2 Why We Need Model-Based Testing

Timer
Temperature
sensor
Overview 33
StartTimer,
CancelTimer
✛
✲
?Timeout
✛
?Message
Reset,
Poll
✲
Figure 3.1. Process controller, a reactive system.
Controller
✛
?Command,
?Exit
Supervisor
systems are called event-driven systems. Reactive systems include embedded control
systems, operating systems, and most user interfaces. Reactive systems contrast
with closed systems, where all actions are controllable.
The supervisor program, acting on its own schedule, frequently commands the
control program to compute the calibration factor. The control program responds by
computing the calibration with the most recently obtained temperature sample. The
arrival of a calibrate command is another observable action. The control program
cannot predict which observable action will occur next, or when it will occur.
Observable actions are nondeterministic.
The control program schedules each polling action by starting a timer (a controllable
action); when the timer times out (an observable action), the program polls the
sensor (controllable) and begins waiting for a message. When the message arrives
(observable), the program starts the timer again and the cycle begins over. The interval
that the timer waits before timing out determines the approximate frequency
at which polling occurs. It is not required that polling be exactly periodic.
The control program should continue working despite occasional faulty behavior
by the sensor. It is possible that the sensor may not respond when polled. In order to
prevent waiting indefinitely for an unresponsive sensor, each time the program polls,
it starts the timer again (a controllable action). After some time, either a message
arrives (an observable action) or the timer times out (another observable action); this
is another example of nondeterminism. If the time-out occurs, the control program
commands the sensor to reset, which may clear the problem. If it does, the sensor
sends back a message with a temperature sample.
It is possible that a faulty sensor may report an incorrect temperature. The control
program attempts to detect this. The temperature may vary over a wide range, so
a simple check that the temperature lies within this range would not be sound; an
incorrect temperature might be accepted. Instead, we rely on the fact that the temperature
in this system cannot change too rapidly. We require that each temperature
sample be close to the previous sample. If a sample differs from the previous sample
more free ebooks download links at:
http://www.ebook-x.com