2 Why We Need Model-Based Testing

46 Why We Need Model-Based Analysis
CheckMessage ’99.9’, compare to 999.9, Error
?Timeout, Timeout, Error
Reset
?Message ’100.1’, Message, Error
CheckMessage ’100.1’, compare to 999.9, Error
?Timeout, Timeout, Error
Reset
?Message ’101.5’, Message, Error
CheckMessage ’101.5’, compare to 999.9, Error
?Timeout, Timeout, Error
Reset
?Message ’102.3’, Message, Error
CheckMessage ’102.3’, compare to 999.9, Error
3.5 Design defects
The defects that caused these failures are deeper than the coding defect discussed in
Chapter 2. We consider these to be design errors. Recall that a design describes how
a system is built up from parts and how the parts communicate. Here the controller
is built up from events and handlers that communicate through variables and the
timer. The design is expressed by the guard expressions that test the variables to
determine which handler to run, and the statements in the handlers that assign these
variables and start or cancel the timer. Each failure results from tests or assignments
that do not produce the intended behaviors, when combined with the other tests and
assignments in the program. All the tests and assignments cooperate to produce the
behaviors, and it is necessary to consider them all to understand the failures.
All of the failures shown in Section 3.4 can be understood in this way. The
CommandWhenWaiting run fails because no handler for the Command event is enabled
when the controller is waiting for a message. The OutOfRangeMessageWhenIdle run
fails because no handler for the Message event is enabled when the controller is
waiting for a time-out. The LostMessageWhenIdle run reaches a deadlocks after
a message is lost because no handler for the Timeout event is enabled when the
controller is waiting for a message and the sensor is considered erroneous, and
no preceding handler requested another message or scheduled another time-out.
The InitialOutOfRangeMessage run cycles endlessly because none of the enabled
handlers can make progress by assigning the sensor status to OK.
We designed the controller by considering some typical runs and coding tests
and assignments to make them work. But many more runs are possible than the
ones we considered and tested, so our design is defective. We are getting tired of
experimenting with the simulator. Discovering defects by trial and error provides
more free ebooks download links at:
http://www.ebook-x.com