SEKE 2012 Proceedings - Knowledge Systems Institute

condition of a transitio n is a logical form ula built from
arithmetic or relational operations. A transition m ay be
associated with a list of variables as its form al parameters. A
marking is a set of tokens distri buted in all places. A token is a
tuple of constants. W e represent t oken in p as
p(V 1 , …, V n ). No-argument token ( , or little solid circle or
dot in traditional Petri nets) in p is simply denoted as p. Figure
1 shows an example, where initial marking is {p 1 (0), p 4 (0)}.
pstop [x>=5]
x
p 1
x
produce[x<
5, y=x+1]
y y
y
put
p 2
z
y
p 3
Figure 1. A test model for producer/consumer
z
cstop [x>=5]
x
x
get[xM 1 [t 2 θ 2 >M 2 …[t n θ n >M n , or sim ply t 1 θ 1 t 2 θ 2 …t n θ n ,
where firing transition t i with substitution θ i (1≤i≤n) under M i-1
leads to M i (1≤i≤n). A marking M is said to be reachable from
M 0 if there is such a firing sequence that leads to M from M 0 .
A function net captures system behaviors through state
transitions from a given initial state (m arking). An initial
marking determines the entry point (s), i.e., w hat transitions
can be fired at the initial state. We also allow a function net to
have one or more “ sink” transitions, sim ilar to term ination
states or exi t points in other models such as finite state
machines and activity diagrams. The behaviors of a function
net can be interpreted by its reachability tree (graph). To
facilitate test generation from different data sets, our approach
allows a function net to be a ssociated with multiple initial
markings. Therefore, the root of a reachability tree represents
p 4
p 5
y,z
y
a dummy state, whose child nodes are built from the given
initial markings. The construction of a reachability tree starts
with expanding each initial marking node. Each node is
expanded as follows: (1) find all possible firings t i θ j under the
marking of the current node under expansion; (2) for each
firing t i θ j , create a new child node according to the new
marking. The edge from the current node to the new child is
labeled with t i θ j . (3) if t i is not a sink transition and the new
marking has not yet expanded in the sub -tree of the same
initial marking, then expand the new child node.
In MISTA, partial ordering of concurrent (or independent
firings) and pairwise combina tion of input values are two
techniques for reducing the com plexity of reachability tree.
When the partial ordering of concurrent firings is used, step (2)
only selects one firing from a se t of concurrent firings. W hen
pairwise combination is used , all pairs (rather than all
combinations) of input values are used to derive firings in step
(1). We use a region to represent a collection of events in the
same thread (or process) of a concurrent system. For example,
region (consumer)={get , consume, cstop}. Building the
reachability tree for a region uses the transitions listed in the
given region.
B. Function Nets as Test Models
Function nets can represent various building blocks of
software models, such as sequence, condition (choice),
repetition (loop), concurrency, synchronization and m utual
exclusion, structured data, arithmetic and relational operations,
and modularization (hierarchy). These building blocks can be
used to compose complex test models of concurrent programs.
Consider bounded buffer as an exam ple. A bounded buffer is
shared by different producer and consumer threads. A producer
thread puts data into the shared buffer, whe reas a consumer
thread gets data from the shared buffer. To function correctly,
the implementation of bounded buffer must synchronize the
concurrent “put” and “ get” actions from different threads.
Figure 1 shows a test model of bounded buffer, where a
producer produces and puts five items to the buffer and
consumer gets and consumes five items from the buffer. The
producer is not intended to put any item to the buffer if the
buffer is not empty. The consumer is not intended to get an
item from the buffer unless the buffer has an item . The
“produce” and “ put” actions in the producer thread are
sequential; the “ get” and “ consume” actions in the consumer
thread are sequential. They are represented by two sequential
structures. They are included in the two loo p structures,
respectively. “put” has two postconditions: updating the loop
control value and depositing the produced item into the buffer
(place p 3 ). Producer and consumer have concurrent actions
(e.g., produce and consume). They are synchronized because of
the shared buffer.
Although building a test m odel depends on what needs to
be tested against a specific sy stem under test (SUT), there are
two different perspectives: whitebox and blackbox. A white
test model is similar to the design m odel of a SU T – what is
described in the model is suppos ed to be implemented by the
SUT. For example, Figure 1 w ould be a whitebox test model
for the producer/consumer program if a SUT has im plemented
the producer and consumer threads and these threads are the
a
347