Testing Generation at UPenn

Model-Based Test Generation

I. Model-based test generation for discrete systems [HLS02].

Temp. Prop. Translator

ControllerModel Checker----------------------

Witness generator

1 Æ ……Æ ni

i ² i

Concretization

TS={1,……, n}

Specification Model

Implementation

Coverage Criteria

Test Suite

II. Current works,1. Lift the restriction on i.

1. What is a testable property? Must be a linear-witness ready property. Can we lift this restriction?

2. Use desirable properties directly as the coverage criteria.

Testing Generation at UPenn

Testing Hybrid System: Phase I

1. Randomized test generator=Randomized Simulator+ Coverage Checker. Randomization is introduced when1. Both the discrete transition and continue update available

1. f=1.5 ) Continue Stay in mode A or take b?2. Multiple trans. Enabled. Which one should be chosen?

1. f=2.5 and decide to take a trans ) should take b or c?3. How long we should remain in a mode?

1. F=1.5 and decide to stay in mode A ) 0.1 s? 0.2 s? …

Mode Adf/dt=1

a: True:f=0b: 1<f<3:m=1

c: 2<f<4:m=2

2. Coverage checker will keep a trace only if it helps reach the coverage criteria.3. Current Status,

1. A working test generator has been built as the part of CHARON simulator.

Testing Generation at UPenn

Testing Hybrid System: Phase II

SystemModeling

CHARON(Model)

Discrete transition

Continuous mode AbstractionDiscreteModel

Predicate abstractQualitative abstraction

Reachability test/Bounded BFS

Converter

Implementation

Coverage criteria

TracesTest Suite

Testing Generation at UPenn

Current status of implementation

A randomized test generator finished the first phrase of development, Generator is a part of Charon simulator. Test generation is based on randomized

execution. Mode and transition coverage are

supported. Currently we are investigating smarter

model-checking-guided test generation. Model coverage: if a node is unable to be

reached by a randomized execution mark it as the bad state. call model checker to find a counterexample.

A counterexample-ready model checker for hybrid system has been developed by Rajeev’s group.

Testing Generation at UPenn

Theoretical research Property-coverage testing,

Testing criteria is directly presented as temporal property.

Testing will yield some decisive result Does the system satisfy the property? Does the system conform to the specification.

Testing+monitering, checking the property on every execution.

Con: Generally cannot prove whether system satisfies the property.

Pro: Cheap (easy to implement) and generic (available even the abstraction-based model check cannot give a decisive positive result.)

What is a testable property? Other coverage criteria can be

accommodated in model-based test generation.