1. Natallia Kokash (Accepted for PACO’2011) ACG, 31/05/2011 1 Input-output conformance testing for channel-based connectors 1

2. Agenda ACG, 31/05/2011 2 Introduction Reo Semantics of Reo Automata-based Process algebra-based Input-output conformance (ioco) theory Using ioco to test Reo Tool support Related work Conclusions and future work

3. ACG, 31/05/2011 3 Introduction Reo is a channel-based coordination language Components or services are coordinated by Reo connectors Primitive connectors with just two ends are called channels Connectors can be composed to form more complex connectors Channels are user-defined Nodes implement a fixed routing policy

4. ACG, 31/05/2011 4 Constraint automata Constraint automaton A = (S, N, →, s 0 ) consists of a set of states S, a set of port names N, a transition relation → ⊆ S × 2 N × DC × S, where DC is the set of data constraints over a finite data domain Data, an initial state s 0 ∈ S. Two operators on CA are defined: product and port hiding A CA for a Reo connector can be computed as product of CA for individual channels.

5. ACG, 31/05/2011 5 Basic Reo channels and nodes

6. ACG, 31/05/2011 6 Constraint automata for basic channels and nodes

7. ACG, 31/05/2011 7 Process algebra mCRL2  Actions are atomic events  Processes are the active entities defined as expressions over actions and other processes  Multiaction: a|b (synchronized actions)  Alternative composition: a + b (nondeterministic choice)  Sequential composition: a.b (b started after a)  Conditional: exp → a ◊ b (if-then-else)  At operator: a c t (action a happens at time t)  Summation: ∑ d ∈ D a(d) (a(d 1 ) + a(d 2 ) + a(d 3 )…)  Parallel composition: a||b (interleavings a.b + b.a + a|b)  Renaming: ρ R (a) where R is a set of renamings of the form b → c, meaning that every occurrence of b in a is replaced by c  Hiding: τ H (a) renames all actions of H in a to τ  Restriction (allow): ∇ R (a) where R specifies which actions are allowed to occur in a  Blocking: ∂ B (a) where B is a set of actions that is not allowed to occur in a  Communication: Γ C (p), where C is a set of allowed communications of the form a 0 |...|a n → c, n ≥1 which means that every group of actions a 0 |...|a n within a multiaction is replaced by an action c

8. ACG, 31/05/2011 8 From CA to mCRL2 Data flow observed at a channel end = mCRL2 action

9. ACG, 31/05/2011 9 Correctness

10. ACG, 31/05/2011 10 Correctness

11. Why do we need testing for Reo? ACG, 31/05/2011 11 Circuit design is error-prone It is not a trivial task to design a Reo connector with a certain behavior Model-checking is not always feasible (e.g., data-aware models with infinite domains) When Reo is used for workflow and dataflow design, how do we assure the quality of workflow/dataflow implementations?

12. Specification: Reo ACG, 31/05/2011 12

13. Implementation: extension of BPEL ACG, 31/05/2011 13 <bpws:process exitOnStandardFault="yes" name="separation_of_duty_V_001“ suppressJoinFailure="yes" targetNamespace=http://www.iaas.uni-stuttgart.de/pf/separation_of_dutyhttp://www.iaas.uni-stuttgart.de/pf/separation_of_duty … …

14. ACG, 31/05/2011 14 Examples of wrong connector implementations

15. Input-output conformance theory ACG, 31/05/2011 15 Model-based testing aims at automatically generating test suits from software models J. Tretmans (2008): Model Based Testing with Labelled Transition Systems. In: Formal Methods and Testing, LNCS 4949, Springer, pp. 1–38. Formal, specification-based active, black-box, functionality testing

16. Labelled transition systems ACG, 31/05/2011 16

17. Language with LTS as operational semantics ACG, 31/05/2011 17

18. Sequences of observable actions ACG, 31/05/2011 18

19. Some definitions: tau-abstracted sequence of observable actions ACG, 31/05/2011 19

20. Some useful definitions ACG, 31/05/2011 20

21. LTL with Inputs/Outputs and Input-Output Transition Systems (IOTS) ACG, 31/05/2011 21

22. Input-output transition systems ACG, 31/05/2011 22 Two ways to convert LTL with I/O to IOTS: 1. Angelic completion: add self-loops to every reachable state 2. Demonic completion: add a chaos state χ such that all non-specified inputs lead to χ, once in χ any behavior is possible.

23. Quiescent and suspension traces ACG, 31/05/2011 23 Extend traces with observations of quiescence: Traces that can contain the quiescence action are called suspension traces:

24. Quiescence ACG, 31/05/2011 24 The occurrence of θ in a test indicates the detection of quiescence δ

25. Test case ACG, 31/05/2011 25 A tester should not offer more than one input at a time:

26. Examples of test cases ACG, 31/05/2011 26

27. The ioco relation ACG, 31/05/2011 27

28. Example ACG, 31/05/2011 28

29. Compositional testing ACG, 31/05/2011 29

30. Example ACG, 31/05/2011 30

31. Test execution ACG, 31/05/2011 31

32. Test generation ACG, 31/05/2011 32

33. Application of ioco to testing Reo Reo is a language with LTS semantics We can associate mCRL2 processes with each state of a Reo circuit {A,B,C} → A|B|C – a unique action (can be renamed e.g., to ABC) Extend CA/LTS with Input/Output actions Is Reo implementation input enabled? Specification: CA, implementation: Reo Specification: Reo, implementation: Reo Specification: Reo, implementation: BPEL, Java, etc. ACG, 31/05/2011 33

34. ACG, 31/05/2011 34 CA with Inputs and Outputs Encoding for boundary nodes:

35. Input/Output CA ACG, 31/05/2011 35 We can apply angelic completion to a CA with I/O without changing the functional behavior of the circuit it specifies Every boundary node A has associated Input and Output actions: A circuit cannot accept ?A through its input port A without observing !A An environment cannot observe !B on the circuit output port B before ?B What happens with pending requests if the circuit cannot process them?

36. ACG, 31/05/2011 36 Compositional testing for Reo

37. Tool support ACG, 31/05/2011 37 specification (s) Implementation (i)

38. ACG, 31/05/2011 38 Test case simulation

39. Related work ACG, 31/05/2011 39 B. K. Aichernig, F. Arbab, L. Astefanoaei, F. S. de Boer, M. Sun & J. Rutten: Fault-Based Test Case Generation for Component Connectors. In: Third IEEE International Symposium on Theoretical Aspects of Software Engineering, (2009), pp. 147–154. S. Meng, F. Arbab, B. K. Aichernig, L. A ş tef ă noaei, Frank S. de Boer, J. Rutten, “Connectors as designs: Modeling, refinement and test case generation,Science of Computer Programming, (2011). Considers connectors as designs A prototype tool for test case generation developed in Maude “An approach based on I/O FSM is not appropriate for generating test cases for connectors, since it assumes that a pair of input and output constitutes an atomic action of a system, in other words, that the system cannot accept the next input before producing the output in reaction to the previous input. In Reo, such assumptions do not hold.”

40. Future work ACG, 31/05/2011 40 Testing Java code generation for Reo Testing data-aware Reo: J. Tretmans L. Frantzen & T. A.C. Willemse (2005): Test Generation Based on Symbolic Speci fi cations. In J. Grabowski & B. Nielsen, editors: Proc. FATES 2004, LNCS 3395, Springer, pp. 1–15. Testing timed Reo: Brinksma E. Brandan Briones, L. (2005): A Test Generation Framework for quiescent Real-Time Systems. In J. Grabowski & B. Nielsen, editors: Proc. FATES 2004, LNCS 3395, Springer, pp. 64–78.