Model-Based test

Model-Based Testing for

Embedded Systems


Embedded Systems

EDITED BY Justyna Zander, Ina Schieferdecker, and Pieter J. MostermanK10969

ELECTRICAL ENGINEERING

What the experts have to say about Model-Based Testing for Embedded SystemsThis book is exactly what is needed at the exact right time in this fast-growing area. From its beginnings over 10 years ago of deriving tests from UML statecharts, model-based testing has matured into a topic with both breadth and depth. Testing embedded systems is a natural application of MBT, and this book hits the nail exactly on the head. Numerous topics are presented clearly, thoroughly, and concisely in this cutting-edge book. The authors are world-class leading experts in this area and teach us well-used and validated techniques, along with new ideas for solving hard problems.

It is rare that a book can take recent research advances and present them in a form ready for practical use, but this book accomplishes that and more. I am anxious to recommend this in my consulting and to teach a new class to my students.

DR. JEFF OFFUTT, Professor of Software Engineering, George Mason University, Fairfax, Virginia, USA

This handbook is the best resource I am aware of on the automated testing of embedded systems. It is thorough, comprehensive, and authoritative. It covers all important technical and scientific aspects but also provides highly interesting insights into the state of practice of model-based testing for embedded systems.

DR. LIONEL C. BRIAND, IEEE Fellow, Simula Research Laboratory, Lysaker, Norway, and Professor at the University of Oslo, Norway

As model-based testing is entering the mainstream, such a comprehensive and intelligible book is a must-read for anyone looking for more information about improved testing methods for embedded systems. Illustrated with numerous aspects of these techniques from many contributors, it gives a clear picture of what the state of the art is today.

DR. BRUNO LEGEARD, CTO of Smartesting, Professor of Software Engineering at the University of Franche-Comt, Besanon, France, and coauthor of Practical Model-Based Testing

Zander Schieferdecker

Mosterman

Model-Based Testing for Em

bedded Systems

K10969_Cover_mech.indd 1 8/15/11 3:33 PM


Embedded Systems

Computational Analysis, Synthesis,and Design of Dynamic Systems Series

Series Editor

Pieter J. MostermanMathWorks

Natick, Massachusetts

McGill UniversityMontral, Qubec

Discrete-Event Modeling and Simulation: A Practitioners Approach,Gabriel A. Wainer

Discrete-Event Modeling and Simulation: Theory and Applications,edited by Gabriel A. Wainer and Pieter J. Mosterman

Model-Based Design for Embedded Systems,edited by Gabriela Nicolescu and Pieter J. Mosterman

Model-Based Testing for Embedded Systems,edited by Justyna Zander, Ina Schieferdecker, and Pieter J. Mosterman

Multi-Agent Systems: Simulation and Applications,edited by Adelinde M. Uhrmacher and Danny Weyns

Forthcoming Titles:

Computation for Humanity: Information Technology to Advance Society,edited by Justyna Zander and Pieter J. Mosterman

Real-Time Simulation Technologies: Principles, Methodologies, and Applications,edited by Katalin Popovici and Pieter J. Mosterman

CRC Press is an imprint of theTaylor & Francis Group, an informa business

Boca Raton London New York


Embedded Systems

EDITED BY Justyna Zander, Ina Schieferdecker, and Pieter J. Mosterman

MATLAB is a trademark of The MathWorks, Inc. and is used with permission. The MathWorks does not warrant the accuracy of the text or exercises in this book. This books use or discussion of MATLAB software or related products does not consti-tute endorsement or sponsorship by The MathWorks of a particular pedagogical approach or particular use of the MATLAB software.

CRC PressTaylor & Francis Group6000 Broken Sound Parkway NW, Suite 300Boca Raton, FL 33487-2742

2012 by Taylor & Francis Group, LLCCRC Press is an imprint of Taylor & Francis Group, an Informa business

No claim to original U.S. Government worksVersion Date: 20110804

International Standard Book Number-13: 978-1-4398-1847-3 (eBook - PDF)

This book contains information obtained from authentic and highly regarded sources. Reasonable efforts have been made to publish reliable data and information, but the author and publisher cannot assume responsibility for the validity of all materials or the consequences of their use. The authors and publishers have attempted to trace the copyright holders of all material repro-duced in this publication and apologize to copyright holders if permission to publish in this form has not been obtained. If any copyright material has not been acknowledged please write and let us know so we may rectify in any future reprint.

Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced, transmitted, or utilized in any form by any electronic, mechanical, or other means, now known or hereafter invented, including photocopying, microfilming, and recording, or in any information storage or retrieval system, without written permission from the publishers.

For permission to photocopy or use material electronically from this work, please access www.copyright.com (http://www.copy-right.com/) or contact the Copyright Clearance Center, Inc. (CCC), 222 Rosewood Drive, Danvers, MA 01923, 978-750-8400. CCC is a not-for-profit organization that provides licenses and registration for a variety of users. For organizations that have been granted a photocopy license by the CCC, a separate system of payment has been arranged.

Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are used only for identifica-tion and explanation without intent to infringe.Visit the Taylor & Francis Web site athttp://www.taylorandfrancis.comand the CRC Press Web site athttp://www.crcpress.com

Contents

Preface ix

Editors xi

MATLAB Statement xiv

Contributors xv

Technical Review Committee xix

Book Introduction xxi

Part I Introduction

1 A Taxonomy of Model-Based Testing for Embedded Systemsfrom Multiple Industry Domains 3Justyna Zander, Ina Schieferdecker, and Pieter J. Mosterman

2 Behavioral System Models versus Models of Testing Strategiesin Functional Test Generation 23Antti Huima

3 Test Framework Architectures for Model-Based EmbeddedSystem Testing 49Stephen P. Masticola and Michael Gall

Part II Automatic Test Generation

4 Automatic Model-Based Test Generation from UML State Machines 77Stephan Weileder and Holger Schlinglo

5 Automated Statistical Testing for Embedded Systems 111Jesse H. Poore, Lan Lin, Robert Eschbach,and Thomas Bauer

6 How to Design Extended Finite State Machine Test Models in Java 147Mark Utting

7 Automatic Testing of LUSTRE/SCADE Programs 171Virginia Papailiopoulou, Besnik Seljimi, and Ioannis Parissis

8 Test Generation Using Symbolic Animation of Models 195Frederic Dadeau, Fabien Peureux, Bruno Legeard, Regis Tissot,Jacques Julliand, Pierre-Alain Masson, and Fabrice Bouquet

v

vi Contents

Part III Integration and Multilevel Testing

9 Model-Based Integration Testing with CommunicationSequence Graphs 223Fevzi Belli, Axel Hollmann, and Sascha Padberg

10 A Model-Based View onto Testing: Criteria for the Derivationof Entry Tests for Integration Testing 245Manfred Broy and Alexander Pretschner

11 Multilevel Testing for Embedded Systems 269Abel Marrero Perez and Stefan Kaiser

12 Model-Based X-in-the-Loop Testing 299Jurgen Gromann, Philip Makedonski, Hans-Werner Wiesbrock,Jaroslav Svacina, Ina Schieferdecker, and Jens Grabowski

Part IV Specic Approaches

13 A Survey of Model-Based Software Product Lines Testing 339Sebastian Oster, Andreas Wubbeke, Gregor Engels, and Andy Schurr

14 Model-Based Testing of Hybrid Systems 383Thao Dang

15 Reactive Testing of Nondeterministic Systems by Test Purpose-Directed Tester 425Juri Vain, Andres Kull, Marko Kaaramees, Maili Markvardt,and Kullo Raiend

16 Model-Based Passive Testing of Safety-Critical Components 453Stefan Gruner and Bruce Watson

Part V Testing in Industry

17 Applying Model-Based Testing in the Telecommunication Domain 487Fredrik Abbors, Veli-Matti Aho, Jani Koivulainen, Risto Teittinen,and Dragos Truscan

18 Model-Based GUI Testing of Smartphone Applications:Case S60TM and Linux 525Antti Jaaskelainen, Tommi Takala, and Mika Katara

19 Model-Based Testing in Embedded Automotive Systems 545Pawel Skruch, Miroslaw Panek, and Bogdan Kowalczyk

Part VI Testing at the Lower Levels of Development

20 Testing-Based Translation Validation of Generated Code 579Mirko Conrad

Contents vii

21 Model-Based Testing of Analog Embedded Systems Components 601Lee Barford

22 Dynamic Verication of SystemC Transactional Models 619Laurence Pierre and Luca Ferro

Index 639

This page intentionally left blankThis page intentionally left blank

Preface

The ever-growing pervasion of software-intensive systems into technical, business, and socialareas not only consistently increases the number of requirements on system functionalityand features but also puts forward ever-stricter demands on system quality and reliability.In order to successfully develop such software systems and to remain competitive on top ofthat, early and continuous consideration and assurance of system quality and reliability arebecoming vitally important.

To achieve eective quality assurance, model-based testing has become an essential ingre-dient that covers a broad spectrum of concepts, including, for example, automatic test gen-eration, test execution, test evaluation, test control, and test management. Model-basedtesting results in tests that can already be utilized in the early design stages and that con-tribute to high test coverage, thus providing great value by reducing cost and risk. Theseobservations are a testimony to both the eectiveness and the eciency of testing that canbe derived from model-based approaches with opportunities for better integration of systemand test development.

Model-based test activities comprise dierent methods that are best applied comple-menting one another in order to scale with respect to the size and conceptual complexityof industry systems. This book presents model-based testing from a number of dierentperspectives that combine various aspects of embedded systems, embedded software, theirmodels, and their quality assurance. As system integration has become critical to dealingwith the complexity of modern systems (and, indeed, systems of systems), with softwareas the universal integration glue, model-based testing has come to present a persuasivevalue proposition in system development. This holds, in particular, in the case of het-erogeneity such as components and subsystems that are partially developed in softwareand partially in hardware or that are developed by dierent vendors with o-the-shelfcomponents.

This book provides a collection of internationally renowned work on current technologicalachievements that assure the high-quality development of embedded systems. Each chaptercontributes to the currently most advanced methods of model-based testing, not in the leastbecause the respective authors excel in their expertise in system verication and validation.Their contributions deliver supreme improvements to current practice both in a qualitativeas well as in a quantitative sense, by automation of the various test activities, exploitationof combined model-based testing aspects, integration into model-based design process, andfocus on overall usability. We are thrilled and honored by the participation of this selectgroup of experts. They made it a pleasure to compile and edit all of the material, and wesincerely hope that the reader will nd the endeavor of intellectual excellence as enjoyable,gratifying, and valuable as we have.

In closing, we would like to express our genuine appreciation and gratitude for all thetime and eort that each author has put into his or her chapter. We gladly recognize thatthe high quality of this book is solely thanks to their common eort, collaboration, andcommunication. In addition, we would like to acknowledge the volunteer services of thosewho joined the technical review committee and to extend our genuine appreciation fortheir involvement. Clearly, none of this would have been possible had it not been for the

ix

x Preface

continuous support of Nora Konopka and her wonderful team at Taylor & Francis. Manythanks to all of you! Finally, we would like to gratefully acknowledge support by the AlfriedKrupp von Bohlen und Halbach Stiftung.

Justyna ZanderIna Schieferdecker

Pieter J. Mosterman

Editors

Justyna Zander is a postdoctoral research scientist at Harvard University (HarvardHumanitarian Initiative) in Cambridge, Massachusetts, (since 2009) and project managerat the Fraunhofer Institute for open communication systems in Berlin, Germany (since2004).

She holds a PhD (2008) and an MSc (2005), both in the elds of computer scienceand electrical engineering from Technical University Berlin in Germany, a BSc (2004) incomputer science, and a BSc in environmental protection and management from GdanskUniversity of Technology in Poland (2003).

She graduated from the Singularity University, Mountain View, California, as one of40 participants selected from 1200 applications in 2009. For her scientic eorts, Dr. Zanderreceived grants and scholarships from institutions such as the Polish Prime Ministry (19992000), the Polish Ministry of Education and Sport (20012004), which is awarded to0.04% students in Poland, the German Academic Exchange Service (2002), the EuropeanUnion (20032004), the Hertie Foundation (20042005), IFIP TC6 (2005), IEEE (2006),Siemens (2007), Metodos y Tecnologia (2008), Singularity University (2009), and FraunhoferGesellschaft (20092010). Her doctoral thesis on model-based testing was supported by theGerman National Academic Foundation with a grant awarded to 0.31% students in Germany(20052008).

xi

xii Editors

Ina Schieferdecker studied mathematical computer science at Humboldt-UniversityBerlin and earned her PhD in 1994 at Technical University Berlin on performance-extendedspecications and analysis of quality-of-service characteristics. Since 1997, she has headedthe Competence Center for Testing, Interoperability and Performance (TIP) at the Fraun-hofer Institute on Open Communication Systems (FOKUS), Berlin, and now heads theCompetence Center Modelling and Testing for System and Service Solutions (MOTION).

She has been a professor on engineering and testing of telecommunication systems atTechnical university Berlin since 2003.

Professor Schieferdecker has worked since 1994 in the area of design, analysis, testing,and evaluation of communication systems using specication-based techniques such as uni-ed modeling language, message sequence charts, and testing and test control notation(TTCN-3). Professor Schieferdecker has written many scientic publications in the areaof system development and testing. She is involved as editorial board member with theInternational Journal on Software Tools for Technology Transfer. She is a cofounder of theTesting Technologies IST GmbH, Berlin, and a member of the German Testing Board. In2004, she received the Alfried Krupp von Bohlen und Halbach Award for Young Professors,and she became a member of the German Academy of Technical Sciences in 2009. Herwork on this book was partially supported by the Alfried Krupp von Bohlen und HalbachStiftung.

Editors xiii

Pieter J. Mosterman is a senior research scientist at MathWorks in Natick,Massachusetts, where he works on core Simulink r simulation and code generation technolo-gies, and he is an adjunct professor at the School of Computer Science of McGill University.Previouly, he was a research associate at the German Aerospace Center (DLR) in Oberpfaf-fenhofen. He has a PhD in electrical and computer engineering from Vanderbilt Universityin Nashville, Tennessee, and an MSc in electrical engineering from the University of Twente,the Netherlands. His primary research interests are in Computer Automated MultiparadigmModeling (CAMPaM) with principal applications in design automation, training systems,and fault detection, isolation, and reconguration. He designed the Electronics LaboratorySimulator, nominated for the Computerworld Smithsonian Award by Microsoft Corporationin 1994. In 2003, he was awarded the IMechE Donald Julius Groen Prize for a paper onHyBrSim, a hybrid bond graph modeling and simulation environment. Professor Moster-man received the Society for Modeling and Simulation International (SCS) DistinguishedService Award in 2009 for his services as editor-in-chief of SIMULATION: Transactions ofSCS. He is or has been an associate editor of the International Journal of Critical ComputerBased Systems, the Journal of Defense Modeling and Simulation, the International Jour-nal of Control and Automation, Applied Intelligence, and IEEE Transactions on ControlSystems Technology.

MATLAB Statement

MATLAB r is a registered trademark of The MathWorks, Inc. For product information,please contact:

The MathWorks, Inc.3 Apple Hill DriveNatick, MA 01760-2098 USATel: 508 647 7000Fax: 508-647-7001E-mail: [email protected]: www.mathworks.com

xiv

Contributors

Fredrik AbborsDepartment of Information TechnologiesAbo Akademi UniversityTurku, Finland

Veli-Matti AhoProcess ExcellenceNokia Siemens NetworksTampere, Finland

Lee BarfordMeasurement Research LaboratoryAgilent TechnologiesReno, NevadaandDepartment of Computer

Science and EngineeringUniversity of NevadaReno, Nevada

Thomas BauerFraunhofer Institute for Experimental

Software Engineering (IESE)Kaiserslautern, Germany

Fevzi BelliDepartment of Electrical Engineering

and Information TechnologyUniversity of PaderbornPaderborn, Germany

Fabrice BouquetComputer Science DepartmentUniversity of Franche-Comte/INRIA

CASSIS ProjectBesancon, France

Manfred BroyInstitute for Computer ScienceTechnische Universitat MunchenGarching, Germany

Mirko ConradThe MathWorks, Inc.Natick, Massachusetts

Frederic DadeauComputer Science DepartmentUniversity of Franche-Comte/INRIA

CASSIS ProjectBesancon, France

Thao DangVERIMAG CNRS (French National

Center for Scientic Research)Gieres, France

Gregor EngelsSoftware Quality Labs-labUniversity of PaderbornPaderborn, Germany

Robert EschbachFraunhofer Institute for Experimental

Software Engineering (IESE)Kaiserslautern, Germany

Luca FerroTIMA LaboratoryUniversity of Grenoble, CNRSGrenoble, France

Michael GallSiemens Industry, Inc.Building Technologies DivisionFlorham Park, New Jersey

Jens GrabowskiInstitute for Computer ScienceUniversity of GoettingenGoldschmidtstrae 7Goettingen, Germany

xv

xvi Contributors

Jurgen GromannFraunhofer Institute FOKUSKaiserin-Augusta-Allee 31Berlin, Germany

Stefan GrunerDepartment of Computer ScienceUniversity of PretoriaPretoria, Republic of South Africa

Axel HollmannDepartment of Applied Data TechnologyInstitute of Electrical and Computer

EngineeringUniversity of PaderbornPaderborn, Germany

Antti HuimaPresident and CEOConformiq-Automated Test DesignSaratoga, California

Antti JaaskelainenDepartment of Software SystemsTampere University of TechnologyTampere, Finland

Jacques JulliandComputer Science DepartmentUniversity of Franche-ComteBesancon, France

Marko KaarameesDepartment of Computer ScienceTallinn University of TechnologyTallinn, Estonia

Stefan KaiserFraunhofer Institute FOKUSBerlin, Germany

Mika KataraDepartment of Software SystemsTampere University of TechnologyTampere, Finland

Jani KoivulainenConformiq Customer SuccessConformiqEspoo, Finland

Bogdan KowalczykDelphi Technical Center Krakowul. Podgorki Tynieckie 2Krakow, Poland

Andres KullELVIORTallinn, Estonia

Bruno LegeardResearch and DevelopmentSmartesting/University of Franche-ComteBesancon, France

Lan LinDepartment of Electrical Engineering

and Computer ScienceUniversity of TennesseeKnoxville, Tennessee

Philip MakedonskiInstitute for Computer ScienceUniversity of GoettingenGoldschmidtstrae 7Goettingen, Germany

Maili MarkvardtDepartment of Computer ScienceTallinn University of TechnologyTallinn, Estonia

Abel Marrero PerezDaimler Center for Automotive IT

InnovationsBerlin Institute of TechnologyBerlin, Germany

Pierre-Alain MassonComputer Science DepartmentUniversity of Franche-ComteBesancon, France

Stephen P. MasticolaSystem Test DepartmentSiemens Fire SafetyFlorham Park, New Jersey

Contributors xvii

Pieter J. MostermanMathWorks, Inc.Natick, MassachusettsandMcGill UniversitySchool of Computer ScienceMontreal, Quebec, Canada

Sebastian OsterReal-Time Systems LabTechnische Universitat DarmstadtDarmstadt, Germany

Sascha PadbergDepartment of Applied Data TechnologyInstitute of Electrical and Computer

EngineeringUniversity of PaderbornPaderborn, Germany

Miroslaw PanekDelphi Technical Center Krakowul. Podgorki Tynieckie 2Krakow, Poland

Virginia PapailiopoulouINRIARocquencourt, France

Ioannis ParissisGrenoble INPLaboratoire de Conception

et dIntegration des SystemesUniversity of GrenobleValence, France

Fabien PeureuxComputer Science DepartmentUniversity of Franche-ComteBesancon, France

Laurence PierreTIMA LaboratoryUniversity of Grenoble, CNRSGrenoble, France

Jesse H. PooreEricsson-Harlan D. Mills Chair in Software

EngineeringDepartment of Electrical

Engineering and Computer ScienceUniversity of TennesseeKnoxville, Tennessee

Alexander PretschnerKarlsruhe Institute of TechnologyKarlsruhe, Germany

Kullo RaiendELVIORTallinn, Estonia

Ina SchieferdeckerFraunhofer Institute FOKUSKaiserin-Augusta-Allee 31Berlin, Germany

Holger SchlingloFraunhofer Institute FIRSTKekulestraeBerlin, Germany

Andy SchurrReal-Time Systems LabTechnische Universitat DarmstadtDarmstadt, Germany

Besnik SeljimiFaculty of Contemporary Sciences and

TechnologiesSouth East European UniversityTetovo, Macedonia

Pawel SkruchDelphi Technical Center Krakowul. Podgorki Tynieckie 2Krakow, Poland

Jaroslav SvacinaFraunhofer Institute FIRSTKekulestraeBerlin, Germany

Tommi TakalaDepartment of Software SystemsTampere University of TechnologyTampere, Finland

xviii Contributors

Risto TeittinenProcess ExcellenceNokia Siemens NetworksEspoo, Finland

Regis TissotComputer Science DepartmentUniversity of Franche-ComteBesancon, France

Dragos TruscanDepartment of Information TechnologiesAbo Akademi UniversityTurku, Finland

Mark UttingDepartment of Computer ScienceUniversity of WaikatoHamilton, New Zealand

Juri VainDepartment of Computer Science/Institute

of CyberneticsTallinn University of TechnologyTallinn, Estonia

Bruce WatsonDepartment of Computer ScienceUniversity of PretoriaPretoria, Republic of South Africa

Stephan WeilederFraunhofer Institute FIRSTKekulestrae 7Berlin, Germany

Hans-Werner WiesbrockIT Power ConsultantsKolonnenstrae 26Berlin, Germany

Andreas WubbekeSoftware Quality Labs-labUniversity of PaderbornPaderborn, Germany

Justyna ZanderHarvard UniversityCambridge, MassachusettsandFraunhofer Institute FOKUSKaiserin-Augusta-Allee 31Berlin, Germany

Technical Review Committee

Lee Barford

Fevzi Belli

Fabrice Bouquet

Mirko Conrad

Frederic Dadeau

Thao Dang

Thomas Deiss

Vladimir Entin

Alain-Georges Vouo Feudjio

Gordon Fraser

Ambar Gadkari

Michael Gall

Jeremy Gardiner

Juergen Grossmann

Stefan Gruner

Axel Hollmann

Mika Katara

Bogdan Kowalczyk

Yves Ledru

Pascale LeGall

Jenny Li

Levi Lucio

Jose Carlos Maldonado

Eda Marchetti

Steve Masticola

Swarup Mohalik

Pieter J. Mosterman

Sebastian Oster

Jan Peleska

Abel Marrero Perez

Jesse H. Poore

Stacy Prowell

Holger Rendel

Axel Rennoch

Markus Roggenbach

Bernhard Rumpe

Ina Schieferdecker

Holger Schlinglo

Diana Serbanescu

Pawel Skruch

Paul Strooper

Mark Utting

Stefan van Baelen

Carsten Wegener

Stephan Weileder

Martin Wirsing

Karsten Wolf

Justyna Zander

xix

Book Introduction

Justyna Zander, Ina Schieferdecker, and Pieter J. Mosterman

The purpose of this handbook is to provide a broad overview of the current state of model-based testing (MBT) for embedded systems, including the potential breakthroughs, thechallenges, and the achievements observed from numerous perspectives. To attain this objec-tive, the book oers a compilation of 22 high-quality contributions from world-renownedindustrial and academic authors. The chapters are grouped into six parts.

The rst part comprises the contributions that focus on key test concepts for embeddedsystems. In particular, a taxonomy of MBT approaches is presented, an assessment ofthe merit and value of system models and test models is provided, and a selected testframework architecture is proposed.

In the second part, dierent test automation algorithms are discussed for various typesof embedded system representations.

The third part contains contributions on the topic of integration and multilevel testing.Criteria for the derivation of integration entry tests are discussed, an approach forreusing test cases across dierent development levels is provided, and an X-in-the-Looptesting method and notation are proposed.

The fourth part is composed of contributions that tackle selected challenges of MBT,such as testing software product lines, conformance validation for hybrid systems andnondeterministic systems, and understanding safety-critical components in the passivetest context.

The fth part highlights testing in industry including application areas such as telecom-munication networks, smartphones, and automotive systems.

Finally, the sixth part presents solutions for lower-level tests and comprises an approachto validation of automatically generated code, contributions on testing analog compo-nents, and verication of SystemC models.

To scope the material in this handbook, an embedded system is considered to be a systemthat is designed to perform a dedicated function, typically with hard real-time constraints,limited resources and dimensions, and low-cost and low-power requirements. It is a combina-tion of computer software and hardware, possibly including additional mechanical, optical,and other parts that are used in the specic role of actuators and sensors (Ganssle andBarr 2003). Embedded software is the software that is part of an embedded system. Embed-ded systems have become increasingly sophisticated and their software content has grownrapidly in the past decade. Applications now consist of hundreds of thousands or even mil-lions of lines of code. Moreover, the requirements that must be fullled while developingembedded software are complex in comparison to standard software. In addition, embedded

xxi

xxii Book Introduction

systems are often produced in large volumes, and the software is dicult to update oncethe product is deployed. Embedded systems interact with the physical environment, whichoften requires models that embody both continuous-time and discrete-event behavior. Interms of software development, it is not just the increased product complexity that derivesfrom all those characteristics, but it combines with shortened development cycles and highercustomer expectations of quality to underscore the utmost importance of software testing(Schauele and Zurawka 2006).

MBT relates to a process of test generation from various kinds of models by applicationof a number of sophisticated methods. MBT is usually the automation of black-box testing(Utting and Legeard 2006). Several authors (Utting, Pretschner, and Legeard 2006; Kamga,Herrmann, and Joshi 2007) dene MBT as testing in which test cases are derived in theirentirety or in part from a model that describes some aspects of the system under test (SUT)based on selected criteria. In addition, authors highlight the need for having dedicated testmodels to make the most out of MBT (Baker et al. 2007; Schulz, Honkola, and Huima 2007).

MBT clearly inherits the complexity of the related domain models. It allows tests to belinked directly to the SUT requirements, makes readability, understandability, and main-tainability of tests easier. It helps to ensure a repeatable and scientic basis for testing andhas the potential for known coverage of the behaviors of the SUT (Utting 2005). Finally, itis a way to reduce the eort and cost for testing (Pretschner et al. 2005).

This book provides an extensive survey and overview of the benets of MBT in the eldof embedded systems. The selected contributions present successful test approaches wheredierent algorithms, methodologies, tools, and techniques result in important cost reductionwhile assuring the proper quality of embedded systems.

Organization

This book is organized in the six following parts: (I) Introduction, (II) Automatic TestGeneration, (III) Integration and Multilevel Testing, (IV) Specic Approaches, (V) Testingin Industry, and (VI) Testing at the Lower Levels of Development. An overview of eachof the parts, along with a brief introduction of the contents of the individual chapters, ispresented next. The following gure depicts the organization of the book.

Embedded systemspecication

Model Test model

Test specication

Executable test caseCode

VI. Testing at the lower levels of development

II. Automatic test generation

Model-baseddevelopment

III. I

nteg

ratio

n an

dm

ultil

evel

testi

ng

Model-basedtesting

I. Introduction

IV. S

peci

cap

proa

ches

V. T

estin

gin

indu

stry

Book Introduction xxiii

Part I. Introduction

The chapter A Taxonomy of Model-Based Testing for Embedded Systems from MultipleIndustry Domains provides a comprehensive overview of MBT techniques using dierentdimensions and categorization methods. Various kinds of test generation, test evaluation,and test execution methods are described, using examples that are presented throughoutthis book and in the related literature.

In the chapter Behavioral System Models versus Models of Testing Strategies in Func-tional Test Generation, the distinction between diverse types of models is discussed exten-sively. In particular, models that describe intended system behavior and models that describetesting strategies are considered from both practical as well as theoretical viewpoints. Itshows the diculty of converting the system model into a test model by applying the men-tal and explicit system model perspectives. Then, the notion of polynomial-time limit on testcase generation is included in the reasoning about the creation of tests based on nite-statemachines.

The chapter Test Framework Architectures for Model-Based Embedded System Test-ing provides reference architectures for building a test framework. The test framework isunderstood as a platform that runs the test scripts and performs other functions such as, forexample, logging test results. It is usually a combination of commercial and purpose-builtsoftware. Its design and character are determined by the test execution process, commonquality goals that control test harnesses, and testability antipatterns in the SUT that mustbe accounted for.

Part II. Automatic Test Generation

The chapter Automatic Model-Based Test Generation from UML State Machines presentsseveral approaches for the generation of test suites from UML state machines based on dif-ferent coverage criteria. The process of abstract path creation and concrete input valuegeneration is extensively discussed using graph traversal algorithms and boundary valueanalysis. Then, these techniques are related to random testing, evolutionary testing, con-straint solving, model checking, and static analysis.

The chapter Automated Statistical Testing for Embedded Systems applies statisticsto solving problems posed by industrial software development. A method of modeling thepopulation of uses is established to reason according to rst principles of statistics. TheModel Language and Java Usage Model Builder Library is employed for the analysis. Modelvalidation and revision through estimates of long-run use statistics are introduced based on amedical device example while paying attention to test management and process certication.

In the chapter How to Design Extended Finite State Machine Models in Java extendednite-state machine (EFSM) test models that are represented in the Java programming lan-guage are applied to an SUT. ModelJUnit is used for generating the test cases by stochasticalgorithms. Then, a methodology for building a MBT tool using Java reection is proposed.Code coverage metrics are exploited to assess the results of the method, and an examplereferring to the GSM 11.11 protocol for mobile phones is presented.

The chapter Automatic Testing of Lustre/Scade Programs addresses the automa-tion of functional test generation using a Lustre-like language in the Lutess V2 tool andrefers to the assessment of the created test coverage. The testing methodology includes thedenitions of the domain, environment dynamics, scenarios, and an analysis based on safetyproperties. A program control ow graph for SCADE models allows a family of coveragecriteria to assess the eectiveness of the test methods and serves as an additional basis forthe test generation algorithm. The proposed approaches are illustrated by a steam-boilercase study.

xxiv Book Introduction

In the chapter Test Generation Using Symbolic Animation of Models, symbolic exe-cution (i.e., animation) of B models based on set-theoretical constraint solvers is appliedto generate the test cases. One of the proposed methods focuses on creation of tests thatreach specic test targets to satisfy structural coverage, whereas the other is based on man-ually designed behavioral scenarios and aims at satisfying dynamic test selection criteria.A smartcard case study illustrates the complementarity of the two techniques.

Part III. Integration and Multilevel Testing

The chapter Model-Based Integration Testing with Communication Sequence Graphsintroduces a notation for representing the communication between discrete-behavior soft-ware components on a meta-level. The models are directed graphs enriched with semanticsfor integration-level analysis that do not emphasize internal states of the components, butrather focus on events. In this context, test case generation algorithms for unit and integra-tion testing are provided. Test coverage criteria, including mutation analysis, are denedand a robot-control application serves as an illustration.

In the chapter A Model-Based View onto Testing: Criteria for the Derivation of EntryTests for Integration Testing components and their integration architecture are modeledearly on in development to help structure the integration process. Fundamentals for testingcomplex systems are formalized. This formalization allows exploiting architecture modelsto establish criteria that help minimize the entry-level testing of components necessary forsuccessful integration. The tests are derived from a simulation of the subsystems and reectbehaviors that usually are veried at integration time. Providing criteria to enable shiftingeort from integration testing to component entry tests illustrates the value of the method.

In the chapter Multilevel Testing for Embedded Systems, the means for a smoothintegration of multiple test levels artifacts based on a continuous reuse of test models andtest cases are provided. The proposed methodology comprises the creation of an invarianttest model core and a test-level specic test adapter model that represents a varying compo-nent. Numerous strategies to obtain the adapter model are introduced. The entire approachresults in an increased optimization of the design eort across selected functional abstractionlevels and allows for the easier traceability of the test constituents. A case study from theautomotive domain (i.e., automated light control) illustrates the feasibility of the solution.

The chapter Model-Based X-in-the-Loop Testing provides a methodology fortechnology-independent specication and systematic reuse of testing artifacts for closed-loop testing across dierent development stages. Simulink r-based environmental modelsare coupled with a generic test specication designed in the notation called TTCN-3 embed-ded. It includes a dedicated means for specifying the stimulation of an SUT and assessingits reaction. The notions of time and sampling, streams, stream ports, and stream vari-ables are paid specic attention as well as the denition of statements to model a controlow structure akin to hybrid automata. In addition, an overall test architecture for theapproach is presented. Several examples from the automotive domain illustrate the verticaland horizontal reuse of test artifacts. The test quality is discussed as well.

Part IV. Specic Approaches

The chapter A Survey of Model-Based Software Product Lines Testing presents anoverview of the testing that is necessary in software product line engineering methods.Such methods aim at improving reusability of software within a range of products sharinga common set of features. First, the requirements and a conception of MBT for softwareproduct lines are introduced. Then, the state of the art is provided and the solutions arecompared to each other based on selected criteria. Finally, open research objectives areoutlined and recommendations for the software industry are provided.

Book Introduction xxv

The chapter Model-Based Testing of Hybrid Systems describes a formal frameworkfor conformance testing of hybrid automaton models and their adequate test generationalgorithms. Methods from computer science and control theory are applied to reason aboutthe quality of a system. An easily computable coverage measure is introduced that refersto testing properties such as safety and reachability based on the equal-distribution degreeof a set of states over their state space. The distribution degree can be used to guide thetest generation process, while the test creation is based on the rapidly exploring randomtree algorithm (Lavalle 1998) that represents a probabilistic motion planning technique inrobotics. The results are then explored in the domain of analog and mixed signal circuits.

The chapter Reactive Testing of Nondeterministic Systems by Test Purpose DirectedTester provides a model-based construction of an online tester for black-box testing. Thenotation of nondeterministic EFSM is applied to formalize the test model. The synthesisalgorithm allows for selecting a suboptimal test path at run time by nding the shortest pathto cover the test purpose. The rules enabling an implementation of online reactive planningare included. Coverage criteria are discussed as well, and the approach is compared withrelated algorithms. A feeder-box controller of a city lighting system illustrates the feasibilityof the solution.

The chapter Model-Based Passive Testing of Safety-Critical Components providesa set of passive-testing techniques in a manner that is driven by multiple examples. First,general principles of the approach to passive quality assurance are discussed. Then, complexsoftware systems, network security, and hardware systems are considered as the targeteddomains. Next, a step-by-step illustrative example for applying the proposed analysis to aconcurrent system designed in the form of a cellular automaton is introduced. As passivetesting usually takes place after the deployment of a unit, the ability of a component tomonitor and self-test in operation is discussed. The benets and limitations of the presentedapproaches are described as well.

Part V. Testing in Industry

The chapter Applying Model-Based Testing in the Telecommunication Domain refers totesting practices at Nokia Siemens Networks at the industrial level and explains the state ofMBT in the trenches. The presented methodology uses a behavioral system model designedin UML and SysML for generating the test cases. The applied process, model development,validation, and transformation aspects are extensively described. Technologies such as theMATERA framework (Abbors, Backlund, and Truscan 2010), UML to QML transformation,and OCL guideline checking are discussed. Also, test generation, test execution aspects (e.g.,load testing, concurrency, and run-time executability), and the traceability of all artifacts arediscussed. The case study illustrates testing the functionality of a Mobile Services SwitchingCenter Server, a network element using oine testing.

The chapter Model-Based GUI Testing of Smartphone Applications: Case S60TM andLinux r discusses application of MBT along two case studies. The rst one considers built-in applications in a smartphone model S60, and the second tackles the problem of a mediaplayer application in a variant of mobile Linux. Experiences in modeling and adapter devel-opment are provided and potential problems (e.g., expedient pace of product creation) arereported in industrial deployment of the technology for graphical user interface (GUI) testingof smartphone applications. In this context, the TEMA toolset (Jaaskelainen 2009) designedfor test modeling, test generation, keyword execution, and test debugging is presented. Thebenets and business aspects of the process adaptation are also briey considered.

The chapter Model-Based Testing in Embedded Automotive Systems provides a broadoverview of MBT techniques applied in the automotive domain based on experiences fromDelphi Technical Center, Krakow (Poland). Key automotive domain concepts specic to

xxvi Book Introduction

MBT are presented as well as everyday engineering issues related to MBT process deploy-ment in the context of the system-level functional testing. Examples illustrate the appli-cability of the techniques for industrial-scale mainstream production projects. In addition,the limitations of the approaches are outlined.

Part VI. Testing at the Lower Levels of Development

The chapter Testing-Based Translation Validation of Generated Code provides anapproach for model-to-code translation that is followed by a validation phase to verifythe target code produced during this translation. Systematic model-level testing is sup-plemented by testing for numerical equivalence between models and generated code. Themethodology follows the objectives and requirements of safety standards such as IEC 61508and ISO 26262 and is illustrated using a Simulink-based code generation tool chain.

The chapter Model-Based Testing of Analog Embedded Systems Componentsaddresses the problem of determining whether an analog system meets its specication asgiven either by a model of correct behavior (i.e., the system model) or of incorrect behav-ior (i.e., a fault model). The analog model-based test follows a two-phase process. First,a pretesting phase including system selection, fault model selection, excitation design, andsimulation of fault models is presented. Next, an actual testing phase comprising measure-ment, system identication, behavioral simulation, and reasoning about the faults is exten-sively described. Examples are provided while benets, limitations, and open questions inapplying analog MBT are included.

The chapter Dynamic Verication of SystemC Transactional Models presents a solu-tion for verifying logic and temporal properties of communication in transaction-level mod-eling designs from simulation. To this end, a brief overview on SystemC is provided. Issuesrelated to globally asynchronous/locally synchronous, multiclocked systems, and auxiliaryvariables are considered in the approach.

Target Audience

The objective of this book is to be accessible to engineers, analysts, and computer scientistsinvolved in the analysis and development of embedded systems, software, and their qual-ity assurance. It is intended for both industry-related professionals and academic experts,in particular those interested in verication, validation, and testing. The most importantobjectives of this book are to help the reader understand how to use Model-Based Testingand test harness to a maximum extent. Various perspectives serve to:

- Get an overview on MBT and its constituents;

- Understand the MBT concepts, methods, approaches, and tools;

- Know how to choose modeling approaches tting the customers needs;

- Be able to select appropriate test generation strategies;

- Learn about successful applications of MBT;

- Get to know best practices of MBT; and

- See prospects of further developments in MBT.

Book Introduction xxvii

References

Abbors, F., Backlund, A., and Truscan, D. (2010). MATERAAn integrated frameworkfor model-based testing. In Proceedings of the 17th IEEE International Conference andWorkshop on Engineering of Computer-Based Systems (ECBS 2010), Pages: 321328.IEEE Computer Societys Conference Publishing Services (CPS).

Baker, P., Ru Dai, Z., Grabowski, J., Haugen, O., Schieferdecker, I., and Williams, C.(2007). Model-Driven Testing, Using the UML Testing Prole. ISBN 9783-5407-2562-6,Springer Verlag.

Ganssle, J. and Barr, M. (2003). Embedded Systems Dictionary, ISBN-10: 1578201209,ISBN-13: 978-1578201204, 256 pages.

Jaaskelainen, A., Katara, M., Kervinen, A., Maunumaa, M., Paakkonen, T., Takala, T., andVirtanen, H. (2009). Automatic GUI test generation for smartphone applicationsan evaluation. Proceedings of the Software Engineering in Practice track of the 31stInternational Conference on Software Engineering (ICSE 2009), pp. 112122. IEEEComputer Society (companion volume).

Kamga, J., Herrmann, J., and Joshi, P. (2007). Deliverable: D-MINT automotive casestudyDaimler, Deliverable 1.1, Deployment of Model-Based Technologies to Indus-trial Testing, ITEA2 Project.

Lavalle, S.M. (1998). Rapidly-Exploring Random Trees: A New Tool for Path Plan-ning. Computer Science Dept, Iowa State University, Technical Report 9811.http://citeseer.ist.psu.edu/311812.html.

Pretschner, A., Prenninger, W., Wagner, S., Kuhnel, C., Baumgartner, M., Sostawa, B.,Zolch, R., and Stauner, T. (2005). One evaluation of model-based testing and itsautomation. In Proceedings of the 27th International Conference on Software Engi-neering, St. Louis, MO, Pages: 392401, ISBN: 1-59593-963-2. ACM New York.

Schauele, J. and Zurawka, T. (2006). Automotive Software Engineering, ISBN: 3528110406.Vieweg.

Schulz, S., Honkola, J., and Huima, A. (2007). Towards model-based testing with archi-tecture models. In Proceedings of the 14th Annual IEEE International Conferenceand Workshops on the Engineering of Computer-Based Systems (ECBS 07). IEEEComputer Society, Washington, DC, Pages: 495502. DOI=10.1109/ECBS.2007.73http://dx.doi.org/10.1109/ECBS.2007.73.

Utting, M. (2005). Model-based testing. In Proceedings of the Workshop on VeriedSoftware: Theory, Tools, and Experiments VSTTE 2005.

Utting, M. and Legeard, B. (2006). Practical Model-Based Testing: A Tools Approach.ISBN-13: 9780123725011. Elsevier Science & Technology Books.

Utting, M., Pretschner, A., and Legeard, B. (2006). A Taxonomy of Model-Based Testing,ISSN: 1170-487X.

Part I

Introduction

1A Taxonomy of Model-Based Testing for EmbeddedSystems from Multiple Industry Domains

Justyna Zander, Ina Schieferdecker, and Pieter J. Mosterman

CONTENTS1.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31.2 Denition of Model-Based Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

1.2.1 Test dimensions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51.2.1.1 Test goal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61.2.1.2 Test scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61.2.1.3 Test abstraction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

1.3 Taxonomy of Model-Based Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71.3.1 Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81.3.2 Test generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

1.3.2.1 Test selection criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101.3.2.2 Test generation technology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111.3.2.3 Result of the generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

1.3.3 Test execution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131.3.4 Test evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

1.3.4.1 Specication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151.3.4.2 Technology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

1.4 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

1.1 Introduction

This chapter provides a taxonomy of Model-Based Testing (MBT) based on the approachesthat are presented throughout this book as well as in the related literature. The techniquesfor testing are categorized using a number of dimensions to familiarize the reader with theterminology used throughout the chapters that follow.

In this chapter, after a brief introduction, a general denition of MBT and related workon available MBT surveys is provided. Next, the various test dimensions are presented.Subsequently, an extensive taxonomy is proposed that classies the MBT process accordingto the MBT foundation (referred to as MBT basis), denition of various test generationtechniques, consideration of test execution methods, and the specication of test evaluation.The taxonomy is an extension of previous work by Zander and Schieferdecker (2009) and itis based on contributions of Utting, Pretschner, and Legeard (2006). A summary concludesthe chapter with the purpose of encouraging the reader to further study the contributionsof the collected chapters in this book and the specic aspects of MBT that they address indetail.

3

4 Model-Based Testing for Embedded Systems

1.2 Denition of Model-Based Testing

This section provides a brief survey of the selected denitions of MBT available in theliterature. Next, certain aspects of MBT are highlighted in the discussion on test dimensionsand their categorization is illustrated.

MBT relates to a process of test generation from models of/related to a system undertest (SUT) by applying a number of sophisticated methods. The basic idea of MBT isthat instead of creating test cases manually, a selected algorithm is generating them auto-matically from a model. MBT usually comprises the automation of black-box test design(Utting and Legeard 2006), however recently it has been used to automate white-box testsas well. Several authors such as Utting (2005) and Kamga, Hermann, and Joshi (2007)dene MBT as testing in which test cases are derived in their entirety or in part from amodel that describes some aspects of the SUT based on selected criteria. Utting, Pretschner,and Legeard (2006) elaborate that MBT inherits the complexity of the domain or, morespecically, of the related domain models. Dai (2006) refers to MBT as model-driven test-ing (MDT) because of the context of the model-driven architecture (MDA) (OMG 2003) inwhich MBT is proposed.

Advantages of MBT are that it allows tests to be linked directly to the SUT requirements,which renders readability, understandability, and maintainability of tests easier. It helpsensure a repeatable and scientic basis for testing. Furthermore, MBT has been shown toprovide good coverage of all the behaviors of the SUT (Utting 2005) and to reduce the eortand cost for testing (Pretschner et al. 2005).

The term MBT is widely used today with subtle dierences in its meaning. Surveyson dierent MBT approaches are provided by Broy et al. (2005), Utting, Pretschner, andLegeard (2006), and the D-Mint Project (2008), and Schieferdecker et al. (2011). In theautomotive industry, MBT describes all testing activities in the context of Model-BasedDesign (MBD), as discussed for example, by Conrad, Fey, and Sadeghipour (2004) andLehmann and Kramer (2008). Rau (2002), Lamberg et al. (2004), and Conrad (2004a, 2004b)dene MBT as a test process that encompasses a combination of dierent test methods thatutilize the executable model in MBD as a source of information. As a single testing techniqueis insucient to achieve a desired level of test coverage, dierent test methods are usuallycombined to complement each other across all the specied test dimensions (e.g., functionaland structural testing techniques are frequently applied together). If sucient test coveragehas been achieved on the model level, properly designed test cases can be reused for testingthe software created based on or generated from the models within the framework of back-to-back tests as proposed by Wiesbrock, Conrad, and Fey (2002). With this practice, thefunctional equivalence between the specication, executable model, and code can be veriedand validated (Conrad, Fey, and Sadeghipour 2004).

The most generic denition of MBT is testing in which the test specication is derived inits entirety or in part from both the system requirements and a model that describe selectedfunctional and nonfunctional aspects of the SUT.

The test specication can take the form of a model, executable model, script, or computerprogram code. The resulting test specication is intended to ultimately be executed togetherwith the SUT so as to provide the test results. The SUT again can exist in the form of amodel, code, or even hardware.

For example, in Conrad (2004b) and Conrad, Fey, and Sadeghipour (2004), no additionaltest models are created, but the already existing functional system models are utilizedfor test purposes. In the test approach proposed by Zander-Nowicka (2009), the sys-tem models are exploited as well. In addition, however, a test specication model (also

Taxonomy of MBT for Embedded Systems 5

called test case specication, test model, or test design in the literature (Pretschner 2003b,Zander et al. 2005, and Dai 2006) is created semi-automatically. Concrete test data variantsare then automatically derived from this test specication model.

The application of MBT is as proliferate as the interest in building embedded systems.For example, case studies borrowed from such widely varying domains as medicine, auto-motive, control engineering, telecommunication, entertainment, or aerospace can be foundin this book. MBT then appears as part of specic techniques that are proposed for testinga medical device, the GSM 11.11 protocol for mobile phones, a smartphone graphical userinterface (GUI), a steam boiler, smartcard, a robot-control application, a kitchen toaster,automated light control, analog- and mixed-signal electrical circuits, a feeder-box controllerof a city lighting system, and other complex software systems.

1.2.1 Test dimensions

Tests can be classied depending on the characteristics of the SUT and the test sys-tem. In this book, such SUT features comprise, for example, safety-critical properties,deterministic and nondeterministic behavior, load and performance, analog characteristics,network-related, and user-friendliness qualities. Furthermore, systems that exhibit behav-ior of a discrete, continuous, or hybrid nature are analyzed in this book. The modelingparadigms for capturing a model of the SUT and tests combine dierent approaches, suchas history-based, functional data ow combined with transition-based semantics. As it isnext to impossible for one single classication scheme to successfully apply to such a widerange of attributes, selected dimensions have been introduced in previous work to isolatecertain aspects. For example, Neukirchen (2004) aims at testing communication systemsand categorizes testing in the dimensions of test goals, test scope, and test distribution. Dai(2006) replaces the test distribution by a dimension describing the dierent test developmentphases, since she is testing both local and distributed systems. Zander-Nowicka (2009) refersto test goals, test abstraction, test execution platforms, test reactiveness, and test scope inthe context of embedded automotive systems.

In the following, the specics related to test goal, test scope, and test abstraction (seeFigure 1.1) are introduced to provide a basis for a common vocabulary, simplicity, and abetter understanding of the concepts discussed in the rest of this book.

Nonfunctional

Functional

StructuralComponent

Abstract NonabstractTest abstraction

Integration

SystemTest scope

Static

Dynamic

Test

goal

FIGURE 1.1Selected test dimensions.


1.2.1.1 Test goal

During software development, systems are tested with dierent purposes (i.e., goals). Thesegoals can be categorized as static testing, also called review, and dynamic testing, wherethe latter is based on test execution and further distinguishes between structural, func-tional, and nonfunctional testing. After the review phase, the test goal is usually to checkthe functional behavior of the system. Nonfunctional tests appear in later developmentstages.

Static test: Testing is often dened as the process of nding errors, failures, and faults.Errors in a program can be revealed without execution by just examining its source code(International Software Testing Qualication Board 2006). Similarly, other developmentartifacts can be reviewed (e.g., requirements, models, or the test specication itself).

Structural test: Structural tests cover the structure of the SUT during test execution(e.g., control or data ow), and so the internal structure of the system (e.g., code ormodel) must be known. As such, structural tests are also called white-box or glass-boxtests (Myers 1979; International Software Testing Qualication Board 2006).

Functional test: Functional testing is concerned with assessing the functional behaviorof an SUT against the functional requirements. In contrast to structural tests, func-tional tests do not require any knowledge about system internals. They are thereforecalled black-box tests (Beizer 1995). A systematic, planned, executed, and documentedprocedure is desirable to make them successful. In this category, functional safety teststo determine the safety of a software product are also included.

Nonfunctional test : Similar to functional tests, nonfunctional tests (also called extra-functional tests) are performed against a requirements specication of the system. Incontrast to pure functional testing, nonfunctional testing aims at assessing nonfunc-tional requirements such as reliability, load, and performance. Nonfunctional tests areusually black-box tests. Nevertheless, internal access during test execution is requiredfor retrieving certain information, such as the state of the internal clock.

For example, during a robustness test, the system is tested with invalid input data thatare outside the permitted ranges to check whether the system is still safe and operatesproperly.

1.2.1.2 Test scope

Test scopes describe the granularity of the SUT. Because of the composition of the system,tests at dierent scopes may reveal dierent failures (Weyuker 1988; International SoftwareTesting Qualication Board 2006; and D-Mint Project 2008). This leads to the followingorder in which tests are usually performed:

Component: At the scope of component testing (also referred to as unit testing), thesmallest testable component (e.g., a class in an object-oriented implementation or asingle electronic control unit [ECU]) is tested in isolation.

Integration: The scope of integration test combines components with each other andtests those as a subsystem, that is, not yet a complete system. It exposes defects inthe interfaces and in the interactions between integrated components or subsystems(International Software Testing Qualication Board 2006).

System: In a system test, the complete system, including all subsystems, is tested.Note that a complex embedded system is usually distributed with the single subsystems


connected, for example, via buses using dierent data types and interfaces through whichthe system can be accessed for testing (Hetzel 1988).

1.2.1.3 Test abstraction

As far as the abstraction level of the test specication is considered, the higher the abstrac-tion, the better test understandability, readability, and reusability are observed. However,the specied test cases must be executable at the same time. Also, the abstraction levelshould not aect the test execution in a negative way. An interesting and promising approachto address the eect of abstraction on execution behavior is provided by Mosterman et al.(2009, 2011) and Zander et al. (2011) in the context of complex system development. Intheir approach, the error introduced by a computational approximation of the execution isaccepted as an inherent system artifact as early as the abstract development stages. Thebenet of this approach is that it allows eliminating the accidental complexity of the codethat makes the abstract design executable while enabling high-level analysis and synthesismethods. A critical enabling element is a high-level declarative specication of the execu-tion logic so that its computational approximation becomes explicit. Because it is explicitand declarative, the approximation can then be consistently preserved throughout thedesign stages. This approach holds for test development as well. Whenever the abstract testsuites are executed, they can be rened with the necessary concrete analysis and synthesismechanisms.

1.3 Taxonomy of Model-Based Testing

In Utting, Pretschner, and Legeard (2006), a broad taxonomy for MBT is presented. Here,three general classes are identied: model, test generation, and test execution. Each ofthe classes is divided into further categories. The model class consists of subject, inde-pendence, characteristics, and paradigm categories. The test generation class consists oftest selection criteria and technology categories. The test execution class contains executionoptions.

Zander-Nowicka (2009) completes the overall view with test evaluation as an additionalclass. Test evaluation refers to comparing the actual SUT outputs with the expected SUTbehavior based on a test oracle. Such a test oracle enables a decision to be made as towhether the actual SUT outputs are correct. The test evaluation is divided into two cate-gories: specication and technology.

Furthermore, in this chapter, the test generation class is extended with an additionalcategory called result of the generation. Also, the semantics of the class model is dierentin this taxonomy than in its previous incarnations. Here, a category called MBT basisindicates what specic element of the software engineering process is the basis for MBTprocess.

An overview of the resulting MBT taxonomy is illustrated in Figure 1.2. All the cate-gories in the presented taxonomy are decomposed into further elements that inuence eachother within or between categories. The A/B/C notation at the leaves indicates mutuallyexclusive options.

In the following three subsections, the categories and options in each of the classes ofthe MBT taxonomy are explained in depth. The descriptions of the most important optionsare endowed with examples of their realization.


Model

Classes: Categories: Options:

MBT basis System modelTest modelCoupled system model and test model

Mutation-analysis basedStructural model coverage

Requirements coverageTest case specicationRandom and stochasticFault-based

Automatic/manualRandom generationGraph search algorithmModel checkingSymbolic executionTheorem provingOnline/oineExecutable test modelsExecutable test scriptsExecutable code

MiL / SiL / HiL / PiL (simulation)Reactive/nonreactiveGenerating test logs

Reference signal-feature basedReference signal basedRequirements coverageTest evaluation specication

Automatic/manualOnline/oineTechnology

Specication

Executionoptions

Result of thegeneration

TechnologyTestgeneration

Test execution

Testevaluation

Data coverage

Properties +

Test selectioncriteria

FIGURE 1.2Overview of the taxonomy for Model-Based Testing.

1.3.1 Model

The models applied in the MBT process can include both system-specic and test-specicdevelopment artifacts. Frequently, the software engineering practice for a selected projectdetermines the basis for incorporating the testing into the process and thus, selecting theMBT type. In the following, selected theoretical viewpoints are introduced and join pointsbetween them are discussed.

To specify the system and the test development, the methods that are presented inthis book employ a broad spectrum of notations such as Finite State Machines (FSM)(e.g., Chapter 2), Unied Modeling Language (UML r) (e.g., state machines, use cases),UML Testing Prole (UTP) (see OMG 2003, 2005), SysML (e.g., Chapter 4), The ModelLanguage (e.g., Chapter 5), Extended FSM, Labeled State Transition System notation,Java (e.g., Chapter 6), Lustre, SCADE r (e.g., Chapter 7), B-Notation (e.g., Chapter 8),Communication Sequence Graphs (e.g., Chapter 9), Testing and Test Control Notation,version 3 (TTCN-3) (see ETSI 2007), TTCN-3 embedded (e.g., Chapter 12), TransactionLevel Models, Property Specication Language, SystemC (e.g., Chapter 22), Simulink r

(e.g., Chapter 12, Chapter 19, or Chapter 20), and so on.


Model-Based Testing basis

In the following, selected options referred to as the MBT basis are listed and their meaningis described. System model : A system model is an abstract representation of certain aspects of the

SUT. A typical application of the system model in the MBT process leverages its behav-ioral description for derivation of tests. Although this concept has been extensivelydescribed in previous work (Conrad 2004a; Utting 2005), another instance of usinga system model for testing is the approach called architecture-driven testing (ADT)introduced by Din and Engel (2009). It is a technique to derive tests from architectureviewpoints. An architecture viewpoint is a simplied representation of the system modelwith respect to the structure of the system from a specic perspective. The architectureviewpoints not only concentrate on a particular aspect but also allow for the combinationof the aspects, relations, and various models of system components, thereby providing aunifying solution. The perspectives considered in ADT include a functional view, logicalview, technical view, and topological view. They enable the identication of test proce-dures and failures on certain levels of detail that would not be recognized otherwise.

Test model: If the test cases are derived directly from an abstract test model and aredecoupled from the system model, then such a test model is considered to constitutethe MBT basis. In practice, such a method is rarely applied as it requires substantialeort to introduce a completely new test model. Instead, the coupled system and testmodel approach is used.

Coupled system and test model: UTP plays an essential role for the alignment of systemdevelopment methods together with testing. It introduces abstraction as a test artifactand counts as a primary standard in this alignment. UTP is utilized as the test model-ing language before test code is generated from a test model. Though, this presupposesthat an adequate system model already exists and will be leveraged during the entiretest process (Dai 2006). As a result, system models and test models are developed inconcert in a coupled process. UTP addresses concepts, such as test suites, test cases, testconguration, test component, and test results, and enables the specication of dierenttypes of testing, such as functional, interoperability, scalability, and even load testing.

Another instantiation of such a coupled technique is introduced in the Model-in-the-Loop for Embedded System Test (MiLEST) approach (Zander-Nowicka 2009) whereSimulink system models are coupled with additionally generated Simulink-based testmodels. MiLEST is a test specication framework that includes reusable test patterns,generic graphical validation functions, test data generators, test control algorithms, andan arbitration mechanism all collected in a dedicated library.

The application of the same modeling language for both system and test design bringsabout positive eects as it ensures that the method is more transparent and it does notforce the engineers to learn a completely new language.

A more extensive illustration of the challenge to select a proper MBT basis is provided inChapter 2 of this book.

1.3.2 Test generation

The process of test generation starts from the system requirements, taking into accountthe test objectives. It is dened in a given test context and results in the creation of testcases. A number of approaches exist depending on the test selection criteria, generationtechnology, and the expected generation results. They are reviewed next.


1.3.2.1 Test selection criteria

Test selection criteria dene the facilities that are used to control the generation of tests.They help specify the tests and do not depend on the SUT code. In the following, the mostcommonly used criteria are investigated. Clearly, dierent test methods should be combinedto complement one another so as to achieve the best test coverage. Hence, there is no bestsuitable solution for generating the test specication. Subsequently, the test selection criteriaare described in detail.

Mutation-analysis based: Mutation analysis consists of introducing a small syntacticchange in the source of a model or program in order to produce a mutant (e.g., replacingone operator by another or altering the value of a constant). Then, the mutant behavioris compared to the original. If a dierence can be observed, the mutant is marked askilled. Otherwise, it is called equivalent. The original aim of the mutation analysis isthe evaluation of a test data applied in the test case. Thus, it can be applied as afoundational technique for test generation. One of the approaches to mutation analysisis described in Chapter 9 of this book.

Structural model coverage criteria: These exploit the structure of the model to selectthe test cases. They deal with coverage of the control-ow through the model, based onideas from the ow of control in computer program code.

Previous work (Pretschner 2003) has shown how test cases can be generated that satisfythe modied condition/decision coverage (MC/DC) coverage criterion. The idea is torst generate a set of test case specications that enforce certain variable valuations andthen generate test cases for them.

Similarly, safety test builder (STB) (GeenSoft 2010a) or Reactis Tester (ReactiveSystems 2010; Sims and DuVarney 2007) generate test sequences covering a set ofStateow r test objectives (e.g., transitions, states, junctions, actions, MC/DC cover-age) and a set of Simulink test objectives (e.g., Boolean ow, look-up tables, conditionalsubsystems coverage).

Data coverage criteria: The idea is to decompose the data range into equivalence classesand select one representative value from each class. This partitioning is usually comple-mented by a boundary value analysis (Kosmatov et al. 2004), where the critical limitsof the data ranges or boundaries determined by constraints are selected in addition tothe representative values.

An example is the MATLAB r Automated Testing Tool (MATT 2008) that enablesblack-box testing of Simulink models and code generated from them by Real-TimeWorkshop r (Real-Time Workshop 2011). MATT furthermore enables the creation ofcustom test data for model simulations by setting the types of test data for each input.Additionally, accuracy, constant, minimum, and maximum values can be provided togenerate the test data matrix.

Another realization of this criterion is provided by Classication Tree Editor for Embed-ded Systems (CTE/ES) implementing the Classication Tree Method (Grochtmann andGrimm 1993; Conrad 2004a). The SUT inputs form the classications in the roots of thetree. From here, the input ranges are divided into classes according to the equivalencepartitioning method. The test cases are specied by selecting leaves of the tree in thecombination table. A row in the table species a test case. CTE/ES provides a way ofnding test cases systematically by decomposing the test scenario design process intosteps. Visualization of the test scenario is supported by a GUI.


Requirements coverage criteria: These criteria aim at covering all informal SUT require-ments. Traceability of the SUT requirements to the system or test model/code aids inthe realization of this criterion. It is targeted by almost every test approach (Zander-Nowicka 2009).

Test case denition: When a test engineer denes a test case specication in someformal notation, the test objectives can be used to determine which tests will be gen-erated by an explicit decision and which set of test objectives should be covered. Thenotation used to express these objectives may be the same as the notation used for themodel (Utting, Pretschner, and Legeard 2006). Notations commonly used for test objec-tives include FSMs, UTP, regular expressions, temporal logic formulas, constraints, andMarkov chains (for expressing intended usage patterns).

A prominent example of applying this criterion is described by Dai (2006), where thetest case specications are derived from UML models and transformed into executabletests in TTCN-3 by using MDA methods (Zander et al. 2005). The work of Pretschneret al. (2004) is also based on applying this criterion (see symbolic execution).

Random and stochastic criteria: These are mostly applicable to environment modelsbecause it is the environment that determines the usage patterns of the SUT. A typicalapproach is to use a Markov chain to specify the expected SUT usage prole. Anotherexample is to use a statistical usage model in addition to the behavioral model of theSUT (Carter, Lin, and Poore 2008). The statistical model acts as the selection criterionand chooses the paths, while the behavioral model is used to generate the oracle forthose paths.

As an example, Markov Test Logic (MaTeLo) (All4Tec 2010) can generate test suitesaccording to several algorithms. Each of them optimizes the test eort according toobjectives such as boundary values, functional coverage, and reliability level. Test casesare generated in XML/HTML format for manual execution or in TTCN-3 for automaticexecution (Dulz and Fenhua 2003).

Another instance, Java Usage Model Builder Library (JUMBL) (Software Qual-ity Research Laboratory 2010) (cf. Chapter 5) can generate test cases as a collection oftest cases that cover the model with minimum cost, by random sampling with replace-ment, by interleaving the events of other test cases, or in order by probability. Aninteractive test case editor supports creating test cases by hand.

Fault-based criteria: These rely on knowledge of typically occurring faults, often cap-tured in the form of a fault model.

1.3.2.2 Test generation technology

One of the most appealing characteristics of MBT is its potential for automation. Theautomated generation of test cases usually necessitates the existence of some form of testcase specications.

In the proceeding paragraphs, dierent technologies applied to test generation arediscussed.

Automatic/Manual technology: Automatic test generation refers to the situation where,based on given criteria, the test cases are generated automatically from an informationsource. Manual test generation refers to the situation where the test cases are producedby hand.


Random generation: Random generation of tests is performed by sampling the inputspace of a system. It is straightforward to implement, but it takes an undened periodof time to reach a certain satisfying level of model coverage as Gutjahr (1999) reports.

Graph search algorithms: Dedicated graph search algorithms include node or arc cov-erage algorithms such as the Chinese Postman algorithm that covers each arc at leastonce. For transition-based models, which use explicit graphs containing nodes and arcs,there are many graph coverage criteria that can be used to control test generation.The commonly used are all nodes, all transitions, all transition pairs, and all cycles.The method is exemplied by Lee and Yannakakis (1994), which specically addressesstructural coverage of FSM models.

Model checking: Model checking is a technology for verifying or falsifying propertiesof a system. A property typically expresses an unwanted situation. The model checkerveries whether this situation is reachable or not. It can yield counterexamples whena property is falsied. If no counterexample is found, then the property is proven andthe situation can never be reached. Such a mechanism is implemented in safety checkerblockset (GeenSoft 2010b) or in EmbeddedValidator (BTC Embedded Systems AG2010).

The general idea of test case generation with model checkers is to rst formulate testcase specications as reachability properties, for example, eventually, a certain state isreached or a certain transition res. A model checker then yields traces that reach thegiven state or that eventually make the transition re. Wieczorek et al. (2009) present anapproach to use Model Checking for the generation of Integration Tests from Choreogra-phy Models. Other variants use mutations of models or properties to generate test suites.

Symbolic execution: The idea of symbolic execution is to run an executable model notwith single input values but with sets of input values instead (Marre and Arnould 2000).These are represented as constraints. With this practice, symbolic traces are generated.By instantiation of these traces with concrete values, the test cases are derived. Symbolicexecution is guided by test case specications. These are given as explicit constraintsand symbolic execution may be performed randomly by respecting these constraints.

Pretschner (2003) presents an approach to test case generation with symbolic execu-tion built on the foundations of constraint logic programming. Pretschner (2003a and2003b) concludes that test case generation for both functional and structural test casespecications reduces to nding states in the state space of the SUT model. The aimof symbolic execution of a model is then to nd a trace that represents a test case thatleads to the specied state.

Theorem proving: Usually theorem provers are employed to check the satisability offormulas that directly occur in the models. One variant is similar to the use of modelcheckers where a theorem prover replaces the model checker.

For example, one of the techniques applied in Simulink r Design VerierTM (TheMathWorks r, Inc.) uses mathematical procedures to search through the possible exe-cution paths of the model so as to nd test cases and counterexamples.

Online/oine generation technology: With online test generation, algorithms can reactto the actual outputs of the SUT during the test execution. This idea is exploited forimplementing reactive tests as well.

Oine testing generates test cases before they are run. A set of test cases is generatedonce and can be executed many times. Also, the test generation and test execution can


be performed on dierent machines, at dierent levels of abstractions, and in dierentenvironments. If the test generation process is slower than test execution, then there areobvious advantages to minimizing the number of times tests are generated (preferablyonly once).

1.3.2.3 Result of the generation

Test generation usually results in a set of test cases that form test suites. The test cases areexpected to ultimately become executable to allow for observation of meaningful verdictsfrom the entire validation process. Therefore, in the following, the produced test cases aredescribed from the execution point of view, and so they can be represented in dierentforms, such as test scripts, test models, or code. These are described next.

Executable test models: Similarly, the created test models (i.e., test designs) should beexecutable. The execution engine underlying the test modeling semantics is the indicatorof the character of the test design and its properties (cf. the discussion given in, e.g.,Chapter 11).

Executable test scripts: The test scripts refer to the physical description of a test case(cf., e.g., Chapter 2). They are represented by a test script language that has to thenbe translated to the executables (cf. TTCN-3 execution).

Executable code: The code is the lowest-level representation of a test case in terms ofthe technology that is applied to execute the tests (cf. the discussion given in, e.g.,Chapter 6). Ultimately, every other form of a test case is transformed to a code in aselected programming language.

1.3.3 Test execution

In the following, for clarity reasons, the analysis of the test execution is limited to the domainof engineered systems. An example application in the automotive domain is recalled in thenext paragraphs. Chapters 11, 12, and 19 provide further background and detail to thematerial in this subsection.

Execution options

In this chapter, execution options refer to the execution of a test. The test execution ismanaged by so-called test platforms. The purpose of the test platform is to stimulate thetest object (i.e., SUT) with inputs and to observe and analyze the outputs of the SUT.

In the automotive domain, the test platform is typically represented by a car with atest driver. The test driver determines the inputs of the SUT by driving scenarios andobserves the reaction of the vehicle. Observations are supported by special diagnosis andmeasurement hardware/software that records the test data during the test drive and thatallows the behavior to be analyzed oine. An appropriate test platform must be chosendepending on the test object, the test purpose, and the necessary test environment. In theproceeding paragraphs, the execution options are elaborated more extensively.

Model-in-the-Loop (MiL): The rst integration level, MiL, is based on a behavioralmodel of the system itself. Testing at the MiL level employs a functional model orimplementation model of the SUT that is tested in an open loop (i.e., without a plantmodel) or closed loop (i.e., with a plant model and so without physical hardware)(Schauele and Zurawka 2006; Kamga, Herrman, and Joshi 2007; Lehmann and Kramer2008). The test purpose is prevailingly functional testing in early development phasesin simulation environments such as Simulink.


Software-in-the-Loop (SiL): During SiL, the SUT is software tested in a closed-loop oropen-loop conguration. The software components under test are typically implementedin C and are either handwritten or generated by code generators based on implementa-tion models. The test purpose in SiL is mainly functional testing (Kamga, Herrmann,and Joshi 2007). If the software is built for a xed-point architecture, the required scalingis already part of the software.

Processor-in-the-Loop (PiL): In PiL, embedded controllers are integrated into embeddeddevices with proprietary hardware (i.e., ECU). Testing on the PiL level is similar to SiLtests, but the embedded software runs on a target board with the target processor oron a target processor emulator. Tests on the PiL level are important because they canreveal faults that are caused by the target compiler or by the processor architecture.It is the last integration level that allows debugging during tests in an inexpensive andmanageable manner (Lehmann and Kramer 2008). Therefore, the eort spent by PiLtesting is worthwhile in most any case.

Hardware-in-the-Loop (HiL): When testing the embedded system on the HiL level, thesoftware runs on the target ECU. However, the environment around the ECU is stillsimulated. ECU and environment interact via the digital and analog electrical connectorsof the ECU. The objective of testing on the HiL level is to reveal faults in the low-levelservices of the ECU and in the I/O services (Schauele and Zurawka 2006). Additionally,acceptance tests of components delivered by the supplier are executed on the HiL levelbecause the component itself is the integrated ECU (Kamga, Herrmann, and Joshi2007). HiL testing requires real-time behavior of the environment model to ensure thatthe communication with the ECU is the same as in the real application.

Vehicle: The ultimate integration level is the vehicle itself. The target ECU operates inthe physical vehicle, which can either be a sample or be a vehicle from the productionline. However, these tests are expensive, and, therefore, performed only in the latedevelopment phases. Moreover, conguration parameters cannot be varied arbitrarily(Lehmann and Kramer 2008), hardware faults are dicult to trigger, and the reactionof the SUT is often dicult to observe because internal signals are no longer accessible(Kamga, Herrmann, and Joshi 2007). For these reasons, the number of in-vehicle testsdecreases as MBT increases.

In the following, the execution options from the perspective of test reactiveness are dis-cussed. Reactive testing and the related work on the reactive/nonreactive are reviewed.Some considerations on this subject are covered in more detail in Chapter 15.

Reactive/Nonreactive execution: Reactive tests are tests that apply any signal or dataderived from the SUT outp

Date post:	15-Dec-2015
Category:	Documents
Upload:	jaganathan-radhakrishnan
View:	88 times
Download:	6 times

Model-Based test

Documents