-based method. This comparison provides an initial assessment of the relative behavior of the methods under equivalent computational conditions.

A broader benchmark including additional rare-event simulation techniques, such as Subset Simulation (SS) and Sequential Monte Carlo (SMC), remains outside the scope of the present work and represents a possible direction for future investigation.

The Cross-Entropy (CE) method is an adaptive importance sampling algorithm that iteratively refines the sampling distribution to minimize the “distance” (or cross-entropy) between the biased proposal distribution and the optimal importance-sampling distribution. In the context of this study, a CE-based approach would learn the optimal probability for flipping each bit to maximize the chances of generating a UFE. While powerful, the CE method’s effectiveness depends on the chosen parametric family of distributions and can be computationally intensive during the iterative learning phase.

Subset Simulation (SS) tackles the rare-event problem by expressing the target failure probability as a product of larger, conditional probabilities of intermediate events. It works by generating samples that populate progressively “rarer” regions of the state space. For this problem, SS would define a sequence of nested failure regions (e.g., based on the number of corrupted bits that align with a potential masking pattern) and estimate the probability of transitioning from one subset to the next.

The primary strength of the Guided Carry-over heuristic lies in its protocol-specific, computationally lightweight guidance. The “hot-slot” mechanism is designed to directly leverage knowledge of the physical-layer bit-stuffing rules and CRC structures. It does not require complex iterative optimization (as in CE) or the definition of intermediate failure events (as in SS). This makes it highly efficient for a targeted vulnerability search, where the goal is to quickly find if and where failures exist. It excels at exploiting the “memory” of the system, reinforcing the exploration of regions that have already proven to be vulnerable.

However, this targeted approach comes with a trade-off. The heuristic’s reliance on the initial, low-order exhaustive search means that its effectiveness is conditioned on the discovery of at least some UFE-producing configurations in this phase. It is a “greedy” search that deeply explores known vulnerabilities but may be less effective at broad, exploratory searches for entirely new and different failure modes.

In contrast, a method like Subset Simulation offers a more robust exploration of the fault space. Because SS advances by populating nested failure regions, it is less likely to be trapped in a local minimum and may be more capable of discovering multiple, disconnected regions of vulnerability that the Guided Carry-over heuristic might miss. Similarly, the CE method, by optimizing a global distribution, could theoretically identify complex, non-intuitive combinations of bit flips that are not anchored to a single “hot-slot.” The potential drawback of these more general methods is their computational overhead and the challenge of adapting them to the highly specific, non-linear bit-stuffing logic of the CAN FD protocol.

In summary, while established methods like CE and SS provide alternative strategies for exploring rare-event spaces with different assumptions and optimization mechanisms, the Guided Carry-over heuristic provides a practical, domain-specific alternative that leverages the structural properties of the communication protocol under analysis.

4.2. Analysis of Empirical Findings

The empirical results indicate that native data-link layer CRC protection alone may not be sufficient to detect all specific high-order physical-layer corruption patterns within the evaluated frame structures. The observed UFE cases suggest a cross-layer failure mechanism in which bit flips affect both payload-related bits and the dynamic bit-stuffing structure of the physical bitstream. This may lead to receiver-side destuffing shifts and altered frame interpretation. In rare cases, such shifted corrupted bitstreams can still produce a CRC-consistent frame, allowing the message to pass the data-link layer validation despite containing corrupted payload data.

The high-order fault-injection campaigns identified UFE-producing configurations with an increased concentration in the Byte 12–16 region of the evaluated radar payload structures. This observation was reproduced across multiple evaluated BLF-derived message and payload campaigns; however, the localization is specific to the investigated traces, frame structures, fault-depth ranges, and sampling configurations and should not be generalized to CAN FD payloads in general. These results address RQ1 and RQ3 by showing that the proposed Guided Carry-over sampling strategy improves the practical efficiency of rare-event residual error analysis and that undetected frame errors are not uniformly distributed across the evaluated payload structure. Instead, the observed UFE-producing configurations were concentrated in localized, payload-dependent regions that are more susceptible to CRC masking and stuff-bit cascading effects.

Within the evaluated application-layer E2E-protected configurations, no residual errors were observed in the executed test campaigns and sampled fault configurations. This observation indicates that the applied E2E validation detected the residual payload corruptions encountered within the investigated sample space. However, the absence of observed UFE cases should not be interpreted as proof of zero residual error probability or as a universal statement regarding AUTOSAR E2E protection. The result is limited to the tested E2E configuration, payload structures, fault-depth ranges, sampling strategy, and executed sample space.

The identified UFE mechanisms should therefore be interpreted as conditional frame-level communication-integrity phenomena. The present framework evaluates whether a specified corrupted frame can pass receiver-side validation, while dynamic bus utilization, arbitration, retransmission behavior, gateway forwarding, and CAN error-state evolution affect fault exposure and system-level propagation. Consequently, the reported results should not be interpreted as network-level UFE occurrence rates. Extending the analysis toward such system-level metrics requires integration with dynamic network simulation or hardware-in-the-loop environments. In addition, the reported UFE occurrence densities are conditional on the discrete multi-bit fault model used in the present experiments. The supplementary burst-oriented evaluation indicates that structured correlated fault patterns can also produce residual-error behavior within the evaluated configuration. However, the applied burst model represents a simplified synthetic sensitivity model rather than a measurement-calibrated physical disturbance distribution. Therefore, the reported results remain conditional on the evaluated fault-pattern assumptions.

5. Conclusions

This paper presented a GPU-accelerated residual error analysis framework for Classical CAN and CAN FD communication under high-order physical-layer fault conditions. The study focused on rare multi-bit corruption patterns that may pass receiver-side destuffing, protocol-level CRC validation, and normal message filtering, while still resulting in corrupted reconstructed payload data. To address the computational complexity of this problem, the proposed method combines rare-event importance sampling with a Guided Carry-over heuristic mechanism and OpenCL-based data-parallel execution.

The results show that the proposed framework can substantially improve the practical feasibility of residual error analysis. The GPU implementation achieved an approximately 28-fold throughput improvement compared to the single-threaded CPU reference implementation, increasing the processing rate from approximately $1.5\times {10}^5$ to $4.2\times {10}^6$ iterations per second under the evaluated conditions. This directly addresses the computational challenge formulated in RQ1 and RQ4, since large-scale high-order fault-injection campaigns become significantly more practical within realistic engineering timeframes.

The Guided Carry-over mechanism also demonstrated practical value for rare-event discovery. By reusing bit positions that previously appeared in undetected error configurations, the sampling process could concentrate computational effort on empirically vulnerable regions of the physical bitstream. This addresses RQ2 by showing that previously observed UFE-producing configurations can be used to guide subsequent high-order fault-injection campaigns toward more relevant candidate regions.

A preliminary matched-budget comparison with a Cross-Entropy-based rare-event simulation approach showed that the two methods provide different advantages under the evaluated conditions. The Guided Carry-over heuristic enabled earlier discovery of UFE-producing configurations, while the Cross-Entropy-based approach achieved a lower observed estimator variance after its learning phase. These results indicate that the suitability of each approach depends on whether the primary objective is targeted vulnerability discovery or variance reduction in rare-event probability estimation.

The empirical results further indicate that, within the evaluated radar-derived CAN FD configurations, UFE-producing samples were not uniformly distributed across the investigated payload structures. An increased concentration was observed in the Byte 12–16 region across multiple evaluated BLF-derived message and payload campaigns. This finding addresses RQ3 for the tested configurations and indicates that residual-error behavior can depend strongly on payload layout, bitstream structure, and the interaction between bit-stuffing and CRC validation. The identified Byte 12–16 region should therefore be interpreted as configuration-specific and not as a generally vulnerable byte range of CAN FD messages.

The analysis also showed that native data-link layer CRC protection may be bypassed under specific high-order physical-layer corruption patterns involving stuff-bit cascading and CRC masking effects. However, this conclusion is limited to the evaluated frame structures, fault-depth ranges, and sampling configurations. It should not be interpreted as a general statement that CAN FD CRC mechanisms are insufficient in all cases. Rather, the results demonstrate that specific payload-dependent residual error vulnerabilities may exist and should be considered during safety-oriented communication analysis.

For the evaluated application-layer AUTOSAR End-to-End protected configurations, no residual errors were observed within the executed test campaigns and sampled fault configurations. This indicates that the applied E2E validation detected the residual payload corruptions encountered within the investigated sample space. However, this observation should not be interpreted as proof of zero residual error probability or as a universal statement regarding AUTOSAR E2E protection. The result is limited to the tested E2E configuration, payload structures, fault-depth ranges, sampling strategy, and executed sample space. A complete and reproducible safety argument would additionally require precise documentation of the applied E2E profile, polynomial configuration, Data ID handling, rolling-counter configuration, and field placement.

From an industrial perspective, the proposed framework can support Tier-1 suppliers, hardware-in-the-loop test engineers, and OEM functional safety teams by providing a targeted method for residual error exploration. The identified hot-slot regions can be used for deterministic stress testing, payload layout assessment, and communication safety argumentation. In early architecture design, the results may also support the placement of safety-relevant signals away from payload regions that show increased susceptibility under the evaluated fault model.

The main limitation of the current study is that the analysis was performed on selected, pre-recorded radar sensor BLF traces and static payload structures. A further methodological limitation arises from the dependence of the Guided Carry-over strategy on the low-order vulnerability-mapping stage. Vulnerable regions that are not activated or sufficiently sampled during this initial stage may receive less attention in subsequent guided layers, and the present method therefore does not provide a formal completeness guarantee for the explored fault space. The current fault-injection framework primarily evaluates discrete multi-bit inversion patterns, complemented by a preliminary burst-oriented sensitivity analysis. These additional results extend the evaluated fault-pattern space; however, they do not represent measurement-calibrated EMI disturbance models or transceiver-specific physical-layer behavior. Therefore, the reported residual-error characteristics remain conditional on the evaluated fault-pattern model. The present study includes a preliminary matched-budget comparison with a Cross-Entropy-based rare-event simulation method. However, this comparison is limited to the evaluated configuration and does not establish general superiority of the Guided Carry-over strategy regarding estimator bias, variance, or statistical efficiency relative to all alternative rare-event simulation methods. The present study focuses on conditional frame-level residual-error behavior and therefore does not estimate complete network-level failure rates. Dynamic bus-load variations, variable message periods, arbitration and timing interactions, gateway forwarding, multi-frame dependencies, CAN error-state evolution, retransmission behavior, and closed-loop vehicle-level consequences represent additional system-level effects that should be considered when translating frame-level residual-error characteristics into vehicle-level safety metrics.

Future work will focus on extending the static, per-frame analysis into a dynamic, network-level context to formally evaluate the system-level consequences of residual communication errors. A key step will be the integration of the GPU-accelerated fault-injection engine into a co-simulation environment. This can be achieved by coupling the framework with industry-standard network analysis tools such as CANoe or CANalyzer, or by developing a custom co-simulation platform using Python-based simulators. In such an environment, the current framework would act as a high-throughput “fault oracle,” injecting UFE-producing bit patterns into a live, simulated bus.

This approach will enable the investigation of critical system-level metrics that are beyond the scope of the current static analysis. The research will quantify:

• The rate of undetected errors under varying bus loads (e.g., at 20%, 50%, and 80% utilization) to understand how network congestion affects the propagation and system-level impact of corrupted frames.
• The influence of CAN error state transitions, modeling how a node transitioning from error-active to error-passive or bus-off states alters the probability of a UFE being accepted by other nodes on the network.
• The end-to-end delivery probability of corrupted data, tracing a corrupted message from its source through gateways and retransmission attempts to determine the likelihood of it being processed by a critical target ECU.

The present study focuses on conditional frame-level residual-error behavior and therefore does not estimate complete network-level failure rates. Dynamic bus-load variations, variable message periods, arbitration interactions, gateway forwarding, multi-frame dependencies, CAN error-state evolution, and retransmission behavior represent additional system-level effects that should be considered when translating frame-level residual-error probabilities into vehicle-level safety metrics.