2 Why We Need Model-Based Testing

48 Why We Need Model-Based Analysis
TimeoutMsgLate()
Message("99.9")
CheckMessage()
Message("99.9")
TimeoutMsgLost()
TimeoutMsgLate()
TimeoutMsgLost()
43
ReportLostMessage() Poll()
46
Command()
47
Calibrate() Command()
49
TimeoutMsgLate()
Message("999.9")
48
0
Command()
1
Timeout() NoHandler() Command()
22
Timeout()
2
Reset()
3
Command()
4
Message("999.9") NoHandler() Command() TimeoutMsgLost() TimeoutMsgLate() Message("99.9")
52
Message("999.9")TimeoutMsgLost() TimeoutMsgLate() Message("99.9")
6
8
5
7
NoHandler()
NoHandler()
19
14
Command()
Command()
20
15
CheckMessage()
NoHandler() Command()
Message("999.9") NoHandler() Command() Message("99.9")
CheckMessage()
21
18
Message("999.9") Message("99.9")
16
17
CheckMessage()
CheckMessage()
9
10
Command()
Command()
11
71
Timeout() Command() Calibrate()
Timeout() Command() Calibrate()
13
113
Timeout()
Timeout()
12
72
Poll()
Poll()
23
73
Command()
Command()
Command()
Command()
24
74
TimeoutMsgLost()
TimeoutMsgLate() NoHandler() Command() TimeoutMsgLost()
Timeout()
TimeoutMsgLost()
TimeoutMsgLate()
NoHandler() Command()
TimeoutMsgLost() Timeout()
31
120
TimeoutMsgLost()
TimeoutMsgLate() TimeoutMsgLost()
TimeoutMsgLost()
TimeoutMsgLate() TimeoutMsgLost()
25
28
75
78
Poll()
ReportLostMessage()
ReportLostMessage()
Poll()
ReportLostMessage()
ReportLostMessage()
30
51
83
98
Command()
Command()
32
99
Message("99.9") TimeoutMsgLate() Calibrate() Command()
TimeoutMsgLate() Calibrate() Command() Message("999.9")
CheckMessage()
36
103
Message("999.9")
Message("99.9") TimeoutMsgLate()
Message("99.9")
NoHandler()
TimeoutMsgLate() Message("999.9")
35
33
100
101
NoHandler()
Message("999.9") Message("99.9")
NoHandler()
NoHandler()
Message("99.9")
Message("999.9")
37
104
Timeout()
CheckMessage()
Command()
Message("99.9") Message("999.9")
39
105
Poll()
Command() Calibrate() Timeout()
CheckMessage()
40
107
Command()
Message("999.9")
CheckMessage()
Timeout()
42
106
Message("999.9")
NoHandler() Command()
TimeoutMsgLost() Timeout() Message("99.9") Command() Message("999.9")
Message("99.9")
Message("999.9")
Poll()
CheckMessage()
50
108
TimeoutMsgLate() Message("999.9") Timeout() TimeoutMsgLost()
Message("99.9")
Message("99.9") Message("999.9") Command()
Command()
26
44
27
109
ReportLostMessage()
CheckMessage()
Timeout() TimeoutMsgLost()
TimeoutMsgLost() TimeoutMsgLate() Command() NoHandler()
Message("99.9")
Message("999.9")
45
29
112
Command()
Command()
TimeoutMsgLost() TimeoutMsgLate() TimeoutMsgLost()
Message("99.9")
Message("999.9")
38
53
111
110
77
76
Message("999.9")
Calibrate() Command()
Command() NoHandler() Timeout()
ReportLostMessage() ReportLostMessage()
Poll()
CheckMessage()
41
55
115
116
79
Timeout()
Command()
Command()
34
54
117
80
Reset()
CheckMessage()
Message("99.9")
Command() Calibrate()
TimeoutMsgLate()
Command() NoHandler() Timeout()
56
119
114
Command()
Message("99.9")
TimeoutMsgLate()
Timeout()
57
102
118
81
CheckMessage()
TimeoutMsgLost() TimeoutMsgLate() Command() NoHandler() Message("99.9") Message("999.9")
CheckMessage()
Reset()
63
82
TimeoutMsgLost() TimeoutMsgLate() Message("99.9")
Message("999.9")
Command()
61
58
60
59
84
NoHandler()
NoHandler()
CheckMessage()
Message("999.9") Command() NoHandler() TimeoutMsgLate() Message("99.9") TimeoutMsgLost()
64
62
90
Command()
Command()
Message("999.9") TimeoutMsgLate() Message("99.9") TimeoutMsgLost()
65
67
86
85
87
88
NoHandler() Command()
Message("99.9") Message("999.9") NoHandler() Command()
NoHandler()
NoHandler()
66
70
93
89
Message("99.9") Message("999.9")
Command()
Command()
69
68
94
91
Message("999.9") Message("99.9") NoHandler() Command()
NoHandler() Command()
97
92
Message("999.9") Message("99.9")
95
96
Figure 3.8. Controller FSM showing unsafe states.
Figure 3.8 shows the entire FSM of our model program. Figures 3.9–3.11 display
portions of the FSM that show paths to interesting states. Each path through the
FSM is a possible run of the system. The FSM represents all possible runs of this
system. There are 121 states and 239 transitions between states. The model program
has to have some additional methods and variables (which do not appear in the
implementation) that represent the environment where the controller runs, including
the timer and sensor. Therefore, the actions in the diagrams include some that do not
appear in the controller implementation. For example, our implementation’s Timeout
event must be represented here by Timeout, TimeoutMsgLate, and TimeoutMsgLost.
We also need a NoHandler action here to represent what happens when no handler
is enabled.
For safety analysis, the mpv tool searches for unsafe states where the controller
attempts to calculate the calibration factor when the temperature sample is
more free ebooks download links at:
http://www.ebook-x.com