Lecture Notes in Computer Science 3472

416 Axel Belinfante, Lars Frantzen, and Christian Schallhart
implementation. The Co-Op method of deriving a canonical tester is based on
the above observations.
To slightly formalize the above we can say that the outgoing transitions from
a state s can be divided in two sets: Options(s) isthesetofactionsthats can
perform from its unstable states, and Compulsory(s) isasetofofsetsofactions,
where each of the sets of actions corresponds to a stable state that can be reached
from B, and contains exactly the outgoing actions of that stable state.
The initial behavior from the tester is constructed using Compulsory and
Options. The tester may initially try to test any of the actions in Options(s).
The implementation may interact, but this is not guaranteed. Alternatively (or
after trying several Options), the tester may internally move to a state from
which it offers to interact with any of a set of actions: this set is chosen such
that it contains exactly one action of each of the elements of Compulsory(s).
We assume that eventually the implementation moves to one of its stable states,
and from there must be able to perform at least one of the actions offered by the
tester. An implementation that does not interact within some limited time is not
regarded as conforming. If a process s may, after performing a series of internal
actions, enter a deadlocking state from which it cannot perform any actions,
Compulsory(s) will contain the empty set. The tester may then try to do any of
the observable outgoing transitions of s, but no interaction is guaranteed. The
tester may then, after trying zero or more actions, deadlock.
The behavior of the tester after doing an action is computed by first collecting
all states subsequent that can be reached by doing that transition, computing the
initial behavior for the tester from those states (using Compulsory and Options
as above), and combining these initial behaviors.
To paraphrase: this is about who takes the initiative to force a decision in the
case of non deterministic choices. If the specification can decide to do something,
the tester must be able to follow, but if the specification leaves the choice to its
environment, the tester can make (force) the decisions. This means that in the
resulting tester, we see internal steps where the tester may make a decision (to
select between multiple actions offered from stable states of the implementation),
and actions directly offered (without preceding internal step) where the tester
must be able to interact directly with actions from unstable states.
User Interaction
Cooper is started with a given specification. It then shows the user this specification,
together with the initial canonical tester for it, which is the canonical
tester derivation function T applied to the whole expression of the specification.
The user can then zoom in and step by step apply the canonical tester derivation
function on expressions and subexpressions, every time replacing a sub expression
by its initial tester, which leaves the canonical tester to be applied on
the sub expressions that follows the initial actions in initial tester, from which
can then in turn the initial tester can be computed, etc.
Cooper allows the user to select a behavior expression, and then computes
the corresponding canonical tester by computing the tester for the left-hand side