Testing Generation at UPenn Testing Hybrid System: Phase I Randomized test generator=Randomized Simulator+ Coverage Checker. 1. Local ramdomization 1. Stay or jump 2. Where to jump 3. How long to stay 2. Gobal ramdomization 1. Continuing on current trace. 3. Heuristic search 1. Uncovered neighbor first 2. Syntax-based distance matrix (Shortest distance to uncovered state/location) 3. Open question: deciding the weight for outgoing transitions based on the history of the search from these transitions. 4. Current status 1. A working version of randomized test generation is written on CHARON simulator. Mode A df/dt=1 a: True:f=0 b: 1<f<3:m=1 c: 2<f<4:m=2

Testing Generation at UPenn Testing Hybrid System: Phase II System Modeling CHARON (Model) Flatten hybrid model Converte Implementation Test Suite Set of predicates Coverage criteria Bad set Reachability Checker Yes w/ Trace Simulation /refinment NO w/ more predicates YES

Testing Generation at UPenn Intelligent simulator Intelligent simulator=Simulator+ property checker (monitor) 1. Verification as the byproduct of simulation 1. LTL Property encoded as the monitor 1. MEDL: A subset of LTL, has been applied to Java running-time monitoring. 2. Monitor advances when the simulation proceeds. 3. Open problem: LTL with eventuality only is easy, but how about the formula a R b. 1. Need to remember the states traversed to sense the loop. 1. Difficult because the domain of continuous variables are dense. 2. The search is tailored by the property. 1. A transition “measure” has the priority higher than “sendValue” if the property is G(measure => X (home)). 2. Most interesting simulation trace: Covering as many parts of property as possible using the minimal steps.

Testing Generation at UPenn Testing on discrete systems Given: Test setting = LTL/ 9 LTL + the specification+ Blackbox implementation. Problem: Currently the testing properties is limited to LTL with eventuality only. Question: is there a test for “F( G( a ! Xb))”. Constructing test suites for 9 LTL property. 1. Is the property “E GF a” testable? 1. No finite trace can be attest to this property. 2. If the number of states in blackbox is bounded by n, 1. A trace for 9 LTL + the specification is rational:  (  ) . 2. A infinite trace  (  )  can be cut to $  (  ) n 2. LTL can be translated to a set of interesting 9 LTL properties. 1. E( GF( a)) is an interesting property for F(G(a ! X b))

Testing Generation at UPenn Theoretical research Property-coverage testing, Testing criteria is directly presented as temporal property. Testing will yield some decisive result Does the system satisfy the property? Does the system conform to the specification. Testing+monitering, checking the property on every execution. Con: Generally cannot prove whether system satisfies the property. Pro: Cheap (easy to implement) and generic (available even the abstraction-based model check cannot give a decisive positive result.) What is a testable property? Other coverage criteria can be accommodated in model-based test generation.