2 Why We Need Model-Based Testing

Systems with Finite Models 107
[StateInvariant]
public static bool CalibrateInRange()
{
return (!CalibrateEnabled()
|| buffer == InRange);
}
Figure 6.8. Reactive system: state invariant for safety analysis.
safety analysis requires that we identify states. We resolve this by describing the
states where the action is enabled, instead of the action itself. In the unsafe states, the
calibration action is enabled but the temperature is invalid. This Boolean expression
is true in the unsafe states:
CalibrateEnabled() && buffer != InRange // unsafe states
It is often easier to describe the unsafe states first, as we did here. Negate the
expression for unsafe states to obtain the safety condition. 4
!CalibrateEnabled() || buffer == InRange // safety condition
We wrap this expression in a static method, label it with the [StateInvariant]
attribute, and place it in the Controller class in the Reactive model program
namespace (Figure 6.8).
Now that we have defined the state invariant, exploration can find all of the unsafe
states in the generated FSM. We command the mpv tool to explore the reactive system
model program, and to count and display unsafe states:
mpv /r:Controller.dll Reactive.Factory.Create /safetyCheckIsOn+ ...
Figure 6.9 shows the generated FSM. We had to increase MaxTransitions to 300
to generate the true FSM. The mpv tool finds 239 transitions and 121 states, including
4 unsafe states. The unsafe states are marked but they are hard to find in Figure 6.9.
They are easier to find in the mpv session, where we can magnify and scroll the
graph.
To check that the unsafe states found by exploration include the one we expect,
we explore interactively. We reproduce the OutOfRangeMessageWhenIdle run we
found by experimenting with the implementation (Chapter 3, Section 3.4). The
FSM we generate shows a path to one of the unsafe states (Figure 6.10). This FSM
contains the second trace we wrote in Chapter 5, Section 5.7.1. The unsafe state is
the state labeled 105 near the bottom of the diagram, where Calibrate is enabled.
4 Here we apply De Morgan’s Law, which shows how to negate expressions involving and and
or: !(p && q) == !p || !q.
more free ebooks download links at:
http://www.ebook-x.com