Lecture Notes in Computer Science 3472

352 Levi Lúcio and Marko Samer
Finally, the test cases are obtained by running the Java PathFinder model
checker over the instrumented code. For each of the criteria specified in logic
formulas, witnesses or counter-examples traces are generated. As in the previous
approaches, the path conditions for these traces may then be used the build the
actual input values to test the concrete system.
12.4 Model Checking
In the next few paragraphs we will describe the application of model checking
for test case generation. Given that the topic is explored in depth in Chap. 19
of the present volume, we limit ourselves to giving a short overview of the subject.
Several approaches exist that establish connections between model checking
and model-based testing (see [CSE96, EFM97, GH99, GRR03, HLSU02,
HCL + 03, RH01a, RH01b]). In all these approaches the problem of test case generation
is reduced to finding witnesses or counterexamples to a set of temporal
logic formulas. These temporal logic formulas express control flow oriented test
coverage criteria (see [GH99, GRR03, RH01a, RH01b]) or data flow oriented
test coverage criteria (see [HLSU02, HCL + 03]). The capability of model checkers
to find witnesses and counterexamples to the logic formulas allows then test
case generation to be fully automatic. The obtained execution traces are obtained
from a simplified model of the application and can be used to test a real
implementation either for correct traces or for error situations.
In [CSE96, EFM97], the authors propose similar approaches that use test
purposes instead of test coverage criteria. Differently from test coverage criteria
which capture structural entities of a model, test purposes express behavioral
properties of a model. Examples are properties of certain states or a sequence of
states to be traversed.
The authors of [ABM98, AB99] apply model checking to test case generation
for mutation analysis-based test coverage criteria. By applying mutation operators
to either a system model or a property, mutants are produced. A test suite
is then generated to cover the inconsistent behaviors exhibited by the mutants.
The capability of model checkers to construct counterexamples is used to find
such inconsistent behaviors.
Model checking-based test case generation provides several relevant features
in comparison to other test case generation techniques. First, all details on test
case generation are hidden inside the model checkers. This allows the test engineer
to focus on only high-level specifications of test purposes or coverage criteria
written in temporal logic. On the other hand, test case generation is language independent
in the sense that the temporal logic formulas can be applied to various
specification and programming languages without having to build a dedicated
tool for each language. Finally, test case generation can be performed on large
and complex models since model checking is a relatively mature technology.