1. Testing functionality independent on history of system-environment interactions Study 2

2. Specifications Test sequence generator Specifications Test action iterator Test scenario Mediators on SeC Target system Test engine Оракул Oracle Медиатор Mediator Спецификации Specifications Specification development Mediator development Test scenario development Steps of test development using the tool:

3. Specification function trunc_spec specification mix_num trunc_spec(mix_num* mn) { pre { return mn->denom > 0 && ( mn->integral >= 0 && mn->num >= 0 || mn->integral num denom == @(mn->denom) && abs(mn->num) denom && mn->integral * mn->denom + mn->num == @(mn->integral) * @(mn->denom) + @(mn->num); } }

4. Specification function specification (,..., ) { pre {... } coverage {... } post {... } } signature body

5. Pointers as parameters of specification functions specification f( int* i, int* iarray ) {... if(*i == 0)...... if(iarray[3] != 0)...... }

6. ; * ; Specification types void* create(& _type,…); int compare(Object*,Object*); bool equal(Object*,Object*); void* copy(Object*,Object*); void* clone(Object*); String* toString(Object* ref) Integer, Double, Char, String, Set, List, Map

7. Definition of specification type specification typedef = {.init = pointer_to_initialization_function,.copy = pointer_to_finalization_function,.compare = pointer_to_comparing_function,.to_string = pointer_to_string_mapping_function,.enumerator = pointer_to_reference_counting_function,.destroy = pointer_to_destroying_function }; specification typedef = {}; specification typedef ;

8. Specification type MixNum int compare_MixNum(MixNum* left, MixNum* right) { int l = left->num * right->denom, r = right->num * left->denom; if(left->integral != 0) l += left->integral * right->denom * left->denom; if(right->integral != 0) r += right->integral * left->denom * right->denom; return l – r; } specification typedef mix_num MixNum = {.compare = (Compare)compare_MixNum };

9. Signature of specification function trunc_spec specification MixNum* trunc_spec(MixNum* mn);

10. Structure of a body of specification function specification ( ) { pre {... } coverage {... } post {... } }

11. pre { if(...) /* values of inputs meet precondition requirements */ return true; else return false; } specification (...) { pre { if(...) /* values of inputs meet precondition requirements */ return true; else return false; }... } Precondition outputs ( *arg, result ) Target system call inputs ( arg, *arg )

12. Precondition of specification function trunc_spec pre return mn->denum > 0 specification MixNum* trunc_spec(MixNum* mn) { pre { return mn->denum > 0 && ( mn->integral > 0 && mn->num > 0 && ( mn->integral > 0 && mn->num > 0 || mn->integral num integral num < 0 || mn->integral == 0 && mn->num == 0 ); || mn->integral == 0 && mn->num == 0 ); }... }

13. Type invariants /* invariant of C type */ invariant typedef ; invariant( value) { if(/* invariant are held for the value of value */) return true; else return false; } /* invariant of specification type */ invariant specification typedef = {...}; invariant( *r) {...}

14. invariant( value); invariant( value); specification ( * arg) { pre {...} coverage {...} post {...} } Automatic checking invariants for specification function arguments outputs ( *arg, result ) Target system call inputs ( arg, *arg ) Prevalues Postvalues invariant(*arg); invariant(*arg); invariant( );

15. Invariant of specification type MixNum invariant specification typedef mix_num MixNum; invariant(MixNum* mn) { return mn->denum > 0 && ( mn->integral >= 0 && mn->num >= 0 || mn->integral num integral == 0 && mn->num == 0 ); } pre return mn->denum >0 && ( mn->integral >= 0 && mn->num >= 0 || mn->integral num denum >0 && ( mn->integral >= 0 && mn->num >= 0 || mn->integral num <= 0 || mn->integral == 0 && mn->num == 0 ); || mn->integral == 0 && mn->num == 0 ); }... }

16. Coverage criteria coverage {... if(...) /* with given values of arguments the functionality branch is covered */ return {, };... } specification (...) { pre {...} coverage {... if(...) /* with given values of arguments the functionality branch is covered */ return {, };... } post {...} } outputs ( *arg, result ) Target system call inputs ( arg, *arg )

17. Coverage criteria completeness coverage С { if(...) /* Condition 1 */ return { BRANCH_1, "1 st branch" }; else if(...) /* Condition 2 */... else return { LAST_BRANCH, "Last branch" }; } Any set of argument prevalues should belong to one of functionality branches defined be coverage criteria

18. Coverage criterion of specification function trunc_spec coverage С { if(mn->integral == 0 && mn->denom > mn->num) return {PROP_FRACT, "Proper fraction"}; if(mn->integral == 0 && mn->denom num) return {IMPROP_FRACT, "Improper fraction"}; if(mn->integral != 0 && mn->denom > mn->num) return {PROP_MIXED, "Proper mixed number"}; else/*(mn->integral!=0 && mn->denom num)*/ return {IMPROP_MIXED, "Improper mixed number"}; } specification MixNum* trunc_spec(MixNum* mn) { coverage С { if(mn->integral == 0 && mn->denom > mn->num) return {PROP_FRACT, "Proper fraction"}; if(mn->integral == 0 && mn->denom num) return {IMPROP_FRACT, "Improper fraction"}; if(mn->integral != 0 && mn->denom > mn->num) return {PROP_MIXED, "Proper mixed number"}; else/*(mn->integral!=0 && mn->denom num)*/ return {IMPROP_MIXED, "Improper mixed number"}; }... }

19. Postcondition post { if(...) /* values of outputs meet postcondition requirements */ return true; else return false; } specification (...) { pre {...} coverage {... } post { if(...) /* values of outputs meet postcondition requirements */ return true; else return false; } } point of affecting outputs ( *arg, result ) Target system call inputs ( arg, *arg )

20. Prevalues of arguments and returned result in poctcondition specification int func(int *u) { post { return @(*u) != 0 && func == *u } } outputs ( *arg, result ) Target system call inputs ( arg, *arg )

21. Postcondition of specification function trunc_spec post { return trunc_spec->integral == mn->integral && trunc_spec->denom == mn->denom && trunc_spec->num == mn->num /* !memcmp(trunc_spec, mn) */ && mn->denom == @mn->denom && abs(mn->num) denum && equal(mn, @mn); } specification MixNum* trunc_spec(MixNum* mn) { coverage С { if(mn->integral == 0 && mn->denom > mn->num) return {PROP_FRACT, "Proper fraction"}; if(mn->integral == 0 && mn->denom num) return {IMPROP_FRACT, "Improper fraction"}; if(mn->integral != 0 && mn->denom > mn->num) return {PROP_MIXED, "Proper mixed number"}; if(mn->integral != 0 && mn->denom num) return {IMPROP_MIXED, "Improper mixed number"}; } post { return trunc_spec->integral == mn->integral && trunc_spec->denom == mn->denom && trunc_spec->num == mn->num /* !memcmp(trunc_spec, mn) */ && mn->denom == @mn->denom && abs(mn->num) denum && equal(mn, @mn); } }

22. Mediators Test sequence generator Specifications Test action iterator Test scenario Mediators on SeC Target system Test engine Оракул Oracle Медиатор Mediator Specification development Mediator development Test scenario development Steps of test development using the tool: Mediators on SeC

23. Definition of mediators on SeC mediator for specification ( ) { call { /* map specification args to implementation ones */... if(.../* if something wrong */) setBadVerdict( ); /* implementation call */... /* map implementation results to specification ones */... if(.../* if something wrong */) setBadVerdict( ); return ; } }

24. Mediatorof specification function trunc_spec mediator trunc_media for specification MixNum* trunc_spec(MixNum* mn) { call { mix_num imn, res; imn.entire = mn->integral; imn.num = mn->num; imn.denom = mn->denom; res = trunc(&imn); mn->integral = imn.entire; mn->num = imn.num; mn->denom = imn.denom; return create(&MixNum_type, res.entire,res.num,res.denom); } }

25. Test sequence generator Scenarios Test scenario Scenario Specifications Mediators on SeC Target system Оракул Oracle Медиатор Mediator Specification development Mediator development Test scenario development Steps of test development using the tool: Test action iterator Test engine

26. Scenario definition scenario dfsm = {.init =,.actions = {,..., NULL },.finish = } set_coverage_ ( );

27. Scenario functions scenario bool () {... ( );... return ; }

28. Operator iterate scenario bool () {... iterate( ; ; ; ) { }... return ; } =

29. Control flow in scenario function scenario bool () {... iterate( ; ; ; ) {... }... return ; } Test engine

30. Scenario of specification function trunc_spec bool trunc_scen_init (int argc, char **argv) { set_mediator_trunc_spec (trunc_media); return true; } scenario bool trunc_sf () { iterate (int i = -10; i = 0) iterate (int denom = 1; denom <= 10; denom++;) { MixNum mn = create(&MixNum_type, res.entire, res.num, res.denom); trunc_spec (mn); } return true; } scenario dfsm trunc_scen = {.init = trunc_scen_init,.actions = { trunc_sf, NULL } };

31. Function main, starting scenario int main(int argc, char** argv) { ( argc, argv ); }

32. Function main of test for function trunc int main(int argc, char **argv) { trunc_scen(argc, argv); }