Lecture Notes in Computer Science 3472

456 Wolfgang Prenninger, Mohammad El-Ramly, and Marc Horstmann
abstraction can be effectively combined with communication or/and functional
abstraction.
Another form of temporal abstraction is that the test model abstracts from
physical time. For example, the concrete implementation may depend on using
a timer of 250 ms duration. This timer is abstracted in the model by introducing
two symbolic events—one for starting the timer, and one for indicating expiration
of the timer. By doing so, the physical duration of the timer is abstracted away
even if the duration of certain timers changes over runtime at the concrete level.
One might well argue that this kind of abstraction is the special case of a
more general abstraction, namely abstraction from quality-of-service.
In Tab. 15.3 we summarize the abstraction principles which were used in
the documented case studies. The table entry yes indicates that the abstraction
principle was used in the case study and no indicates the opposite. We marked
the entry with ? if we could not find any hint if the abstraction principle was
used or not. It turns out considerably that most of the case studies explicitly
mentioned that functional abstraction and data abstraction was used.
functional data temporal communication
abstraction abstraction abstraction abstraction
[DBG01] SDU of ST100 DSP yes yes no yes
[SA99] Microprocessors yes yes yes yes
[FKL99] PowerPC yes ? ? ?
[PPS + 03] Smart Cards: WIM yes yes yes yes
[CJRZ01] Smart Cards: CEPS ? ? ? ?
[KVZ98] Cache Coherency Protocol yes ? ? yes
[BFdV + 99] Conference Protocol ? yes ? ?
[FHP02] POSIX/Java yes yes ? ?
Table 15.3. Used Abstraction Principles
Limitations of the Abstractions It is crucial that the modeler is aware of the
limitations, and therefore decides for the right trade off between abstraction and
precision when building appropriate test models for testing the critical aspects
of the SUT. There is an inherent complexity in real systems. If some of them
are abstracted in the test model in the sense that it cannot be compensated
afterwards by the test driver component there is no way to detect faults in the
SUT concerning these abstractions. In the following we mention a few limitations
and consequences.
Often enough, test models suffer from a more or less distinct and implicit
“happy world assumption” which stems from functional abstraction. A typical
example is that models assume that parameters of input messages or input operations
are within allowed bounds or have the permitted length or arity. With
the aid of such models, it is not possible to test the SUT’s behavior if it receives
messages with illegal parameters. For example, in the smart card domain an
operation including its operands is represented by a byte string at the concrete