Model‐based testing for concurrent systems with labelled event structures

An abstract definition of bisimulation is presented. It enables a uniform definition of bisimulation across a range of different models for parallel computation presented as categories. As examples, transition systems, synchronisation trees, transition systems with independence (an abstraction from Petri nets) and labelled event structures are considered. On transition systems the abstract definition readily specialises to Milner's strong bisimulation. On event structures it explains and leads to a revision of history-preserving bisimulation of Rabinovitch and Traktenbrot, Goltz and van Glabeek. A tie-up with open maps in a (pre)topos, as they appear in the work of Joyal and Moerdijk, brings to light a promising new model, presheaves on categories of pomsets, into which the usual category of labelled event structures embeds fully and faithfully. As an indication of its promise, this new presheaf model has ``refinement'' operators, though further work is required to justify their appropriateness and understand their relation to previous attempts. The general approach yields a logic, generalising Hennessy-Milner logic, which is characteristic for the generalised notion of bisimulation.

Modelling concurrent interactions

We explore the problem of finding a minimal complete test suite for a refusal trace (or failure trace) semantics. Since complete test suites are typically infinite, we consider the setting with a bound ℓ on the length of refusal traces of interest. A test suite T is thus complete if it is failed by all processes that contain a disallowed refusal trace of length at most ℓ.The proposed approach is based on generating a minimal complete set of forbidden refusal traces. Our solution utilises several interesting insights into refusal trace semantics. In particular, we identify a key class of refusals called fundamental refusals which essentially determine the refusal trace semantics, and the associated fundamental equivalence relation. We then propose a small but not necessarily minimal test suite based on our theory, which can be constructed with a simple algorithm. Subsequently, we provide an enumerative method to remove all redundant traces from our complete test suite, which comes in two variants, depending on whether we wish to retain the highly desirable uniform completeness (guarantee of shortest counterexamples).A related problem is the construction of a characteristic formula of a process P, that is, a formula ΦP such that every process which satisfies ΦP refines P. Our test generation algorithm can be used to construct such a formula using a variant of Hennessy-Milner logic with recursion.

Many Markovian stochastic structured modeling formalisms like Petri nets, automata networks and process algebra represent the infinitesimal generator of the underlying Markov chain as a descriptor instead of a traditional sparse matrix. A descriptor is a compact and structured storage based on a sum of tensor (Kronecker) products of small matrices that can be handled by many algorithms allowing affordable stationary and transient solutions even for very large Markovian models. One of the most efficient algorithms used to compute iterative solutions of descriptors is the Shuffle algorithm which is used to perform the multiplication by a probability vector. In this paper we propose an alternative algorithm called Split, since it offers a flexible solution between the pure sparse matrix approach and the Shuffle algorithm using a hybrid solution. The Split algorithm puts the Shuffle approach in perspective by presenting a faster execution time for many cases and at least the same efficiency for the worst cases. The Split algorithm is applied to solve two SAN models based on real problems showing the practical contribution of this paper.

Model-Based Testing (MBT) is a well-known technique that employs formal models to represent reactive systems’ behavior and generates test cases. Such systems have been specified and verified using mostly Finite State Machines (FSMs). There is a plethora of test generation algorithms in the literature; most of them are based on graphs once an FSM can be formally defined as a graph. Nevertheless, there is a lack of studies on analyzing cost and efficiency of FSM-based test generation algorithms. This study compares graph-based algorithms adopted to generate test cases from FSM models. In particular, we compare the Chinese Postman Problem (CPP) and H-Switch Cover (HSC) algorithms with the well-known Depth-First Search (DFS) and Breadth-First Search (BFS) algorithms in the context of covering all-transitions and all-transition-pairs criteria in an FSM. First, a systematic literature mapping was conducted to summarize the methods that have been adopted in MBT, considering FSMs. Second, the main methods found were implemented and analyzed on randomly-generated FSMs, as well as real-world models that represent embedded systems of space applications. To make comparisons, we considered analyses in terms of cost (time), efficiency (mutant analysis) and characteristics of the generated test suites (number of test cases, average length of test cases, largest and smallest test cases, standard deviation and distribution of test cases). In general, CPP presented the best results in terms of number of test cases and test suite size. In addition, CPP also presented low distribution of average length compared to other algorithms.

Context: Model-Based Testing (MBT) is a technique that employs formal models to represent reactive systems’ behav-ior and generates test cases. Such systems are mostly specified and verified using Finite State Machines (FSMs). There is a plethora of test generation algorithms in the literature. Most of them are graph-based once an FSM can be formally defined as a graph. Nevertheless, there is a lack of studies on analyzing cost and efficiency of FSM-based test generation algorithms. Objective: This study aims to compare graph-based algorithms employed to generate test cases from FSM models. In particular, we compare the Chinese Postman Problem (CPP) and H-Switch Cover (HSC) algorithms with the well-known depth-first and breadth-first searches algorithms in the context of covering all-transitions and all-transition-pairs criteria in an FSM. Method: First, a systematic literature mapping was conducted to summarize the algorithms that have been adopted in MBT, considering FSM. The main algorithms found were implemented and analyzed in different experiments. Results: CPP presented better results with the FSMs used in terms of number of test cases and test suite size. In addition, CPP also presented low distribution of average length compared to other algorithms.

It is more difficult to model a discrete system than a continuous system. Recently, a great number of applications of Petri nets to the design and the analysis of discrete systems has been reported. However, a common problem in its applications is that the required computer memories and the computation times increase explosively in accordance with the increase in the number of systems components. Some methods to divide or to reduce Petri nets have been proposed to solve this problem. Although the liveness and boundedness of Petri nets are held in the divided or reduced Petri nets, the reachability problem cannot be solved by these methods.This paper proposes another method to model discrete systems by Petri nets with place invariants. A sequential control system will be described as a typical kind of discrete system, and its structural characteristics will be used in modeling. Each component of a sequential control system will be modeled by a sub‐Petri net with place invariants. There are many components in one sequential control system, but not each one is necessarily complicated. Most sub‐Petri nets do not have so many places or transitions. It is also well known that a Petri net with place invariants is bounded and can be live by placing sufficient tokens into its initial marking. Besides, the reachability problem is not so difficult to solve in a small sub‐Petri net. Further, an activating relation to combine two or more sub‐Petri nets is defined, and some rules to reduce conflicts among enabled transitions will be described for simulations.

Finite state machines (FSM) are widely used in testing and verification of discrete event and hybrid systems. In order to guarantee fault coverage, various fault models and formal methods are utilized ranging from classical finite state machines (FSM) to logic circuits. The main problem for deriving an FSM-based test suite is the size of an FSM for real digital circuits, and thus, test engineers prefer to randomly derive a prefix of a test sequence and later on extend it with tests for hard detectable faults of a corresponding logic circuit. Usually at the latter step test sequences detecting hard detectable stuck-at faults are considered. In this paper, we are concerned about single functional faults, namely, <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\boldsymbol{a},\boldsymbol{b}-\mathbf{faults}$</tex> , of a system of Boolean functions of the combinational part of a sequential circuit such as deleting a variable or a cube in a SoP which represents the ON-set or the OFF-set of a corresponding Boolean function and experimentally evaluate fault coverage of a corresponding complete test suite with respect to fault coverage of tests returned by other methods. The experimental results show high fault coverage of test suites complete with respect to <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\boldsymbol{a},\boldsymbol{b}-\mathbf{faults}$</tex> and thus, it can be recommended to utilize such a test suite instead of a complete FSM-based test suite or to extend randomly generated test sequences for detecting <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\boldsymbol{a},\boldsymbol{b}-\mathbf{faults}$</tex> not killed with the prefix.

In this paper a method for high-level test generation for systems described in VHDL is presented. First, two test generation algorithms for VHDL processes are presented. The first algorithm works on processes which represent combinational logic whereas the second works on processes which represent sequential logic. The goal of both algorithms is to test all portions of the process body by traversing all the feasible paths. Employing these two algorithms, two new algorithms for system-level test generation for both combinational and sequential systems are presented. The approach employs software metrics as well as signal coverage for interconnections and state and transition coverage for FSMs.

Event Structures for Local Traces

Purpose. For chemical, food, woodworking, pharmaceutical and some other industries, the main fire hazard factor is the circulation of explosive dust and gas flows containing combustible dust. For their disposal and removal from the volumes of equipment and premises, production aspiration systems (PAS) are used, their effective functioning is the key to production safety, so the given work is aimed at developing an automated PAS control system that ensures fire safety, as well integrating PAS control system into ACS of the production. To achieve this goal, the tasks of identifying the main hazards, developing an information environment for the system, developing mechanisms for the interaction of PAS accident triggers with the information environment and other subsystems of the automated control system, and, ultimately, creating the concept of a single system – an integrated production safety management system (IPSMS) are considered. Methods. The task is carried out by systematizing information related to the specifics of developing and operating industrial aspiration systems and evaluating information using logical functions, as well as developing the model based on the graph theory, namely, describing the system operation using Petri nets. Findings. To achieve the goal, the concept of an integrated production safety management system is proposed. The concept takes into account the peculiarities of the technological process and integrating with the subsystems of the production automated control system to neutralize both local accidents and accidents that develop into large-scale emergencies. The system considers the specifics of the main technological equipment and hardware solutions for dust collection in PAS, the degree of production automation, the categories of premises according to explosion and fire hazard. Based on the information analysis, a sequence of actions has been developed to eliminate the accident or minimize its consequences. To implement the tasks of IPSMS, a mathematical model based on the Petri net has been developed. Research application field. The results obtained can be used to design and improve automated systems for preventing accidents, fires and explosions in industries associated with the handling of combustible dust. Conclusions. The use of IPSMS will simplify the decisionmaking process linked with the analysis of a large amount of highly specific information related to the operation of industrial aspiration systems. The proposed methods and models are reliable tools\for the system of intelligent decision making support in stressful situations.

By a “hybrid system” we mean a system of continuous plants, subject to disturbances, interacting with sequential automata in a network. “Hybrid Control” is the name we give to control of continuous plants by digital sequential control automata, that is, by control programs implemented on sequential automata. We associate, without using any approximations, sequential automata with continuous plants, and use this to bring sequential control automata and continuous plants into automata networks which themselves are sequential automata modelling hybrid systems. To be useful, the control automaton's ability to control plant trajectories in a hybrid system should be maintained under small changes in control laws, disturbance, trajectory, measurement, etc. We formalize this notion of controllability and observability for hybrid systems by continuity of system functions, including the input-output function of the control automaton, in non-Hausdorff subtopologies of the usual topologies on spaces of controls, sensor data, plants, disturbances, target sets, etc. These subtopologies arise from the limited ability of digital programs to discriminate between continuous inputs. These notions are appropriate for any knowledge or rule based system where automated deduction interacts in real time with the external world. This topological approach was announced in [46]. (What we call “controllability and observability” here is what we called “stability” in [46] in order to correspond somewhat more closely to usage in the literature [3].)

A PN (place/transition net) is known as an algebraic model that is useful for describing concurrent, distributed and asynchronous properties of software, and it is also recognized as a model of MBT (model-based testing) that is an important technique for developing high quality software. We propose a concurrent N-switch coverage criterion to generate test cases of high coverage levels from a PN representing test specifications of software. All sequences of successive fireable transitions of length N+1 on the PN can be covered by executing test cases that satisfy the concurrent N-switch coverage criterion. This paper shows its processes, work products, algorithms, and examples.

We introduce infinitary partial languages for Petri nets and study some of their properties. Earlier results on the interrelation between various Petri net semantics for finite behaviour are shown to be valid for infinite behaviour. As a consequence step sequences and event structures of processes both can be taken as a semantics for Petri nets without any loss of information.Via the introduction of infinite partial words it is possible to express the properties of justice and fairness in a natural way: justice can be characterized as maximality of progress and fairness as ‘fair’ conflict resolution. By this we overcome the ambiguity arising from the lack of discrimination between concurrency and non-determinism in the sequential approach.

We explore the problem of finding a minimal complete test suite for refusal trace (or failure trace) semantics. Our approach is based on generating a minimal complete set of forbidden refusal traces and utilises several interesting insights into the semantics. In particular, we identify a key class of refusals called fundamental refusals which essentially determine the refusal trace semantics, and the associated equivalence relation. We then propose a small but not necessarily minimal test suite, which can be constructed with a simple algorithm. Subsequently, we provide an enumerative method to remove all redundant traces from our complete test suite, which comes in two variants, depending on whether we wish to retain the highly desirable uniform completeness.We also address a related problem from modal logic, namely the construction of a characteristic formula of a given process with respect to refusal trace semantics, using a variant of Hennessy-Milner logic with recursion.