2 Why We Need Model-Based Testing

136 Structuring Model Programs with Features and Composition
Figure 7.18; it includes all the transitions of the scenario. This indicates that the
contract model program can execute the scenario; there are some unsafe runs. The
projection of the product onto the contract model program appears in Figure 7.19
(the product itself is similar but includes some distracting complications). Many runs
described by the scenario machine appear in the projection, including the unsafe
run shown in Figure 6.10 in Chapter 6. (We can confirm this by magnifying and
inspecting the graph, or by exploring it interactively.)
It is important to understand that here we did not have to identify any unsafe
states in order to perform this analysis; we only had to write the scenario. Moreover,
we did not have to describe any paths completely in our scenario, we only had to
identify what is common to the unsafe runs: a few actions and their ordering.
This analysis takes a somewhat different view of safety than does the analysis of
Chapter 6. Here, a run is unsafe if it includes the actions of our scenario (in that order);
in Chapter 6, a run is unsafe if it reaches an unsafe state (that violates an invariant
defined by a Boolean expression). To compare the two analyses, in Figure 7.19,we
have highlighted the states that are unsafe according to the analysis in Chapter 6.
Two of the four unsafe states identified in Chapter 6 appear in the projection
here. These two states are highlighted in the right lobe of the FSM of the contract
model program (Figure 6.9 in Chapter 6). Notice how a portion of that contract
FSM appears here in the projected FSM. The left lobe of the contract FSM does
not appear in the projection because in all the paths to that lobe, the out-of-range
message reporting temperature 999.9 precedes any in-range message reporting 99.9
(see Figure 6.12 in Chapter 6 and the accompanying discussion). Therefore, those
paths do not match our scenario and are excluded from the product. Two of the unsafe
states appear in that lobe, so they are not reachable by the scenario we specified.
The two analyses produce results that are similar but not identical. For the temporal
analysis we performed here, we chose a scenario that is a bit more selective
(considers fewer runs to be unsafe) than the state-based analysis we performed in
Chapter 6.
7.6 Exercises
1. We say we want to keep contract model programs free of limitations intended
to reduce the number of runs. Is the client/server model program in Chapter 5
entirely free of such limitations? If not, show an example of such a limitation.
2. In the example in Section 7.3.1, the true FSM of the product contained all of the
states and actions of the true FSM of each of the programs that were composed.
Is this always true? If not, provide a counterexample.
more free ebooks download links at:
http://www.ebook-x.com