J. Callahan, F. Schneider, and S. Easterbrook. Automated software testing using model-checking. In Proc. 1996.  Home/Search   Document Details and Download   Summary   Related Articles   Check

....testing 1 Introduction Speci cation based testing is a black box technique, that is, it assumes that internal states of the program implementing the speci cation are unknown, hence failures can only be detected in external responses. Although model checkers can be used to generate tests [3, 6, 10, 13, 25, 17], existing methods allow the model checker to choose tests that do not cause faults to propagate to the program s output. Goradia [16] presents typical cases that prevent a fault in an intermediate state from propagating to the output. The faulty state variable does not participate in a ....

.... as a method for verifying hardware designs, there is growing evidence that it can be applied to checking speci cations of large software systems, such as TCAS II [7] In addition to verifying properties of software, model checking is being applied to test generation and test coverage evaluation [3, 6, 10, 13, 25, 17]. In both uses, one rst chooses a test criterion [14] that is, decides on a philosophy about what properties of a speci cation must be exercised to constitute a thorough test. Some speci cation based test criteria are conjunctive complementary closure partitions [6] branch coverage [13] and ....

[Article contains additional citation context not shown here]

John Callahan, Francis Schneider, and Steve Easterbrook. Automated software testing using model-checking. In Proceedings of the 1996.

....the problem of relating tests to formal speci cations. Counterexamples from model checkers have been recognized as potentially useful test cases. Callahan, Schneider, and Easterbrook used a model checker to generate tests that cover each block in a certain partitioning of the input domain [14]. Engels et al. used a model checker to generate network tests [23] Ammann et al. de ned a mutation analysis approach to generating and recognizing tests with a model checker [5, 4] Gargantini and Heitmeyer used model checkers [25] to generate tests for systems with SCR (Software Cost Reduction) ....

....compare any particular test set against a criterion to determine if and how well it satis es the criterion. We can divide test criteria into two broad categories: those that apply to source code, see for instance the extensive survey in [46] and those that apply to speci cations, for instance [22, 36, 17, 1, 16, 14, 23, 25, 26, 4]. Metrics based on source code are more clearly tied to the implementation. However speci cation based metrics allow some language independence and are applicable even without source code, for instance, in the design phase or during acceptance testing. After [27] we say that a test criterion ....

[Article contains additional citation context not shown here]

John Callahan, Francis Schneider, and Steve Easterbrook. Automated software testing using model-checking. In Proceedings 1996.

....to the particular logics used to represent (for example) Statecharts would result in much more effective automation. 2.4. 2 Model checking for test case generation One of the first papers to describe the application of model checkers to the automated testing problem was by Callahan et al. CSE96] The authors used the SPIN model checker [Hol97] to demonstrate the conformance of a program trace (the values of selected variables measured at different points in the program) to a model of the specification. The authors also demonstrated how sequences could be generated that belong to a ....

....makes model checking a convenient means of generating test sequences from finite state machines. The finite state machine is defined as the model and the negation of the path constraint for the desired test sequence is defined as a liveness property to be checked against the model [CSE96] The model checker then attempts to find a counter example to this property, which due to double negation results in a test sequence satisfying the property. 129 Model checking is a completely automated technique (once the input to the model checker has been produced) and is therefore a ....

J. Callahan, F. Schneider, and S. Easterbrook. Automated software testing using model checking. In Proceedings 1996 SPIN Workshop, August 1996. Also WVU Technical Report NASA-IVV-96-022.

.... to our use of the Symbolic Model Veri er (SMV) model checker [19] to generate mutation adequate tests [2] Callahan, Schneider, and Easterbrook use the Simple PROMELA Interpreter (SPIN) model checker [16] to generate tests that cover each block in a certain partitioning of the input domain [8]. Gargantini and Heitmeyer use both SPIN and SMV to generate branch adequate tests from Software Cost Reduction (SCR) requirements speci cations [14] The model checking approach to formal methods has received considerable attention in the literature, and readily available tools such as SMV and ....

John Callahan, Francis Schneider, and Steve Easterbrook. Automated software testing using model-checking. In Proceedings 1996 SPIN Workshop, Rutgers, NJ, August 1996. Also WVU Technical Report #NASA-IVV-96-022.

....especially algorithms for performing points to analysis [11, 14] The problem of comparing verification based algorithms or of finding counter examples through a data flow analysis problem does not seem to have been studied. Some work has been done on counter example generation for testing [1, 3]. In [9] model checking is used to create counter examples for the inverse of a property. This returns traces that are paths over which the property holds. These traces are then used to select tests for the system. In this work, two different model checkers, SMV [16] and SPIN [12] were used to ....

J. Callahan, F. Schneider, and S. Easterbrook. Automated software testing using model-checking. In Proc. of the Second SPIN Workshop, Aug. 1996.

.... began as a method for verifying hardware designs, there is growing evidence that it can be applied to specifications for large software systems, such as TCAS II [7] In addition to verifying properties of software, model checking is being applied to test generation and test coverage evaluation [2, 6, 10, 11]. In both uses, one begins with selection of a test criterion [12] that is, a decision about what properties of a specification must be exercised to constitute a thorough test. Some specification based test criteria are conjunctive com plementary closure partitions [6] branch coverage [11] ....

....evaluation [2, 6, 10, 11] In both uses, one begins with selection of a test criterion [12] that is, a decision about what properties of a specification must be exercised to constitute a thorough test. Some specification based test criteria are conjunctive com plementary closure partitions [6], branch coverage [11] and mutation adequacy [1] The chosen test criterion is applied to the specification to derive test requirements, i.e. a set of individual properties to be tested. To use a model checker, these requirements are represented as temporal logic formulas. To evaluate coverage ....

J. Callahan, F. Schneider, and S. Easterbrook. Automated software testing using model-checking. In Proceedings

....are consistent. We generated tests for a small example, ran them against a target implementation, and measured code branch coverage. Generating tests to kill all mutants is the rst test criterion we investigated. Some other speci cation based criteria are stuck at faults [1] CCC partitions [6], MC DC [7] automata theoretic [8] branch coverage [10] disconnection or redirection faults [11] and transition pair coverage [13] Test generation then is the problem of nding tests which ful ll the goals embodied in the criterion. Test set recognition is the conjugate of test generation. ....

....test sets. Currently we are applying the method to a part of a ight guidance system from an aerospace rm and to a secure operating system add on for a Unix derivative. Other Work The earliest work we know of on generating tests using model checkers is when Callahan, Schneider, and Easterbrook [6] mentioned that counterexamples generated from SPIN, Mur , or SMV model checkers can be used as test cases. Engels, Feijs, and Mauw [9] named some general concepts, such as test purposes (some goals to achieve with testing) and never claim (submit the negation of what you want so the model ....

John Callahan, Francis Schneider, and Steve Easterbrook. Automated software testing using model-checking. In Proceedings 1996 SPIN Workshop, Rutgers, NJ, August 1996. Also WVU Technical Report #NASA-IVV96 -022.

.... began as a method for verifying hardware designs, there is growing evidence that it can be applied to specifications for large software systems, such as TCAS II [7] In addition to verifying properties of software, model checking is being applied to test generation and test coverage evaluation [2, 6, 10, 11]. In both uses, one begins with selection of a test criterion [12] that is, a decision about what properties of a specification must be exercised to constitute a thorough test. Some specification based test criteria are conjunctive com plementary closure partitions [6] branch coverage [11] ....

....evaluation [2, 6, 10, 11] In both uses, one begins with selection of a test criterion [12] that is, a decision about what properties of a specification must be exercised to constitute a thorough test. Some specification based test criteria are conjunctive com plementary closure partitions [6], branch coverage [11] and mutation adequacy [1] The chosen test criterion is applied to the specification to derive test requirements, i.e. a set of individual properties to be tested. To use a model checker, these requirements are represented as temporal logic formulas. To evaluate coverage ....

J. Callahan, F. Schneider, and S. Easterbrook. Automated software testing using model-checking. In Proceedings 1996 SPIN Workshop, Rutgers, NJ, August 1996. Also WVU Technical Report #NASA-IVV-96-022.

....case explicit, and minimizing expressions are given in [2] The set of clauses derived from all state machine transitions, which are consistent with the state machine, are combined with any preexisting clauses to serve as the specification. Although other test criteria 1 could be applied [8, 14], we confine ourselves here to a specification mutation adequacy criterion. Simply stated, the criterion is that a test set must kill all mutations of a specification produced with some set of mutation operators. A mutant is killed if the mutant CTL clause is shown inconsistent with the trace, or ....

J. Callahan, F. Schneider, and S. Easterbrook. Automated software testing using model-checking. In Proceedings 1996 SPIN Workshop, Rutgers, NJ, August 1996. Also WVU Technical Report #NASA-IVV-96-022.

....We are also not the first to recognize that the counterexamples from model checkers are potentially useful test cases. In particular, Callahan, Schneider, and Easterbrook use the SPIN model checker to generate tests that cover each block in a certain partitioning of the input domain [9]. However, we understand we are the first to define a mutation model in the context of a model checker and automatically generate mutation adequate tests. Table 1 is an SCR mode transition table; it corresponds to a state machine description. For instance, line 7 in the table states that when the ....

J. Callahan, F. Schneider, and S. Easterbrook. Automated software testing using modelchecking. In Proceedings 1996 SPIN Workshop, Rutgers, NJ, August 1996. Also WVU Technical Report #NASA-IVV-96-022.

No context found.

J. Callahan, F. Schneider, and S. Easterbrook. Automated software testing using model-checking. In Proc. 1996.

No context found.

Callahan, John, Steven Easterbrook, and Frank Schneider, "Automated Software Testing Using Model Checking," Workshop on Living with Inconsistency, International Conference on Software Engineering (ICSE97), Boston, MA, May, 1997.

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC