2 Why We Need Model-Based Testing

232 Compositional Modeling
and it is not considered as part of the credits feature; that is, a Cancel request cannot
be used by the client to get more credits. The model program of the cancellation
feature is shown in Figure 14.7.
State variables
The cancellation model program has one state variable mode whose value is a map of
pending request IDs that records for each entry whether it has been sent or cancelled
by the client. Initially no request has been either sent or cancelled, so the value of
mode is the empty map.
Actions
The action vocabulary of the cancellation model program contains all of the action
symbols listed above. The credits field is ignored in all actions.
The update rule of a Setup or a Work request updates the mode of that request ID
to indicate that the request has been sent to the server. The enabling condition is that
a request with the same ID is not pending.
A Cancel request is enabled for all requests. This is needed to avoid race conditions
between the client and the server. A Cancel request must have no effect on the
behavior of the server unless the request being cancelled has actually been sent to
the server and is not yet cancelled or completed.
The update rule of a response action removes the pending request. A response
action has a status field as the third argument. The value of the status field indicates
whether the requested operation was cancelled or completed by the server. If the
status of a response is Cancelled, it must be the case that cancellation of the
corresponding request was sent by the client. Notice that the client may try to cancel
a request but the cancellation arrives too late to the server who has already completed
the request. Therefore, the status of a response to a request that has been cancelled
by the client may be either Cancelled or Completed.
Exploration
Let us look at a particular scenario of the cancellation model program. First note
that the model program behaves uniformly for all message IDs and there are no
interactions or dependencies between actions with distinct message IDs. It is therefore
enough to fix a single message ID, say 2. A convenient way to do so is to use
the FSM scenario shown in Figure 14.8. Notice that the scenario disables all the
work actions by including them in the vocabulary of the FSM. The composition
of the scenario in Figure 14.8 with the cancellation model program is shown in
Figure 14.9.
For visual inspection and validation it is important to choose a small set of
parameters. For example, if we add another message ID 3 into the scenario in
Figure 14.8, that is, we consider the FSM in Figure 14.10 and compose it with
more free ebooks download links at:
http://www.ebook-x.com