Lecture Notes in Computer Science 3472

12 Technology of Test-Case Generation 337
l = nil ✟❍
✟
✟ ❍❍❍❍❍❍❍❍
l �= nil
✟
✷ m =1✟ ✟ m > 1
✟
✟
n > 1 ✟
✟❍
✟
✟ ❍❍❍❍❍❍❍❍
n =1 ✷
✟
✷ cdr(l) =nil ✟
✟ cdr(l) �= nil
✟
✟
✷ ✷
Fig. 12.3. Proof structure of select
ysis is then reflected in the structure of the resulting formal proof. Thus, the
partitioning of the input domain in order to obtain sub-domains which satisfy a
uniformity hypothesis is done as by-product of the proof process, i.e., the domain
analysis is implicitly available in the proof structure and need not to be done
by special test case generation procedures as usual. Test cases extracted from
correctness proofs can then be used for verifying the SUT.
A small case study to justify this approach was also presented by Maharaj
[Mah99]. It discusses a small program implementing the function select
which, given a list and two integers m and n, returns the sublist from the mth
element to the n-th element. The specification of this function is given by
two properties. We consider the first of them which specifies the length of the
returned sublist:
∀ l :List•∀m, n : N • (0 < m ≤ n) ∧ (n ≤ length(l)) (12.7)
⇒ length(select(l, m, n)) = n − m +1
The function has to be implemented in a high-level programming or specification
language about which it is easy to reason. In the case study, the functional
programming language Miranda was used. The resulting program can be seen as
an executable specification of a low-level language implementation that has to
be tested. The theorem prover PVS [ORS92] was used to prove the correctness
of the Miranda implementation regarding both specified properties.
Property (12.7) was proved by induction on the length of the list. The corresponding
proof structure is shown in Fig. 12.3, where cdr : List → List is a
function that maps a list to its tail. This structure arises from the case distinctions
during the proof process. Since the proof is done by induction on the list
length, the first branching distinguishes between the induction start (l = nil)
and the induction step (l �= nil). The other branchings result from the proof of
the induction step.
The test cases can be extracted from this tree by combining the conditions
on the variables that occur on the branches from the root to the leaves. Since
each branch represents a test case, we obtain five test cases. For instance, the
test case corresponding to the right most branch is given by:
{0 < m ≤ n, n ≤ length(l), l �= nil, m > 1}