Testing Techniques Testing with Finite State Machines Ed Brinksma course 2004

© Ed Brinksma/Jan Tretmans TT 2004, FSM 2 This Lecture : Overview lTesting with formal methods: nGeneric framework nTesting based on Labelled Transition Systems - ioco nTesting based on Finite State Machines (FSM) lNow: FSM nState based testing nH. Ural, Formal methods for test sequence generation, Computer Communications, 15(5), nOther literature: D. Lee and M. Yannakakis, Principles and methods of testing finite state machines - A survey. The Proceedings of the IEEE 84, August 1996.

© Ed Brinksma/Jan Tretmans TT 2004, FSM 3 State Machines lMany systems can be specified / modelled as state machines lState machines as the basis for testing : nFSM : Finite State Machine nblack box nspecification based nreactive systems : lcommunication protocols lcontrol systems lembedded systems

© Ed Brinksma/Jan Tretmans TT 2004, FSM 4 State Machines lStates lTransitions lInputs ( “triggers”) lOutputs outputinput state new state

© Ed Brinksma/Jan Tretmans TT 2004, FSM 5 Coffee Machine : State Graph stui? / - dub? / stui! koffie? / koffie! stui? / stui! dub? / - koffie? / - dub? / dub!

© Ed Brinksma/Jan Tretmans TT 2004, FSM 6 Coffee Machine : State Table lconventions (from Z): nplain name:state nname?:input nname!:output lTable gives new state and output as function of state and input State Input stui?5 / - 10 / -10 / stui! dub?10 / -10 / stui!10 / dub! koffie?0 / -5 / -0 / koffie!

© Ed Brinksma/Jan Tretmans TT 2004, FSM 7 State Machine : FSM Model lFSM - Finite State Machine - or Mealy Machine is 5-tuple lM = ( S, I, O, , ) nSfinite set of states nIfinite set of inputs nOfinite set of outputs n  : S x I  Stransfer function n : S x I  Ooutput function nusually we also indicate an initial state nNatural extension to sequences :  : S x I*  S : S x I*  O*

© Ed Brinksma/Jan Tretmans TT 2004, FSM 8 State Machine : FSM Model lFSM restrictions: ndeterministic:  : S x I  S and : S x I  O are functions ncompletely specified:  : S x I  S and : S x I  O are complete functions ( empty output is allowed; sometimes implicit completeness ) nstrongly connected: from any state any other state can be reached, or any state can be reached from the initial state nreduced: there are no equivalent states

© Ed Brinksma/Jan Tretmans TT 2004, FSM 9 Coffee Machine FSM Model stui? / - dub? / stui! koffie? / koffie! stui? / stui! dub? / - koffie? / - dub? / dub!

© Ed Brinksma/Jan Tretmans TT 2004, FSM 10 Testing with FSM lGiven: na specification FSM MS na ( black box ) implementation FSM MI ldetermine whether MI conforms to MS li.e., MI behaves in accordance with MS li.e., whether outputs of MI are the same as of MS li.e., whether the reduced MI is equivalent to MS lPossible errors: nextra or missing states noutput fault ntransition fault lto other state lto new state

© Ed Brinksma/Jan Tretmans TT 2004, FSM 11 FSM Testing lTest with paths of the (specification) FSM lPath = sequence of inputs with expected outputs ( cf. path testing as white-box technique) lInfinitely many paths : how to select ? lDifferent strategies : ntest every state : state coverage (of specification !) ntest every transition : transition coverage ltest output of every transition ltest output + resulting state of every transition

© Ed Brinksma/Jan Tretmans TT 2004, FSM 12 FSM State Testing lMake State Tour that covers every state stui? / - dub? / stui! koffie? / koffie! stui? / stui! dub? / - koffie? / - dub? / dub! Test sequence : stui? dub? koffie? stui? / - dub? / stui! koffie? / koffie! stui? / stui! dub? / - koffie? / - dub? / dub!

© Ed Brinksma/Jan Tretmans TT 2004, FSM 13 FSM Transition Tour lMake Transition Tour that covers every transition stui? / - dub? / stui! koffie? / koffie! stui? / stui! dub? / - koffie? / - dub? / dub! stui? / - dub? / stui! koffie? / koffie! stui? / stui! dub? / - koffie? / - dub? / dub! Test sequence : koffie? stui? koffie? stui? stui? dub? koffie? dub? koffie? stui? dub? koffie?

© Ed Brinksma/Jan Tretmans TT 2004, FSM 14 FSM Transition Testing lOne big tour as test case not always desirable ( too long, too complex, difficult to analyse, not specific ) lMake test case for every transition separately: S1S2 a? / x! lTest transition : nGo to state S1 nApply input a? nCheck output x! nVerify state S2 ( optionally ) lTest purpose: “Test whether the system, when in state S1, produces output x! on input a? and goes to state S2”

© Ed Brinksma/Jan Tretmans TT 2004, FSM 15 FSM Transition Testing lGo to state S1 : nsynchronizing sequence brings machine to particular state, say S0, from any state ( but synchronizing sequence may not exist ) nor: use reset transition if available ngo from S0 to S1 ( always possible because of determinism and completeness )

© Ed Brinksma/Jan Tretmans TT 2004, FSM 16 FSM Transition Testing synchronizing sequence : stui? / - dub? / stui! koffie? / koffie! stui? / stui! dub? / - koffie? / - dub? / dub! dub? koffie? stui? / - dub? / stui! koffie? / koffie! stui? / stui! dub? / - koffie? / - dub? / dub! stui? / - dub? / stui! koffie? / koffie! stui? / stui! dub? / - koffie? / - dub? / dub! koffie? / stui? / - dub? / stui! koffie? / koffie! stui? / stui! dub? / - koffie? / - dub? / dub! stui? / - dub? / stui! koffie? / koffie! stui? / stui! dub? / - koffie? / - dub? / dub!

© Ed Brinksma/Jan Tretmans TT 2004, FSM 17 FSM Transition Testing synchronizing sequence : stui? / - dub? / stui! koffie? / koffie! stui? / stui! dub? / - koffie? / - dub? / dub! dub? koffie? koffie? / stui? / - dub? / stui! koffie? / koffie! stui? / stui! dub? / - koffie? / - dub? / dub! To test dub? / stui! : go to state 5 by : dub? koffie? stui?

© Ed Brinksma/Jan Tretmans TT 2004, FSM 18 FSM Transition Testing koffie? / stui? / - dub? / stui! koffie? / koffie! stui? / stui! dub? / - koffie? / - dub? / dub! To test dub? / stui! : go to state 5 by : dub? koffie? stui? give input dub? check output stui! verify that machine is in state 10

© Ed Brinksma/Jan Tretmans TT 2004, FSM 19 FSM Transition Testing lState identification and verification : lApply sequence of inputs in the current state of the FSM such that from the outputs we can nidentify that state where we started; or nverify that we were in a particular start state lDifferent kinds of sequences nUIO sequences ( Unique Input Output sequence, SIOS) nDistinguishing sequence ( DS ) nW - set ( characterizing set of sequences ) nUIOv nSUIOSingle UIO nMUIOMultiple UIO nOverlapping UIO

© Ed Brinksma/Jan Tretmans TT 2004, FSM 20 FSM Transition Testing lState verification : lUIO sequences nsequence x that distinguishes state s from all other states : for all t  s : ( s, x )  ( t, x ) neach state has its own UIO sequence nUIO sequences may not exist lDistinguishing sequence nsequence x that produces different output for each state : for all pairs t, s with t  s : ( s, x )  ( t, x ) na distinguishing sequence may not exist lW - set of sequences nset of sequences W which can distinguish any pair of states : for all pairs t  s there is x  W : ( s, x )  ( t, x ) nW - set always exists for reduced FSM

© Ed Brinksma/Jan Tretmans TT 2004, FSM 21 FSM Transition Testing UIO sequences stui? / - dub? / stui! koffie? / koffie! stui? / stui! dub? / - koffie? / - dub? / dub! state 0 : stui? / - koffie? / - state 5 : dub? / stui! state 10:koffie? / koffie!

© Ed Brinksma/Jan Tretmans TT 2004, FSM 22 FSM Transition Testing DS sequence stui? / - dub? / stui! koffie? / koffie! stui? / stui! dub? / - koffie? / - dub? / dub! DS sequence : dub?output state 0 :- output state 5 :stui! output state 10 :dub!

© Ed Brinksma/Jan Tretmans TT 2004, FSM 23 FSM Transition Testing koffie? / stui? / - dub? / stui! koffie? / koffie! stui? / stui! dub? / - koffie? / - dub? / dub! To test dub? / stui! : Test case : dub? / * koffie? / * stui? / - dub? / stui! koffie? / koffie! go to state 5 : dub? koffie? stui? give input dub? check output stui! Apply UIO of state 10 : koffie? / koffie!

© Ed Brinksma/Jan Tretmans TT 2004, FSM 24 FSM Transition Testing - 9 transitions / test cases for coffee machine - if end-state of one corresponds with start-state of next then concatenate - different ways to optimize and remove overlapping / redundant parts - there are (academic) tools to support this stui? / - dub? / stui! koffie? / koffie! stui? / stui! dub? / - koffie? / - dub? / dub!

© Ed Brinksma/Jan Tretmans TT 2004, FSM 25 FSM Transition Testing lTest transition : nGo to state S1 nApply input a? nCheck output x! nVerify state S2 lChecks every output fault and transfer fault (to existing state) lIf we assume that the number of states of the implementation machine MI is less than or equal to the number of states of the specification machine to MS. then testing all transitions in this way leads to equivalence of reduced machines, i.e., complete conformance

© Ed Brinksma/Jan Tretmans TT 2004, FSM 26 FSM: variations on this theme lthere exists many variations on this theme: nMoore machines: output determined by state instead of transition nInfinite state machines: infinite number of states (e.g. state contains variable) nNon-deterministic FSM: transition relation instead of transition function Labelled Transition Systems - ioco n...

© Ed Brinksma/Jan Tretmans TT 2004, FSM 27 FSM: Moore machines lMealy Machine is 5-tuple: M = ( S, I, O, , ) nSfinite set of states nIfinite set of inputs nOfinite set of outputs n  : S x I  Stransfer function n : S x I  Ooutput function lMoore Machine is 5-tuple: M = ( S, I, O, , ) nSfinite set of states nIfinite set of inputs nOfinite set of outputs n  : S x I  Stransfer function n : S  Ooutput function, not dependent of input lusually we add an initial state

© Ed Brinksma/Jan Tretmans TT 2004, FSM 28 Coffee Machine: Mealy model stui? / - dub? / stui! koffie? / koffie! stui? / stui! dub? / - koffie? / - dub? / dub!

© Ed Brinksma/Jan Tretmans TT 2004, FSM 29 Coffee Machine: Moore model 0/ /- 5/- stui? dub? koffie? stui? dub? koffie? dub? K/koffie! /10! 10 5 /5! dub? koffie? stui? koffie? stui?

© Ed Brinksma/Jan Tretmans TT 2004, FSM 30 Moore Coffee Machine : State Table State K output---5!10!koffie! Input stui? dub? koffie? KKK0 lCompared to Mealy machine: nmore states nsimpler output function (not dependent on input) lchanges hardly anything for testing

© Ed Brinksma/Jan Tretmans TT 2004, FSM 31 Infinite - State Machines lStates :data structures / data bases lInputs ( “triggers”) :operations on data bases lTransitions :new data base states lOutputs :results of queries outputinput state new state

© Ed Brinksma/Jan Tretmans TT 2004, FSM 32 State Machine : FSM Model lFSM - Finite State Machine - or Mealy Machine is 5-tuple lM = ( S, I, O, , ) nSfinite set of states nIfinite set of inputs nOfinite set of outputs n  : S x I  Stransfer function n : S x I  Ooutput function nNatural extension to sequences :  : S x I*  S : S x I*  O*

© Ed Brinksma/Jan Tretmans TT 2004, FSM 33 Infinite State Machine Testing lNot all transitions can be tested ….. lBut principle remains the same : test transitions nGo to start state of transition nApply input nCheck output nVerify result state lUse selection techniques to select transitions / start states nequivalence partitioning nboundary value analysis n……... state inputoutput new state

© Ed Brinksma/Jan Tretmans TT 2004, FSM 34 FSM Testing vs. InfSM Testing lRestrictions on FSM: ndeterministic ncompleteness lFSM has always alternation between input and output lDifficult to specify interleaving in FSM lFSM is not compositional lFSM has “more intuitive” theory lFSM test suite is complete -- but only w.r.t. assumption on number of states lFSM test theory has been around for a number of years