2 Why We Need Model-Based Testing

Systems with Finite Models 111
0
Command()
1
Timeout() NoHandler() Command()
22
Timeout()
2
Reset()
3
Command()
4
TimeoutMsgLost() Message("999.9") NoHandler() Command()
TimeoutMsgLate() Message("99.9")
52
TimeoutMsgLost() Message("999.9") TimeoutMsgLate()
Message("99.9")
8
6
5
7
NoHandler()
NoHandler()
19
14
Command()
Command()
20
15
Command() NoHandler() CheckMessage()
Message("999.9") NoHandler() Command() Message("99.9")
CheckMessage()
21
18
Message("999.9") Message("99.9")
16
17
CheckMessage()
CheckMessage()
9
10
Command()
Command()
11
71
Timeout() Command() Calibrate()
Timeout() Command() Calibrate()
13
113
Timeout()
Timeout()
12
72
Poll()
Poll()
23
73
Command()
Command()
Command()
Command()
24
74
TimeoutMsgLost()
TimeoutMsgLate()
NoHandler() Command() TimeoutMsgLost()
Timeout()
TimeoutMsgLost() TimeoutMsgLate()
Timeout() NoHandler() Command() TimeoutMsgLost()
31
120
TimeoutMsgLost()
TimeoutMsgLate() TimeoutMsgLost()
TimeoutMsgLost()
TimeoutMsgLate() TimeoutMsgLost()
25
28
75
78
ReportLostMessage()
Poll()
ReportLostMessage()
ReportLostMessage() Poll()
ReportLostMessage()
30
51
83
98
Command()
CheckMessage()
Command()
CheckMessage()
32
99
Message("99.9")
TimeoutMsgLate() Command() Calibrate()
Calibrate() Command()
Message("999.9") TimeoutMsgLate()
36
103
Message("999.9")
Message("99.9") TimeoutMsgLate()
Message("99.9") NoHandler()
NoHandler()
Message("999.9") TimeoutMsgLate()
Message("99.9")
Message("999.9")
35
33
101
100
NoHandler()
Message("999.9")
Message("99.9")
NoHandler()
Message("99.9")
Message("999.9")
37
104
Timeout()
CheckMessage()
Timeout()
CheckMessage()
39
106
Poll()
Poll()
40
108
Message("99.9")
Command()
Message("999.9")
CheckMessage() Message("99.9")
Message("999.9")
Command()
CheckMessage()
42
109
Message("99.9")
TimeoutMsgLost() TimeoutMsgLate()
NoHandler() Command() TimeoutMsgLost() Message("999.9") Timeout() Command()
Message("99.9")
Message("999.9")
Message("99.9") Message("999.9")
TimeoutMsgLost()
TimeoutMsgLate() Timeout() TimeoutMsgLost()
NoHandler() Command() Message("99.9")
Message("999.9") Command()
50
112
TimeoutMsgLost()
Timeout() TimeoutMsgLate() TimeoutMsgLost()
Message("999.9")
Message("99.9")
TimeoutMsgLost() Timeout()
TimeoutMsgLate() TimeoutMsgLost()
Message("99.9")
Message("999.9")
43
44
26
27
110
111
77
76
ReportLostMessage()
Poll()
ReportLostMessage()
CheckMessage()
ReportLostMessage() Poll()
ReportLostMessage()
CheckMessage()
46
45
29
116
115
79
Command()
Command()
Command()
Command()
Command()
Command()
47
38
53
117
105
80
TimeoutMsgLate()
Calibrate() Command()
Message("999.9")
Command() Calibrate()
Timeout() NoHandler() Command()
Message("99.9") Command() Calibrate() TimeoutMsgLate()
Command() Calibrate()
NoHandler() Command() Timeout()
49
41
55
119
107
114
TimeoutMsgLate()
Message("999.9")
Timeout()
Message("99.9") TimeoutMsgLate()
Timeout()
48
34
54
102
118
81
CheckMessage()
Reset()
CheckMessage()
Reset()
56
82
Command()
Command()
57
84
Message("99.9") TimeoutMsgLate() Command() NoHandler() Message("999.9") TimeoutMsgLost() CheckMessage()
CheckMessage()
Message("999.9") TimeoutMsgLost() Message("99.9") NoHandler() Command() TimeoutMsgLate()
63
90
Message("99.9") TimeoutMsgLate() TimeoutMsgLost() Message("999.9")
Message("999.9") TimeoutMsgLost() Message("99.9") TimeoutMsgLate()
60
58
61
59
86
88
87
85
NoHandler()
NoHandler()
NoHandler()
NoHandler()
62
64
89
93
Command()
Command()
Command()
Command()
67
65
91
94
Message("999.9") NoHandler() Command()
Command() NoHandler() Message("99.9")
NoHandler() Command()
Message("999.9") Message("99.9") NoHandler() Command()
70
66
92
97
Message("999.9")
Message("99.9")
Message("999.9") Message("99.9")
68
69
95
96
Figure 6.12. Reactive system: True FSM showing accepting states and dead states.
links connecting outside (lower left and lower right in Figure 6.12). This indicates
that, depending on the first several actions at startup, the program permanently enters
one or the other of two modes. In one of these modes, all of the states are dead states
(lower left in Figure 6.12). Inspecting the FSM closely (magnifying and scrolling
in mpv) reveals that the program enters this mode when the first temperature sample
is out-of-range. After that the program cannot escape. This is the same behavior we
observed in the InitialOutOfRangeMessage run we found by experimenting with the
implementation, where an out-of-range temperature sample at startup is followed by
a livelock where the program resets endlessly without making progress (Chapter 3,
Section 3.4). Exploring interactively, we reproduce the InitialOutOfRangeMessage
run (Figure 6.13). The cycle including the Reset action appears in the lower right
of the diagram. Exploration finds that all of states on the frontier at lower left in
this diagram are also dead states. They offer no escape; they only lead to longer
cycles.
more free ebooks download links at:
http://www.ebook-x.com