2 Why We Need Model-Based Testing

108 Exploring and Analyzing Finite Model Programs
TimeoutMsgLate()
Message("99.9")
CheckMessage()
Message("99.9")
TimeoutMsgLost()
TimeoutMsgLate()
TimeoutMsgLost()
43
ReportLostMessage() Poll()
46
Command()
47
Calibrate() Command()
49
TimeoutMsgLate()
Message("999.9")
48
0
Command()
1
Timeout() NoHandler() Command()
22
Timeout()
2
Reset()
3
Command()
4
Message("999.9") NoHandler() Command() TimeoutMsgLost() TimeoutMsgLate() Message("99.9")
52
Message("999.9")TimeoutMsgLost() TimeoutMsgLate() Message("99.9")
6
8
5
7
NoHandler()
NoHandler()
19
14
Command()
Command()
20
15
CheckMessage()
NoHandler() Command()
Message("999.9") NoHandler() Command() Message("99.9")
CheckMessage()
21
18
Message("999.9") Message("99.9")
16
17
CheckMessage()
CheckMessage()
9
10
Command()
Command()
11
71
Timeout() Command() Calibrate()
Timeout() Command() Calibrate()
13
113
Timeout()
Timeout()
12
72
Poll()
Poll()
23
73
Command()
Command()
Command()
Command()
24
74
TimeoutMsgLost()
TimeoutMsgLate() NoHandler() Command() TimeoutMsgLost()
Timeout()
TimeoutMsgLost()
TimeoutMsgLate()
NoHandler() Command()
TimeoutMsgLost() Timeout()
31
120
TimeoutMsgLost()
TimeoutMsgLate() TimeoutMsgLost()
TimeoutMsgLost()
TimeoutMsgLate() TimeoutMsgLost()
25
28
75
78
Poll()
ReportLostMessage()
ReportLostMessage()
Poll()
ReportLostMessage()
ReportLostMessage()
30
51
83
98
Command()
Command()
32
99
Message("99.9") TimeoutMsgLate() Calibrate() Command()
TimeoutMsgLate() Calibrate() Command() Message("999.9")
CheckMessage()
36
103
Message("999.9")
Message("99.9") TimeoutMsgLate()
Message("99.9")
NoHandler()
TimeoutMsgLate() Message("999.9")
35
33
100
101
NoHandler()
Message("999.9") Message("99.9")
NoHandler()
NoHandler()
Message("99.9")
Message("999.9")
37
104
Timeout()
CheckMessage()
Command()
Message("99.9") Message("999.9")
39
105
Poll()
Command() Calibrate() Timeout()
CheckMessage()
40
107
Command()
Message("999.9")
CheckMessage()
Timeout()
42
106
Message("999.9")
NoHandler() Command()
TimeoutMsgLost() Timeout() Message("99.9") Command() Message("999.9")
Message("99.9")
Message("999.9")
Poll()
CheckMessage()
50
108
TimeoutMsgLate() Message("999.9") Timeout() TimeoutMsgLost()
Message("99.9")
Message("99.9") Message("999.9") Command()
Command()
26
44
27
109
ReportLostMessage()
CheckMessage()
Timeout() TimeoutMsgLost()
TimeoutMsgLost() TimeoutMsgLate() Command() NoHandler()
Message("99.9")
Message("999.9")
45
29
112
Command()
Command()
TimeoutMsgLost() TimeoutMsgLate() TimeoutMsgLost()
Message("99.9")
Message("999.9")
38
53
111
110
77
76
Message("999.9")
Calibrate() Command()
Command() NoHandler() Timeout()
ReportLostMessage() ReportLostMessage()
Poll()
CheckMessage()
41
55
115
116
79
Timeout()
Command()
Command()
34
54
117
80
Reset()
CheckMessage()
Message("99.9")
Command() Calibrate()
TimeoutMsgLate()
Command() NoHandler() Timeout()
56
119
114
Command()
Message("99.9")
TimeoutMsgLate()
Timeout()
57
102
118
81
CheckMessage()
TimeoutMsgLost() TimeoutMsgLate() Command() NoHandler() Message("99.9") Message("999.9")
CheckMessage()
Reset()
63
82
TimeoutMsgLost() TimeoutMsgLate() Message("99.9")
Message("999.9")
Command()
61
58
60
59
84
NoHandler()
NoHandler()
CheckMessage()
Message("999.9") Command() NoHandler() TimeoutMsgLate() Message("99.9") TimeoutMsgLost()
64
62
90
Command()
Command()
Message("999.9") TimeoutMsgLate() Message("99.9") TimeoutMsgLost()
65
67
86
85
87
88
NoHandler() Command()
Message("99.9") Message("999.9") NoHandler() Command()
NoHandler()
NoHandler()
66
70
93
89
Message("99.9") Message("999.9")
Command()
Command()
69
68
94
91
Message("999.9") Message("99.9") NoHandler() Command()
NoHandler() Command()
97
92
Message("999.9") Message("99.9")
95
96
Figure 6.9. Reactive system: true FSM showing unsafe states.
This example confirms that model-based analysis reveals one of the design errors
we originally discovered by executing the implementation.
6.3.2 Liveness
Liveness analysis checks whether something good will happen. It searches for dead
states from which goals cannot be reached. We express liveness requirements by
identifying accepting states, where goals have been reached. We define accepting
states by writing an accepting state condition, a Boolean expression that is supposed
to be true in every accepting state. A dead state is a state from which an accepting
state cannot be reached. For the tools, an accepting state condition is a Boolean
field, property, or method labeled with the [AcceptingStateCondition] attribute.
more free ebooks download links at:
http://www.ebook-x.com