Lecture Notes in Computer Science 3472

13 Real-Time and Hybrid Systems Testing 367
automata work with a dense time domain [AD94]. In contrast, we present here
results from Cardell-Oliver that use discrete time [CO00]. In this approach, it
is argued that events cannot be observed at arbitrarily close times even if this
can be specified in the dense time domain. Therefore digital clocks that model
discrete time are used.
In the original algorithm, the basic assumption is that the implementation
does not possess more states than its model. In this case, it can be proven that
the generated test suite detects non-conformance between model and SUT and
is furthermore complete. We do not believe that this is always guaranteed as
the model is generally derived from the requirements of the SUT and not from
the SUT itself. We refer to Chapter 8 for theoretical background. However, we
believe that the presented ideas for generating a manageable test suite are useful
as their focus is decreasing the amount of test cases.
Modeling: The basis for this approach are Timed Transition Systems
(TTS) that mainly consist of three components:
• States Each TTS owns a finite set of states.
• Initial state One of these states is the initial state, where execution starts.
• Labeled transition relations Source and target states are connected
by labeled transition relations. The label is discussed with respect to the
used timed automata definition.
The timed transition system itself is described by a network of communicating
timed automata as used in the tool UPPAAL [LPY97]. These automata further
consist of:
• Variables Each automaton owns a finite set of data and clock variables.
All variables are bounded. Clocks have to be reset if the specified bound is
reached.
• Guards Guards are predicates that are conjunctions of constraints on clock
and data variables. They are used for labeling transitions. If the guard evaluates
to true, the transition is enabled and can be taken.
• Events Each automaton owns a finite set of events. Different automata
communicate via these events over synchronization channels. For this purpose,
each event is classified either as input or as output. If a is the name of
a synchronization channel, a! is the corresponding output event and a? the
corresponding input event. Like guards, events are used to label transitions.
Two transitions are involved and must therefore be enabled: one that emits
event a! and one that receives event a?.
• Assignments With assignments both data and clock variables can be reset.
They are also used to label transitions.
• Clock Invariants Each state of the automaton can own an invariant that
specifies when the state has to be left due to a given timing constraint.
With respect to transitions, labels are composed of guards, events, and assignments
in this order. The initial state is marked with an inner circle in the
state symbol as shown in Figure 13.6. The network of communicating automata