Lecture Notes in Computer Science 3472

14 Tools for Test Case Generation 403
The test objective allows to state properties and path predicates. Safety properties
are expressed with the assert keyword of Lustre. An asserted property
must hold in each step of the generated test sequence. To state a path predicate,
GATeL employs a slightly expanded Lustre syntax. GATeL allows to express
path predicates with the additional keyword reach. The statement reach Exp
means that Exp must be reached once within the test sequence. More precisely,
GATeL will try to find a test sequence which ends in a state where all expressions
to be reached evaluate to true.
The SUT and the environment are only allowed to contain assertions. An
assertion in the SUT is used by Lustre compilers to optimize the generated
code. Assertions within the environment description are used to constrain the
possible behavior of the environment – as usual.
As an example, consider the following program and test objective. The node
COUNT
SIGNAL is counting the number of cycles when signal is true. Let us further
assume that signal is part of the input.
node COUNT_SIGNAL(signal : bool)
returns (n : int);
let
base = 0 -> pre(n);
n = if signal then base + 1 else base;
tel;
assert true -> not ( signal and pre(signal) )
reach COUNT_SIGNAL(signal)>1;
The assertion requires signal to be true in two consecutive steps. The subsequent
reach statement requires GATeL to generate a test sequence such that
COUNT SIGNAL(signal) becomes greater than 2.
Based on the SUT (or its specification) and the environment description,
GATeL will try to find a test sequence which satisfies the path predicate expressed
in the reach statement and which satisfies the asserted invariance expressions
in every cycle. If such a test sequence can be found, it will be executed
with the SUT. The output values computed by the SUT are compared with the
corresponding values of the precomputed test sequence. If the two sequences
match, the test case passed, otherwise it failed.
Test Sequence Generation
Consider again the node COUNT SIGNAL with the test objective
assert true -> not ( signal and pre(signal) );
reach COUNT_SIGNAL(signal)>1;
To find a sequence which satisfies the test objective, GATeL starts with the final
cycle of the test sequence to be generated. Using the notation signal[N] to