Monterey Workshop, Chicago, September 2003 in cooperation with Hubert Baumeister and Alexander Knapp Techniques for Improving Test-Driven Design Martin Wirsing LMU München

M. Wirsing: Techniques for Improving Test-Driven Design Test-Driven Design Test scenarios act as (partial) specifications and drive the design of programs Extreme Programming - test for program design Use cases serve as basis for test scenarios OOSE - informal use cases (Jacobson, early 90’ties) FOOSE - formalized use cases (W, Knapp, 97)

M. Wirsing: Techniques for Improving Test-Driven Design Property-Driven Design Improve on Test-Driven Design by Joint development of test / formal spec / model Executable models Immediate feedback Automatic tests Properties Basis for verification and improvement of testing Verification through model checking (and theorem proving) Refinement/Abstraction Adding/Deleting functionality and details Refactoring

M. Wirsing: Techniques for Improving Test-Driven Design Contents Property-driven Development Development approach Case study: A Multi User Dungeon Game

M. Wirsing: Techniques for Improving Test-Driven Design Property-Driven Design: Construction & Validation Techniques Model Use Case Scenario Property extract & generalize Abstracted Model verify (model check) detail Instrumented Model test assertions implements construct Iterated development guided by user stories/use cases

M. Wirsing: Techniques for Improving Test-Driven Design Case Study: Multi User Dungeon Game Game Rules The player moves through the rooms until he finds the Special Room. He can see the other players, trade objects, talk and fight with other players in the same room Start RoomSpecial Room Distributed game played via mobile phones Provided by phone company

M. Wirsing: Techniques for Improving Test-Driven Design Develop Use Cases for the MUD Game MUD Player look other players move to room Use Case Development trade personal object...

M. Wirsing: Techniques for Improving Test-Driven Design Develop Scenarios for trade Use Case offer(mask) Scenario Development offer(book) closeTrade()cancelTrade() offer(mask) offer(book) p1:Playe r p2:Playe r has(mask)has(book) unsuccessful trade successful trade p1:Playe r p2:Playe r has(mask)has(book) successTrade has(mask) assert has(mask) !successTrade has(book) assert

M. Wirsing: Techniques for Improving Test-Driven Design Construct Class Diagram and Derive Invariants and Pre-/Post Conditions 0..*0..1 > PersonalObject move(Room) offer(PersObj o, Player to) closeTrade() cancelTrade()... post: to.lastOffer.object = o and to.lastOffer.player = self inv: has  forAll(pObj | pObj.player = self ) has inv: player != null implies player.has  includes( self ) Property Extraction > Player Offer lastOffer object Last offer obtained from another player

M. Wirsing: Techniques for Improving Test-Driven Design Define State Diagrams for players and environment Construct State Diagrams and Define Properties waitingreceivedOffer offer(o,to)/ p._recOffer(o,this) closeTrade()/ p._closeTrade() successTrade=true has.add(lastOffer.object) p._del(lastOffer.object) offer(o,from)/ p._recOffer(o,from) _recOffer(o,from)/ u.offer(o,from) _cancelTrade()/ u.cancelTrade() successTrade=false _closeTrade()/ u.closeTrade() has.add(lastOffer.object) p._del(lastOffer.object) cancelTrade()/ p._cancelTrade() successTrade=false _cancelTrade()/ u.cancelTrade() successTrade=false Modelling Define safety and lifeness properties: No Deadlock Players agree on the outcome of a trade : p1.waiting and p2.waiting implies p1.successTrade = p2.successTrade... Property Extraction

M. Wirsing: Techniques for Improving Test-Driven Design has(book) successTrade has(mask) Validation I: All Tests are Successful… offer(mask) offer(book) closeTrade() p1:Playe r p2:Playe r has(mask)has(book) assert Test Validation & Refactoring

M. Wirsing: Techniques for Improving Test-Driven Design Model checking gives: No Deadlock, but we get... Construct homomorphic abstraction of state diagrams Validation II: Model Checking waitingreceivedOffer offer(o,to)/ p._recOffer(o,this) closeTrade()/ p._closeTrade() successTrade=true has.add(lastOffer.object) p._del(lastOffer.object) offer(o,from)/ p._recOffer(o,from) _recOffer(o,from)/ u.offer(o,from) _cancelTrade()/ u.cancelTrade() successTrade=false _closeTrade()/ u.closeTrade() has.add(lastOffer.object) p._del(lastOffer.object) cancelTrade()/ p._cancelTrade() successTrade=false _cancelTrade()/ u.cancelTrade() successTrade=false Validation & Refactoring a counterexample: Players may not agree on the outcome of a trade

M. Wirsing: Techniques for Improving Test-Driven Design Error found by testing Assertion checking shows source of error in closeTrade closeTrade() offer(mask) offer(book) p1:Playe r p2:Playe r has(mask)has(book) assert successTrade has(book)has(mask) Revising the Test and Testing Without and With Assertions successTrade Validation & Refactoring Additional test Test Add additional check for successTrade Run test again Run test with assertions

M. Wirsing: Techniques for Improving Test-Driven Design Revise State Diagrams waitingreceivedOffer offer(o,to)/ p._recOffer(o,this) closeTrade()/ p._closeTrade() successTrade=true has.add(lastOffer.object) p._del(lastOffer.object) offer(o,from)/ p._recOffer(o,from) _recOffer(o,from)/ u.offer(o,from) _cancelTrade()/ u.cancelTrade() successTrade=false _closeTrade()/ u.closeTrade() has.add(lastOffer.object) p._del(lastOffer.object) successTrade=true cancelTrade()/ p._cancelTrade() successTrade=false _cancelTrade()/ u.cancelTrade() successTrade=false Error correction Validation & Refactoring Correct the state diagrams Validation yields: All tests successful! Model checking successful!

M. Wirsing: Techniques for Improving Test-Driven Design Validation Results of the MUD Game MUD Player look other players move to room trade personal object... Sequence and Activity Diagrams for Mobility Sequence and Activity Diagrams Sequence and State Diagrams Validation completed: All tests and checks successful! Validation & Refactoring

M. Wirsing: Techniques for Improving Test-Driven Design Tool Support Model Use Case Scenario Property extract & generalize detail Abstracted Model verify (model check) test Instrumented Model test assertions Hugo model checking and simulation (using SPIN and UPPAAL) JML assertions Testing with FitNesse and JUnit Test Scenario Editor (under develpt) Program

M. Wirsing: Techniques for Improving Test-Driven Design Summary and Challenges Property-Driven Design Joint development of formal properties and model Tests Formal specification Joint validation and verification Executable models (based on state/activity diagrams) Immediate feedback Allows to experiment with the system Tests/Specs + Refactoring = "Soft"ware Challenges Integrating interactive theorem proving Specification covering criteria Abstraction techniques