2 Why We Need Model-Based Testing

5.7.2 Code
Systems with Finite Models 85
The model program has two data state variables, which also appear in the implementation:
buffer and previous, the most recent temperature sample and the
preceding temperature sample. These are numbers, so they could generate an “infinite”
state space. To finitize our model, we limit both variables to just two values
that represent temperatures that are within-range and out-of-range (by the criteria
explained in Chapter 3, Section 3.6: the out-of-range value differs too much from
the in-range value).
The reactive system model program appears in Figures 5.12–5.18. Compare this to
the implementation code in Chapter 3, Figures 3.2–3.4. The model program includes
code that models the environment (timer, sensor, and supervisor), which does not
correspond to any code in the implementation Controller class. The following
paragraphs explain some features that might not be obvious.
Both data state variables represent numbers, but buffer is a string and previous
is a double. The conversion is performed by the CheckMessage action method.
The particular values of the two temperature values InRange and OutOfRange do
not matter, but they must differ by more than tol in CheckMessage.
There are two kinds of action methods in the model program. The action
methods that handle events appear first. They also appear in the implementation.
The other action methods raise events. They do not appear in the implementation.
The two kinds of actions alternate, using the phase control state variable.
The events are enabled when phase == Phase.WaitForEvent and assign phase =
Phase.HandleEvent. The handlers are enabled when phase == Phase.HandleEvent
and assign phase = Phase.WaitForEvent.
There must be a dummy handler NoHandler to model what happens in the implementation
when no handler is enabled. This handler’s enabling condition NoHandlerEnabled
returns true in states where every other handler’s enabling condition
returns false. The handler itself does nothing but assigns phase.
The two control state variables TimeoutScheduled and MessageRequested, which
do not appear in the implementation, model the timer and the sensor. TimeoutScheduled
is in the enabling condition for every time-out event and MessageRequested is
in the enabling condition for the message event.
There is only one Timeout event in the implementation, but there are three timeout
event action methods in the model. Timeout models a time-out that arrives
when the controller is not waiting for a message; !MessageRequested appears in
its enabling condition. TimeoutMsgLost, and TimeoutMsgLate model time-outs that
arrive when a message is expected; MessageRequested appears in their enabling
conditions. TimeoutMsgLost models what happens in the implementation when the
message is lost; it assigns MessageRequested = false so the message will never be
more free ebooks download links at:
http://www.ebook-x.com