Lecture Notes in Computer Science 3472

Increment
∆Counter
12 Technology of Test-Case Generation 329
((ctr < 3) ∧ (ctr ′ = ctr +1)∧¬(ctr =3))∨
((ctr < 3) ∧ (ctr ′ = ctr +1)∧¬(ctr ′ =0))∨
(¬(ctr < 3) ∧ (ctr =3)∧ (ctr ′ =0))∨
(¬(ctr ′ = ctr +1)∧ (ctr =3)∧ (ctr ′ =0))∨
((ctr < 3) ∧ (ctr ′ = ctr +1)∧ (ctr =3)∧ (ctr ′ =0))
The predicate part in this schema can be simplified by removing unsatisfiable
disjuncts and unnecessary literals. For instance, the final disjunct is unsatisfiable
because ctr < 3andctr = 3 are contradictory. The remaining four disjuncts can
be simplified by removing redundant literals. For instance, the literal ¬(ctr =3)
in the first disjunct can be removed because it is already implied by ctr < 3.
When continuing these simplifications, we finally obtain the original definition
of the schema Increment in Sec. 12.2.1. This is not surprising because, as mentioned
above, the original definition was already in the desired normal form. In
general, however, this need not to be the case. The generation of test cases in
this approach consists of two steps:
(1) Compute disjunctive normal form with mutually exclusive disjuncts
(2) Remove unsatisfiable disjuncts and simplify the remaining test cases
For the computation of the disjunctive normal form, an optimization to avoid
redundancy was used by Helke et al. [HNS97]. In particular, the predicate part P
of each schema is initially transformed into a conjunction of the form P =
R ∧ Q, whereR is a meta-variable consisting of those schema predicates that
do not contain disjunctions (implicitly or explicitly), and Q is a meta-variable
consisting of the remaining predicates that contain at least one disjunction. For
instance, P = a ∧ (c ∨ (d ∧ e)) ∧ b can be transformed such that R = a ∧ b
and Q =(c ∨ (d ∧ e)), where a, b, c, d, ande denote atoms. The disjunctive
normal form is then computed for Q while R is ignored. Hence, the resulting
representation of the predicate part P consists of a purely conjunctive part R and
an expression Q in disjunctive normal form. This avoids that purely conjunctive
predicates appear in each disjunct of the disjunctive normal form which would
lead to much redundancy.
The preparing partitioning of the predicate part and the computation of the
disjunctive normal form can be implemented by Isabelle’s proof tactics. To detect
unsatisfiable disjuncts, Isabelle’s conditional rewrite mechanisms are used,
i.e., a special parameterized tactic called simplifier. It allows to define rewrite
rules which are able to find contradicting disjuncts and makes it possible to
rewrite them to false. For instance, the final disjunct in the above schema Increment
contains ctr < 3aswellasctr = 3. An application of rewriting yields
3 < 3 which is obviously false. Hence, the disjunct is unsatisfiable and can be
removed. A side effect of such rewritings to find contradicting disjuncts is that
redundancy is reduced, i.e., the test cases are simplified. On the other hand, how-