### Citations

810 | DART: directed automated random testing
- Godefroid, Klarlund, et al.
- 2005
(Show Context)
Citation Context ...are many approaches to reactive system testing: While random testing [21] is still commonly used, approaches have been developed that combine random testing with symbolic and concrete execution (Dart =-=[22]-=-, Cute [23], Klee [19]) to guide exhaustive path enumeration. Scenario-based testing employ test specifications to guide test case generation towards a particular functionality (e.g., Lutess [24], Lur... |

558 |
Algorithm 97: shortest path
- Floyd
- 1962
(Show Context)
Citation Context ... property K-reachability graph. Such a path is not necessarily Hamiltonian; revisiting nodes is allowed. However, we can compute the transitive closure of the graph using the Floyd-Warshall algorithm =-=[8]-=- (which preserves minimality), and then compute a Hamiltonian path from I to F . If we do not have a Hamiltonian path solver, we can add an edge from F to I and pass the problem to an asymmetric trave... |

541 | KLEE: Unassisted and Automatic Generation of HighCoverage Tests for Complex Systems Programs
- Cadar, Dunbar, et al.
- 2008
(Show Context)
Citation Context ...r tool ChainCover (using Lkh) with – FShell12 [17,18], an efficient test generator with test suite minimisation, – an in-house, simple random case generator with test suite minimisation, and – Klee13 =-=[19]-=-, a test case generator based on symbolic execution. 6 http://www.cprover.org/cbmc/, version 4.4 7 http://minisat.se, version 2.2.0 8 http://www.akira.ruc.dk/~keld/research/LKH/, version 2.0.2 9 http:... |

331 | Principles and Methods of Testing Finite State Machines - A Survey
- Lee, Yannakakis
- 1996
(Show Context)
Citation Context ...functionality (e.g., Lutess [24], Lurette [25], Lutin [26]). These methods restrict the input space using static analysis and apply (non-uniform) random test case generation. Model-based testing (see =-=[27,28]-=- for surveys on this topic) considers specification models based on labelled transition systems. For instance, extended finite state machines (EFSM) [29,30,31] are commonly used in communication proto... |

315 | A Tool for Checking ANSI-C programs
- Clarke, Kroening, et al.
- 2004
(Show Context)
Citation Context ...sion 2.4.9 5 http://www.cprover.org/chaincover/, version 0.1 reactive system model C code generator static analyser properties test case generator test suite Fig. 7. Tool chain ture provided by Cbmc6 =-=[14]-=- with MiniSat7 as a SAT backend, the Lkh TSP solver8 [15], and the Clingo ASP solver9 [11]. The properties are written in C using the assert and CPROVER assume macros. For instance, property p1 in our... |

265 |
An evaluation of random testing
- Duran, Ntafos
- 1984
(Show Context)
Citation Context ...h was developed with the motivation of enabling the flexible specification of the desired coverage. Reactive system testing. There are many approaches to reactive system testing: While random testing =-=[21]-=- is still commonly used, approaches have been developed that combine random testing with symbolic and concrete execution (Dart [22], Cute [23], Klee [19]) to guide exhaustive path enumeration. Scenari... |

191 | Bounded Model Checking using Satisfiability Solving
- Clarke, Biere, et al.
(Show Context)
Citation Context ...unded model checking to provide an efficient implementation. Alternative instantiations could be based on symbolic execution, for example. BMC-based test case generation. Bounded model checking (BMC) =-=[12]-=- can be used to check the existence of a path pi = 〈s0, s1, . . . , sK〉 of increasing length K from φ to φ′. This check is performed by deciding satisfiability of the following formula using a SAT sol... |

188 | An effective implementation of the Lin–Kernighan traveling salesman heuristic
- Helsgaun
- 2000
(Show Context)
Citation Context ...0.1 reactive system model C code generator static analyser properties test case generator test suite Fig. 7. Tool chain ture provided by Cbmc6 [14] with MiniSat7 as a SAT backend, the Lkh TSP solver8 =-=[15]-=-, and the Clingo ASP solver9 [11]. The properties are written in C using the assert and CPROVER assume macros. For instance, property p1 in our example is stated as follows: void p 1 ( t i n p u t ∗ i... |

106 | JCUTE: Concolic unit testing and explicit path model-checking tools
- Sen, Agha
- 2006
(Show Context)
Citation Context ...proaches to reactive system testing: While random testing [21] is still commonly used, approaches have been developed that combine random testing with symbolic and concrete execution (Dart [22], Cute =-=[23]-=-, Klee [19]) to guide exhaustive path enumeration. Scenario-based testing employ test specifications to guide test case generation towards a particular functionality (e.g., Lutess [24], Lurette [25], ... |

94 | Potassco: The potsdam answer set solving collection
- Gebser, Kaufmann, et al.
- 2011
(Show Context)
Citation Context ... Since our experimental results (§6) suggest that the bottleneck of the approach lies rather in solving reachability queries than TSPs, we can opt for using answer set programming (ASP) solvers (e.g. =-=[11]-=-), which are far less efficient in solving TSPs, but they allow us to specify arbitrary side conditions. Example 5 (Path constraints). Consider the graph in Fig. 4. We can encode the TSP problem in AS... |

59 | Model based testing with labelled transition systems. Formal Methods and Testing
- Tretmans
- 2008
(Show Context)
Citation Context ...ate machines (EFSM) [29,30,31] are commonly used in communication protocol testing to provide exhaustive test case generation for conformance testing. Available tools include, e.g., Tgv [32] and TorX =-=[33]-=-. Minimal checking sequences and test optimisation. In the model-based testing domain, the problem of finding minimal checking sequences has been studied in conformance testing [3,4,1,5,6], which amou... |

55 | Liveness checking as safety checking
- Biere, Artho, et al.
- 2002
(Show Context)
Citation Context ... exist an edge (ϕ′, ϕ′′) with W (ϕ′, ϕ′′) < W (ϕ′, ϕ) +W (ϕ, ϕ′′) that is only discovered for higher values of K. ⊓⊔ For finite state systems, there is an upper bound for K, the reachability diameter =-=[9,10]-=- beyond that we will not discover shorter pairwise links. Definition 1 (Reachability diameter). The reachability diameter d of a system (Σ, Υ, T, I) is the maximum (finite) length of a path in the set... |

55 | Efficient computation of recurrence diameters
- Kroening, Strichman
- 2003
(Show Context)
Citation Context ... exist an edge (ϕ′, ϕ′′) with W (ϕ′, ϕ′′) < W (ϕ′, ϕ) +W (ϕ, ϕ′′) that is only discovered for higher values of K. ⊓⊔ For finite state systems, there is an upper bound for K, the reachability diameter =-=[9,10]-=- beyond that we will not discover shorter pairwise links. Definition 1 (Reachability diameter). The reachability diameter d of a system (Σ, Υ, T, I) is the maximum (finite) length of a path in the set... |

55 |
TGV: theory, principles and algorithms: A tool for the automatic synthesis of conformance test cases for nondeterministic reactive systems
- Jard, Jéron
(Show Context)
Citation Context ...nded finite state machines (EFSM) [29,30,31] are commonly used in communication protocol testing to provide exhaustive test case generation for conformance testing. Available tools include, e.g., Tgv =-=[32]-=- and TorX [33]. Minimal checking sequences and test optimisation. In the model-based testing domain, the problem of finding minimal checking sequences has been studied in conformance testing [3,4,1,5,... |

40 |
A test sequence selection method for protocol testing
- Ural, Yang
- 1991
(Show Context)
Citation Context ...t case generation. Model-based testing (see [27,28] for surveys on this topic) considers specification models based on labelled transition systems. For instance, extended finite state machines (EFSM) =-=[29,30,31]-=- are commonly used in communication protocol testing to provide exhaustive test case generation for conformance testing. Available tools include, e.g., Tgv [32] and TorX [33]. Minimal checking sequenc... |

29 | Testing with Model Checkers: A Survey
- Fraser, Wotawa, et al.
(Show Context)
Citation Context ...e up in the mid-90s and has attracted continuous research interest since then, especially due to the enormous progress in SAT solver performance. There is a vast literature on this topic, surveyed in =-=[20]-=-, for example. The FShell tool [18,17] we have compared with was developed with the motivation of enabling the flexible specification of the desired coverage. Reactive system testing. There are many a... |

29 | Confirming Configurations in EFSM Testing
- Petrenko, Boroday, et al.
- 2004
(Show Context)
Citation Context ...t case generation. Model-based testing (see [27,28] for surveys on this topic) considers specification models based on labelled transition systems. For instance, extended finite state machines (EFSM) =-=[29,30,31]-=- are commonly used in communication protocol testing to provide exhaustive test case generation for conformance testing. Available tools include, e.g., Tgv [32] and TorX [33]. Minimal checking sequenc... |

27 | Lutess: a specification-driven testing environment for synchronous software
- Bousquet, Ouabdesselam, et al.
- 1999
(Show Context)
Citation Context ...Dart [22], Cute [23], Klee [19]) to guide exhaustive path enumeration. Scenario-based testing employ test specifications to guide test case generation towards a particular functionality (e.g., Lutess =-=[24]-=-, Lurette [25], Lutin [26]). These methods restrict the input space using static analysis and apply (non-uniform) random test case generation. Model-based testing (see [27,28] for surveys on this topi... |

25 |
A Method Enabling Feasible Conformance Test Sequence Generation for EFSM Models
- Duale, Uyar
- 2004
(Show Context)
Citation Context ...s computed, which might be infeasible due to the operations on the data variables. Subsequently, random test case generation is applied to discover such a path, which might fail again. Duale and Uyar =-=[34]-=- propose an algorithm for finding a feasible transition path, but it requres guards and assignments in the models to be linear. Another approach is to use genetic algorithms [3,35] to find a feasible ... |

18 | FShell: Systematic Test Case Generation for Dynamic Analysis and Measurement
- Holzer, Schallhart, et al.
- 2008
(Show Context)
Citation Context ...e an initial transition after which the system is strongly connected), hence, they did not require abstraction refinement. Comparison. We have compared our tool ChainCover (using Lkh) with – FShell12 =-=[17,18]-=-, an efficient test generator with test suite minimisation, – an in-house, simple random case generator with test suite minimisation, and – Klee13 [19], a test case generator based on symbolic executi... |

18 | P.: Case studies with Lurette V2
- Jahier, Raymond, et al.
- 2006
(Show Context)
Citation Context ...e [23], Klee [19]) to guide exhaustive path enumeration. Scenario-based testing employ test specifications to guide test case generation towards a particular functionality (e.g., Lutess [24], Lurette =-=[25]-=-, Lutin [26]). These methods restrict the input space using static analysis and apply (non-uniform) random test case generation. Model-based testing (see [27,28] for surveys on this topic) considers s... |

16 | A Single-Instance Incremental SAT Formulation of Proofand Counterexample-Based Abstraction
- Een, Mischenko, et al.
- 2010
(Show Context)
Citation Context ... for a given path, and getFailedPath converts an unsat core into a path (which is SAT solver-specific). 3 There are alternatives to unsatisfiability cores, e.g., the final conflict feature of Minisat =-=[13]-=-. Algorithm 10: RepairPath by concrete chaining Input: failed path , transition relation T , weights W , reachability bound K Output: updated weights W 1 σ ← FirstElement(failed path) 2 for all e = (ϕ... |

15 | Optimizing the length of checking sequences
- Hierons, Ural
- 2006
(Show Context)
Citation Context ...ally goes to F . One can assert that this path has the minimal length of 9 steps. Testing problems similar to ours have been addressed by research on minimal checking sequences in conformance testing =-=[3,4,1,5,6]-=-. This work analyses automata-based specifications that encode system control and have transitions labelled with operations on data variables. The challenge here is to find short transition paths base... |

14 |
S.: Generating feasible transition paths for testing from an extended finite state machine (EFSM
- Kalaji, Hierons, et al.
(Show Context)
Citation Context ...again. Duale and Uyar [34] propose an algorithm for finding a feasible transition path, but it requres guards and assignments in the models to be linear. Another approach is to use genetic algorithms =-=[3,35]-=- to find a feasible path of minimised length. Also in our setting, the use of genetic algorithms in order to find minimised instead of minimal solutions is an option to consider. SAT solvers have also... |

12 |
automotive handbook
- Bosch
- 2000
(Show Context)
Citation Context ...he problem is to find a shortest path through the system that covers all the test goals. Example. To illustrate the problem and our approach, we reuse the classical cruise controller example given in =-=[2]-=-. There are five Boolean inputs, two for actuation of the gas and brake pedals, a toggle button to enable the cruise control, and two sensors indicating whether the car is acc- or decelerating. There ... |

11 | Incremental learning-based testing for reactive systems
- Meinke, Sindhu
(Show Context)
Citation Context ...y had screenshots from the Simulink models, which we had to re-engineer ourselves. Our benchmarks are a simple cruise control model [2], a window controller10, a car alarm system11, an elevator model =-=[16]-=-, and a model of a robot arm that can be controlled with a joystick. We generated test case chains for these examples for specifications of different size and granularity. The benchmark characteristic... |

11 | H.: Query-driven program testing
- Holzer, Schallhart, et al.
- 2009
(Show Context)
Citation Context ...e an initial transition after which the system is strongly connected), hence, they did not require abstraction refinement. Comparison. We have compared our tool ChainCover (using Lkh) with – FShell12 =-=[17,18]-=-, an efficient test generator with test suite minimisation, – an in-house, simple random case generator with test suite minimisation, and – Klee13 [19], a test case generator based on symbolic executi... |

10 |
Optimization problems from feature testing of communication protocols
- Lee, Yannakakis
- 1996
(Show Context)
Citation Context ...t case generation. Model-based testing (see [27,28] for surveys on this topic) considers specification models based on labelled transition systems. For instance, extended finite state machines (EFSM) =-=[29,30,31]-=- are commonly used in communication protocol testing to provide exhaustive test case generation for conformance testing. Available tools include, e.g., Tgv [32] and TorX [33]. Minimal checking sequenc... |

10 |
Automated Test Case Generation with SMT-Solving and Abstract Interpretation
- Peleska, Vorobev, et al.
- 2011
(Show Context)
Citation Context ...le in the concrete program does not arise due to limited reasoning about data variables, but due to the multi-state nature of the properties we are trying to cover. Closest to our work is recent work =-=[38]-=- on generating test chains for EFSM models with timers. They use SMT solvers to find a path to the nearest test goal and symbolic execution to constrain the search space. If no test goal is reachable ... |

8 | Using a minimal number of resets when testing from a finite state machine
- Hierons
- 2004
(Show Context)
Citation Context ...ally goes to F . One can assert that this path has the minimal length of 9 steps. Testing problems similar to ours have been addressed by research on minimal checking sequences in conformance testing =-=[3,4,1,5,6]-=-. This work analyses automata-based specifications that encode system control and have transitions labelled with operations on data variables. The challenge here is to find short transition paths base... |

6 |
Lutin: A language for specifying and executing reactive scenarios
- Raymond, Roux, et al.
- 2008
(Show Context)
Citation Context ... [19]) to guide exhaustive path enumeration. Scenario-based testing employ test specifications to guide test case generation towards a particular functionality (e.g., Lutess [24], Lurette [25], Lutin =-=[26]-=-). These methods restrict the input space using static analysis and apply (non-uniform) random test case generation. Model-based testing (see [27,28] for surveys on this topic) considers specification... |

5 |
H.: On the complexity of generating optimal test sequences
- Boyd, Ural
- 1991
(Show Context)
Citation Context ...sumptions are non-overlapping, i.e. the sub-paths satisfying the assumptions do not share any edges. Our minimality results only apply to such specifications. Detecting overlappings is a hard problem =-=[7]-=- that goes beyond the scope of this paper. Test cases. A test case is an input sequence 〈i0, . . . , in〉 and generates an execution pi = 〈s0, . . . , sn+1〉. A test case covers a property p iff its exe... |

4 |
H.: Generating a checking sequence with a minimum number of reset transitions
- Hierons, Ural
- 2010
(Show Context)
Citation Context ...d>0) s−>speed−−; } Fig. 1. Code generated for cruise controller example on-target testing, where a system is tested in its real-life application environment and resetting might be very time-consuming =-=[1]-=-. This paper presents an approach to discovering a test case chain—a single test case that covers a set of multiple test goals and minimises overall test execution time. The essence of the problem is ... |

4 |
Generating Checking Sequences for Nondeterministic Finite State Machines
- Petrenko, Simao, et al.
- 2012
(Show Context)
Citation Context ...ally goes to F . One can assert that this path has the minimal length of 9 steps. Testing problems similar to ours have been addressed by research on minimal checking sequences in conformance testing =-=[3,4,1,5,6]-=-. This work analyses automata-based specifications that encode system control and have transitions labelled with operations on data variables. The challenge here is to find short transition paths base... |

4 |
T.: A test sequence generation method for communication protocols using the SAT algorithm
- Mori, Otsuka, et al.
- 2003
(Show Context)
Citation Context ...e use of genetic algorithms in order to find minimised instead of minimal solutions is an option to consider. SAT solvers have also been used to compute (non-minimal) checking sequences in FSM models =-=[36,37]-=-. Our method does not impose restrictions on guards and assignments and implicitly handles low-level issues such as overflows and the semantics of floating-point arithmetic in finding feasible test ca... |

4 |
A Method and Tool for Test Optimization for Automotive Controllers
- Petrenko, Dury, et al.
- 2013
(Show Context)
Citation Context ...ch represents a greedy heuristics and thus makes minimality considerations difficult. Our method can handle timing information if it is explicitly expressed as counters in the program. Petrenko et al =-=[39]-=- propose a method for test optimisation for EFSM models with timers. They use an ATSP solver to find an optimal ordering of a given set of test cases and an SMT solver to determine paths connecting th... |

4 | Under-Approximating Loops in C Programs for Fast Counterexample Detection
- Kroening, Lewis, et al.
(Show Context)
Citation Context ...ops pose a problem for BMC-based methods. For instance, we had to reduce size of loop bound constants in the car alarm system benchmark to make it tractable for comparison. Acceleration methods, e.g. =-=[40]-=-, are expected to remedy many such situations, especially those involving counters. Moreover, the property K-reachability graph generation lends itself to parallellisation. This is expected to give a ... |

3 |
M.: Using genetic algorithms to generate test sequences for complex timed systems. Soft Computing 17
- Nuñez, Merayo, et al.
- 2013
(Show Context)
Citation Context |

3 |
J.C.: Model-based testing of software and systems: recent advances and challenges
- Petrenko, Simão, et al.
(Show Context)
Citation Context ...functionality (e.g., Lutess [24], Lurette [25], Lutin [26]). These methods restrict the input space using static analysis and apply (non-uniform) random test case generation. Model-based testing (see =-=[27,28]-=- for surveys on this topic) considers specification models based on labelled transition systems. For instance, extended finite state machines (EFSM) [29,30,31] are commonly used in communication proto... |

3 | D.: Using a SAT solver to generate checking sequences
- Jourdan, Ural, et al.
- 2009
(Show Context)
Citation Context ...e use of genetic algorithms in order to find minimised instead of minimal solutions is an option to consider. SAT solvers have also been used to compute (non-minimal) checking sequences in FSM models =-=[36,37]-=-. Our method does not impose restrictions on guards and assignments and implicitly handles low-level issues such as overflows and the semantics of floating-point arithmetic in finding feasible test ca... |