Lecture Notes in Computer Science 3472

332 Levi Lúcio and Marko Samer
in the following, partitioning and fault-based heuristics can be seen as a uniform
theoretical framework.
Partitioning heuristics can in Z be formulated as theorems which describe
the equivalence between the original predicate and the partitions. In particular,
there are two components of this equivalence: completeness, whichensures
that the union resp. disjunction of the partitions covers the original predicate,
and disjointness, which ensures that the partitions are pairwise disjoint. The
corresponding generic partitioning heuristics are
∀ Vars(P) • P ⇔ P1 ∨ P2 ∨ ...∨ Pn
∀ Vars(P) • ∀i, j :1..n • i �= j ⇒ ¬(Pi∧ Pj )
where P denotes the original predicate, Pi with 1 ≤ i ≤ n denotes a partition,
and Vars denotes a function that returns the declarations of all variables occurring
in its argument. To obtain partitioning heuristics, the above templates
have to be instantiated. Examples of such instantiations concerning disjunctive
normal form have already been shown above (see transformation rules (12.1),
(12.2), and (12.3)). An instantiation of a boundary value analysis heuristic is
given by:
∀ A, B : Z • A ≥ B ⇔ (A = B) ∨ (A = B +1)∨ (A > B +1)
To obtain concrete test cases, such a heuristic has to be applied to a selected
predicate in a specification, i.e., it has to be instantiated with the parameters
of the predicate. For instance, let us apply the above boundary value heuristic
to the first predicate of the schema Modulo in Sec. 12.2.1. To this aim, we
first have to prove within CADiZ that the heuristic is a tautology. If this is
the case, the heuristic’s instantiation with respect to the predicate (A and B
are instantiated by b? andm? respectively) is computed by CADiZ’s pattern
matching mechanisms within a tactic. The resulting equivalence is:
b? ≥ m? ⇔ (b? =m?) ∨ (b? =m?+1)∨ (b? > m?+1)
Now, the predicate b? ≥ m? in the schema can be replaced by the right hand
side of this equivalence, which yields:
Modulo
b?, m?, r! :N
(b? =m?) ∨ (b? =m?+1)∨ (b? > m?+1)
(r! < m?) ∨ (m? =0)
∃ k : N • b? =m? ∗ k + r!
Finally, the predicate part of this schema can be transformed into disjunctive
normal form. Each of the resulting six disjuncts represents one test case. Thus,
the disjuncts can be separated into schemas for each test case.
Fault-based heuristics can be divided into necessary conditions and sufficient
conditions. Necessary conditions are able to distinguish between different
(mutated) subexpressions. This, however, is not always sufficient to detect