STM Notes - Unit-3
STM Notes - Unit-3
ON
MOTIVATION:
Flow graphs are being an abstract representation of programs.
Any question about a program can be cast into an equivalent question about an
appropriate flow graph.
Most software development, testing and debugging tools use flow graphs analysis
techniques.
PATH PRODUCTS:
Normally flow graphs used to denote only control flow connectivity.
The simplest weight we can give to a link is a name.
Using link names as weights, we then convert the graphical flow graph into an
equivalent algebraic like expressions which denotes the set of all possible paths
from entry to exit for the flow graph.
Every link of a graph can be given a name.
The link name will be denoted by lower case italic letters in tracing a path or path
segment through a flow graph, you traverse a succession of link names.
The name of the path or path segment that corresponds to those links is expressed
naturally by concatenating those link names.
For example, if you traverse links a,b,c and d along some path, the name for that
path segment is abcd. This pa
th name is also called a path product. Figure 5.1 shows some examples:
PATH PRODUCTS:
The name of a path that consists of two successive path segments is conveniently
expressed by the concatenation or Path Product of the segment names.
For example, if X and Y are defined as X=abcde,Y=fghij,then the
path corresponding to X followed by Y is denoted by
XY=abcdefghij
Similarly,
YX=fghijabcde
aX=aabcde
If X and Y represent sets of paths or path expressions, their product represents the set
of paths that can be obtained by following every element of X by any element
of Y in all possible ways. For example,
X = abc + def + ghi
oY = uvw + z Then,
XY = abcuvw + defuvw + ghiuvw + abcz + defz + ghiz
o If a link or segment name is repeated, that fact is denoted by an exponent. The
exponent's value denotes the number of repetitions:
a1 = a; a2 = aa; a3 = aaa; an = aaaa . . . n
times. Similarly, if X = abcde then
X1 = abcde
X2 = abcdeabcde = (abcde)2
X3 = abcdeabcdeabcde = (abcde)2abcde
= abcde(abcde)2 = (abcde)3
The path product is not commutative (that is XY!=YX).
o The path product is Associative.
RULE 1: A(BC)=(AB)C=ABC
where A,B,C are path names, set of path names or path expressions.
The zero power of a link name, path product, or path expression is also needed for
completeness. It is denoted by the numeral "1" and denotes the "path"
whose length is zero - that is, the path that doesn't have any links.
a0 = 1
X0=1
PATH SUMS:
The "+" sign was used to denote the fact that path names were part of the same set
of paths.
The "PATH SUM" denotes paths in parallel between nodes.
Links a and b in Figure 5.1a are parallel paths and are denoted by a + b. Similarly,
links c and d are parallel paths between the next two nodes and are denoted by c +
d.
The set of all paths between nodes 1 and 2 can be thought of as a set of parallel
paths and denoted by eacf+eadf+ebcf+ebdf.
If X and Y are sets of paths that lie between the same pair of nodes, then X+Y
denote the UNION of those set of paths. For example, in Figure 5.2:
DISTRIBUTIVE LAWS:
The product and sum operations are distributive, and the ordinary rules of
multiplication apply; that is
RULE 4: A(B+C)=AB+AC and (B+C)D=BD+CD
Applying these rules to the below Figure 5.1a yields
e(a+b)(c+d)f=e(ac+ad+bc+bd)f = eacf+eadf+ebcf+ebdf
ABSORPTION RULE:
If X and Y denote the same set of paths, then the union of these sets is unchanged;
consequently,
If a set consists of paths names and a member of that set is added to it, the "new"
name, which is already in that set of names, contributes nothing and can be
ignored.
For example,
if X=a+aa+abc+abcd+def then
X+a = X+aa = X+abc = X+abcd = X+def = X
It follows that any arbitrary sum of identical path expressions reduces to the same
path expression.
LOOPS:
Loops can be understood as an infinite set of parallel paths. Say that the loop consists of
a single link b. then the set of all paths through that loop point is
b0+b1+b2+b3+b4+b5+..............
RULES 6 - 16:
The following rules can be derived from the previous
rules: o RULE 6: Xn + Xm = Xn if n>m
RULE 6: Xn + Xm = Xm if m>n
RULE 7: XnXm = Xn+m
RULE 8: XnX* = X*Xn = X*
RULE 9: XnX+ = X+Xn = X+
RULE 10: X*X+ = X+X* = X+
RULE11:1+1=1
RULE 12: 1X = X1 = X
Following or preceding a set of paths by a path of zero length does not change the
set.
RULE 13: 1n = 1n = 1* = 1+ = 1
No matter how often you traverse a path of zero length, it is a path of zero
length. RULE 14: 1++1 = 1*=1
The null set of paths is denoted by the numeral 0. it obeys the following rules:
RULE 15: X+0=0+X=X
RULE 16: 0X=X0=0
If you block the paths of a graph for or aft by a graph that has no paths, there
won‘t be any paths.
REDUCTION PROCEDURE:
In the first way, we remove the self-loop and then multiply all outgoing links by
Z*.
In the second way, we split the node into two equivalent nodes, call them A and
A' and put in a link between them whose path expression is Z*. Then we remove
node A' using steps 4 and 5 to yield outgoing links whose path expressions are
Z*X and Z*Y.
Removing the loop and then node 6 result in the following expression:
a(bgjf)*b(c+gkh)d((ilhd)*imf(bjgf)*b(c+gkh)d)*(ilhd)*e
You can practice by applying the algorithm on the following flow graphs
and generate their respective path expressions:
13=10+11+12+13=1+1+1+1=4
E: Multiply the link weights inside the loop: 1 X 4 = 4
F: Evaluate the loop by multiplying the link weights: 2 X 4 = 8.
G: Simplifying the loop further results in the total maximum number
of paths in the flow graph:
2 X 84 X 2 = 32,768.
Alternatively, you could have substituted a "1" for each link in the path expression and
then simplified, as follows:
a(b+c)d{e(fi)*fgj(m+l)k}*e(fi)*fgh
1(1 + 1)1(1(1 x 1)31 x 1 x 1(1 + 1)1)41(1 x 1)31 x 1 x 1
2(131 x (2))413
2(4 x 2)4 x 4
2 x 84 x 4 = 32,768
This is the same result we got graphically. Actually, the outer loop should be taken exactly four
times. That doesn't mean it will be taken zero or four times. Consequently, there is a
superfluous "4" on the out link in the last step. Therefore the maximum number of different
paths is 8192 rather than 32,768.
STRUCTURED FLOWGRAPH:
Structured code can be defined in several different ways that do not involve ad-hoc rules such
as not using GOTOs.
A structured flow graph is one that can be reduced to a single link by successive application
of the transformations of Figure 5.7.
Figure 5.7: Structured Flow graph Transformations.
The node-by-node reduction procedure can also be used as a test for structured code. Flow
graphs that DO NOT contains one or more of the graphs shown below (Figure 5.8) as sub
graphs are structured.
Jumping into loops
Jumping out of loops
Branching into decisions
Branching out of decisions
The values of the weights are the number of members in a set of paths.
EXAMPLE:
Applying the arithmetic to the earlier example gives us the identical steps
until step 3 (C) as below:
This question can be answered under suitable assumptions primarily that all probabilities
involved are independent, which is to say that all decisions are independent and uncorrelated.
We use the same algorithm as before: node-by-node removal of uninteresting nodes.
Weights, Notations and Arithmetic:
Probabilities can come into the act only at decisions (including decisions
associated with loops).
Annotate each out link with a weight equal to the probability of going in
that direction.
Evidently, the sum of the out link probabilities must equal 1
For a simple loop, if the loop will be taken a mean of N times, the looping
probability is N/(N + 1) and the probability of not looping is 1/(N + 1).
A link that is not part of a decision node has a probability of 1.
The arithmetic rules are those of ordinary arithmetic.
In this table, in case of a loop, PA is the probability of the link leaving the
loop and PL is the probability of looping.
The rules are those of ordinary probability theory.
If you can do something either from column A with a probability
of PA or from column B with a probability P B, then the probability
that you do either is PA + PB.
For the series case, if you must do both things, and their
probabilities are independent (as assumed), then the probability
that you do both is the product of their probabilities.
For example, a loop node has a looping probability of P L and a probability
of not looping of PA, which is obviously equal to I - PL.
Following the above rule, all we've done is replace the outgoing
probability with 1 - so why the complicated rule? After a few steps in
which you've removed nodes, combined parallel terms, removed loops
and the like, you might find something like this:
Because PL + PA + PB + PC = 1, 1 - PL = PA + PB + PC, and
Which is what we‘ve postulated for any decision? In other words,
division by 1 - PL renormalizes the out link probabilities so that their sum
equals unity after the loop is removed.
EXAMPLE:
Here is a complicated bit of logic. We want to know the
probability associated with cases A, B, and C.
Let us do this in three parts, starting with case A. Note that the sum of the
probabilities at each decision node is equal to 1. Start by throwing away
anything that isn't on the way to case A, and then apply the reduction
procedure. To avoid clutter, we usually leave out probabilities equal to 1.
CASE A:
Case B is simpler:
These checks. It's a good idea when doing this sort of thing to calculate all
the probabilities and to verify that the sum of the routine's exit
probabilities does equal 1.
If it doesn't, then you've made calculation error or, more likely, you've left
out some bra How about path probabilities? That's easy. Just trace the path
of interest and multiply the probabilities as you go.
Alternatively, write down the path name and do the indicated arithmetic
operation.
Say that a path consisted of links a, b, c, d, e, and the associated
probabilities were .2, .5, 1., .01, and I respectively. Path abcbcbcdeabddea
would have a probability of 5 x 10-10.
Long paths are usually improbable.
EXAMPLE:
1. Start with the original flow graph annotated with probabilities and processing time.
2.Combine the parallel links of the outer loop. The result is just the mean of the
processing times for the links because there aren't any other links leaving the first
node. Also combine the pair of links at the beginning of the flow graph.
PUSH/POP, GET/RETURN:
This model can be used to answer several different questions that can turn up in debugging.
It can also help decide which test cases to design.
The question is:
Given a pair of complementary operations such as PUSH (the stack) and POP (the
stack), considering the set of all possible paths through the routine, what is the net effect
of the routine? PUSH or POP? How many times? Under what conditions?
Here are some other examples of complementary operations to which this model applies:
GET/RETURN a resource block.
OPEN/CLOSE a file.
START/STOP a device or process.
EXAMPLE 1 (PUSH / POP):
Here is the Push/Pop Arithmetic:
The numeral 1 is used to indicate that nothing of interest (neither
PUSH nor POP) occurs on a given link.
"H" denotes PUSH and "P" denotes POP. The operations
are commutative, associative, and distributive.
THE PROBLEM:
The generic flow-anomaly detection problem (note: not just data-flow anomalies,
but any flow anomaly) is that of looking for a specific sequence of
options considering all possible paths through a routine.
Let the operations be SET and RESET, denoted by s and r respectively, and we want
to know if there is a SET followed immediately a SET or a RESET followed
immediately by a RESET (an ss or an rr sequence).
Some more application examples:
A file can be opened (o), closed (c), read (r), or written (w). If the file is
read or written to after it's been closed, the sequence is nonsensical.
Therefore, cr and cw are anomalous. Similarly, if the file is read before
it's been written, just after opening, we may have a bug. Therefore, or is
also anomalous. Furthermore, oo and cc, though not actual bugs, are a
waste of time and therefore should also be examined.
A tape transport can do a rewind (d), fast-forward (f), read (r), write (w),
stop (p), and skip (k). There are rules concerning the use of the transport;
for example, you cannot go from rewind to fast-forward without an
intervening stop or from rewind or fast-forward to read or write without
an intervening stop. The following sequences are anomalous: df, dr, dw,
fd, and fr. Does the flow graph lead to anomalous sequences on any path?
If so, what sequences and under what circumstances?
The data-flow anomalies discussed in Unit 4 requires us to detect the dd,
dk, kk, and ku sequences. Are there paths with anomalous data flows?
THE METHOD:
Annotate each link in the graph with the appropriate operator or the null operator
1.
Simplify things to the extent possible, using the fact that a + a = a and 12 =
1. o You now have a regular expression that denotes all the possible sequences
of operators in that graph. You can now examine that regular expression for the
sequences of interest.
o EXAMPLE: Let A, B, C, be nonempty sets of character sequences whose
smallest string is at least one character long. Let T be a two-character string of
characters. Then if T is a substring of (i.e., if T appears within) AB nC, then T will
appear in AB2C. (HUANG's Theorem)
As an example,
let o A = pp
B = srr
C = rp
T = ss
A = p + pp + ps
B = psr + ps(r + ps)
C = rp
T=P4
LIMITATIONS:
Huang's theorem can be easily generalized to cover sequences of greater length
than two characters. Beyond three characters, though, things get complex and this
method has probably reached its utilitarian limit for manual application.
There are some nice theorems for finding sequences that occur at the beginnings
and ends of strings but no nice algorithms for finding strings buried in an
expression.
Static flow analysis methods can't determine whether a path is or is not
achievable. Unless the flow analysis includes symbolic execution or similar
techniques, the impact of unachievable paths will not be included in the analysis.
The flow-anomaly application, for example, doesn't tell us that there will be a flow
anomaly - it tells us that if the path is achievable, then there will be a flow anomaly. Such
analytical problems go away, of course, if you take the trouble to design routines for
which all paths are achievable.
INTRODUCTION:
The functional requirements of many programs can be specified by decision
tables, which provide a useful basis for program and test design.
Consistency and completeness can be analyzed by using Boolean algebra, which
can also be used as a basis for test design. Boolean algebra is trivialized by using
Karnaugh-Veitch charts.
"Logic" is one of the most often used words in programmers' vocabularies but one
of their least used techniques.
Boolean algebra is to logic as arithmetic is to mathematics. Without it, the tester
or programmer is cut off from many test and design techniques and tools that
incorporate those techniques.
Logic has been, for several decades, the primary tool of hardware logic designers.
o Many test methods developed for hardware logic can be adapted to software logic
testing. Because hardware testing automation is 10 to 15 years ahead of software
testing automation, hardware testing methods and its associated theory is a fertile
ground for software testing methods.
o As programming and test techniques have improved, the bugs have shifted closer
to the process front end, to requirements and their specifications. These bugs
range from 8% to 30% of the total and because they're first-in and last-out, they're
the costliest of all.
o The trouble with specifications is that they're hard to express.
o Boolean algebra (also known as the sentential calculus) is the most basic of all
logic systems.
o Higher-order logic systems are needed and used for formal specifications.
o Much of logical analysis can be and is embedded in tools. But these tools
incorporate methods to simplify, transform, and check specifications, and the
methods are to a large extent based on boolean algebra.
Action 1 will take place if conditions 1 and 2 are met and if conditions 3 and 4 are not met (rule
or if conditions 1, 3, and 4 are met (rule 2).
"Condition" is another word for predicate.
Decision-table uses "condition" and "satisfied" or "met". Let us use "predicate" and
TRUE / FALSE.
Now the above translations become:
Action 1 will be taken if predicates 1 and 2 are true and if predicates 3 and 4 are
false (rule 1), or if predicates 1, 3, and 4 are true (rule 2).
Action 2 will be taken if the predicates are all false, (rule 3).
Action 3 will take place if predicate 1 is false and predicate 4 is true (rule 4).
In addition to the stated rules, we also need a Default Rule that specifies the default action to
be taken when all other rules fail. The default rules for Table in Figure 6.1 is shown in
Figure 6.3
DECISION-TABLE PROCESSORS:
Decision tables can be automatically translated into code and, as such, are a
higher-order language
If the rule is satisfied, the corresponding action takes place
Otherwise, rule 2 is tried. This process continues until either a satisfied rule
results in an action or no rule is satisfied and the default action is taken
Decision tables have become a useful tool in the programmer‘s kit, in business
data processing.
The specification is given as a decision table or can be easily converted into one.
The orders, in which the predicates are evaluated does not affect interpretation of
the rules or the resulting action - i.e., an arbitrary permutation of the predicate
order will not, or should not, affect which action takes place.
The orders, in which the rules are evaluated does not affect the resulting action -
i.e., an arbitrary permutation of rules will not, or should not, affect which action
takes place.
Once a rule is satisfied and an action selected, no other rule need be examined.
If several actions can result from satisfying a rule, the order in which the actions
are executed doesn't matter.
DECISION-TABLES AND STRUCTURE:
PATH EXPRESSIONS:
GENERAL:
Logic-based testing is structural testing when it's applied to structure (e.g., control
flow graph of an implementation); it's functional testing when it's applied to a
specification.
In logic-based testing we focus on the truth values of control flow predicates.
A predicate is implemented as a process whose outcome is a truth-functional
value.
For our purpose, logic-based testing is restricted to binary predicates.
We start by generating path expressions by path tracing as in Unit V, but this
time, our purpose is to convert the path expressions into Boolean algebra, using
the predicates' truth values (e.g., A and ) as weights.
BOOLEAN ALGEBRA: o
STEPS:
Label each decision with an uppercase letter that represents the truth value
of the predicate. The YES or TRUE branch is labeled with a letter (say A)
and the NO or FALSE branch with the same letter over scored (say ).
The truth value of a path is the product of the individual labels.
Concatenation or products mean "AND". For example, the straight-
through path of Figure 6.5, which goes via nodes 3, 6, 7, 8, 10, 11, 12, and
2, has a truth value of ABC. The path via nodes 3, 6, 7, 9 and 2 has a value
of .
If two or more paths merge at a node, the fact is expressed by use of a plus
sign (+) which means "OR".
There are only two numbers in Boolean algebra: zero (0) and one (1). One means
"always true" and zero means "always false".
RULES OF BOOLEAN ALGEBRA:
Boolean algebra has three operators: X (AND), + (OR) and (NOT)
X: meaning AND. Also called multiplication. A statement such as AB (A
X B) means "A and B are both true". This symbol is usually left out as in
ordinary algebra.
+: meaning OR. "A + B" means "either A is true or B is true or both".
Meaning NOT. Also negation or complementation. This is read as either
"not A" or "A bar". The entire expression under the bar is negated.
The following are the laws of Boolean algebra:
In all of the above, a letter can represent a single sentence or an entire Boolean algebra
expression.
Individual letters in a Boolean algebra expression are called Literals (e.g. A, B)
The product of several literals is called a product term (e.g., ABC, DE).
An arbitrary Boolean expression that has been multiplied out so that it consists of the sum of
products (e.g., ABC + DEF + GH) is said to be in sum-of-products form.
The result of simplifications (using the rules above) is again in the sum of product form and each
product term in such a simplified version is called a prime implicant. For example, ABC + AB
DEF reduce by rule 20 to AB + DEF; that is, AB and DEF are prime
implicants. The path expressions of Figure 6.5 can now be simplified by applying
the rules. The following are the laws of Boolean algebra:
Similarly,
The deviation from the specification is now clear. The functions should have been:
Loops complicate things because we may have to solve a Boolean equation to determine what
predicate value combinations lead to where.
KV CHARTS:
INTRODUCTION:
If you had to deal with expressions in four, five, or six variables, you could get
bogged down in the algebra and make as many errors in designing test cases as
there are bugs in the routine you're testing.
Karnaugh-Veitch chart reduces Boolean algebraic manipulations to graphical
trivia.
Beyond six variables these diagrams get cumbersome and may not be effective.
SINGLE VARIABLE:
Figure 6.6 shows all the Boolean functions of a single variable and their
equivalent representation as a KV chart.
The charts show all possible truth values that the variable A can have.
A "1" means the variable‘s value is "1" or TRUE. A "0" means that the variable's
value is 0 or FALSE.
The entry in the box (0 or 1) specifies whether the function that the chart
represents is true or false for that value of the variable.
We usually do not explicitly put in 0 entries but specify only the conditions under
which the function is true.
Figure 6.6: KV Charts for Functions of a Single Variable.
TWO VARIABLES:
Figure 6.7 shows eight of the sixteen possible functions of two variables.
Each box corresponds to the combination of values of the variables for the row
and column of that box.
A pair may be adjacent either horizontally or vertically but not diagonally.
Any variable that changes in either the horizontal or vertical direction does not
appear in the expression.
In the fifth chart, the B variable changes from 0 to 1 going down the column, and
because the A variable's value for the column is 1; the chart is equivalent to a
simple A.
Figure 6.7: KV Charts for Functions of Two Variables.
OR
THREE VARIABLES:
KV charts for three variables are shown below.
As before, each box represents an elementary term of three variables with a bar
appearing or not appearing according to whether the row-column heading for
that box is 0 or 1.
A three-variable chart can have groupings of 1, 2, 4, and 8
boxes. o A few examples will illustrate the principles:
Figure 6.8: KV Charts for Functions of Three Variables.
You'll notice that there are several ways to circle the boxes into maximum-
sized covering groups.