Lecture Notes in Computer Science 3472

13 Real-Time and Hybrid Systems Testing 365
situations of an erroneous implementation of a sample constraint S. Implementation
I1 shows the case that the required output E1 is not produced within the
interval [t1, t2). In contrast, output E1 occurs to early in implementation I2. I3
demonstrates the situation in which an output is produced within the required
interval [t1, t2) but the event associated with the output is incorrect. Since the
quantity being tested is the delay introduced by the SUT, there are no input
parameters for the tester to vary. Therefore, it also does not make a difference
whether the time domain boundaries are open or closed ones.
I1
t1
¬E1
t2
S
I3
t
t1
t1
E1
E2
Fig. 13.4. Erroneous implementations of performance constraints
For behavioral constraints each of the two time domain boundaries is verified
by up to two test points. As shown in Figure 13.5, the number and position of the
test points for each domain boundary depends on its type and value. In contrast
to the performance constraints, for behavioral constraints it makes a difference
whether the time domain boundaries are open or closed ones, because test points
have to be used close to these boundaries. One test point is always placed directly
on the domain boundary. For closed domain boundaries the second test point is
placed at a distance of ɛ outside the boundary. For open domain boundaries the
second test point is placed at a distance ɛ inside the boundary. For the special
case where the upper boundary is ∞, it is not possible to place a test point at
the domain boundary. It is approximated by placing a test point at time Tmax
after the start of the interval, where Tmax is the longest constraint interval in
the system specification. For both open and closed interval boundaries, the up
to two tests per boundary are sufficient to verify that the required change in
system behavior has occurred within ɛ time units with respect to the required
point in time.
A test suite can be derived by generating test cases so that both coverage
criteria are fulfilled. The following three steps are used for test case generation:
(1) Deriving test process templates from the constraint graph. These templates
will supply inputs at some time within the required interval, observe the
outputs of the SUT to verify that they are generated within the correct time
interval, and terminate with ⊤ if the test is successful or ⊥ if the test fails.
t2
t2
I2
t
t
E1
t1
t2
t