2 Why We Need Model-Based Testing

244 Compositional Modeling
It is clearly also a trace of M2. It is also a trace of SetupC because it is an instance
of the trace
ReqSetup()
ResSetup(_,_,STATUS("Completed"))
ReqWork()
Cancel()
ResWork()
14.3.2 Crosscutting
It is often easier to write separate model programs for different features and to
use the product construction to create the product rather than creating the product
directly. When creating the product directly, one has to take into account all the
possible combinations of the state variables from the different features. Moreover,
the full model program can be developed incrementally by adding more feature
model programs without having to change the existing ones.
Another advantage of creating separate model programs is that it helps to separate
crosscutting concerns by using distinct state variables and in this way simplifies
compositional reasoning. Imagine, for example, a model program with a single
feature that includes all the features of SP. When doing so, it is natural to introduce
a single state variable that maps request IDs to compound “request info” values. A
request info describes the relevant information about a pending request in a given
state, namely the command associated with it, the mode of the request, and the
number of requested credits. Separate analysis of the features now requires fairly
sophisticated analysis techniques because the state information about the different
features is stored in a shared state variable.
14.3.3 Trace inclusion
For scenario control, it is sometimes useful to refer to the state variables of a feature
of a model program in order to write a scenario for it. In other words, there is a given
model program M with a feature F1 that is the contract and there is a dependent
feature F2 of M that may read the state variables of F1 but it may not change the
values of those variables. A property that is preserved in this case is that the set of
traces of M[F1]isasuperset of the set of traces of M[F1,F2]. Such use of features
is usually safe because no new traces can arise.
Two typical uses of dependent features for scenario control are state-dependent
parameter generation and enabling condition strengthening. Both uses were illustrated
earlier in this chapter with the CreditScenario scenario in Figure 14.16.
more free ebooks download links at:
http://www.ebook-x.com