Symbolic Observation Graph-Based Generation of Test Paths

Abstract

The paper introduces a theoretical foundation for generating abstract test paths related to Petri net specifications. Based on the structure of the Petri net model of the system, we first define the notion of unobservable transition. Unless such a transition is unreachable, we prove that its firing is necessarily ensured by the firing of another transition (namely observable transition) of the Petri net. We show that the set of observable transitions is the smallest set that guarantees the coverage of all the transitions of the Petri net model, i.e., any set of firing sequences of the model, namely observable traces, involving all the observable transitions passes eventually through the unobservable transitions as well. If some unobservable transitions are mandatory to trigger the execution of a test sub-sequence, observable traces are completed with such transitions to enhance the controllability of the test scenario. In addition to structurally identifying observable (and unobservable) transitions, we mainly propose two algorithms: the first allows to generate a set of observable paths ensuring full coverage of all the system transitions. It is based on an on-the-fly construction of a hybrid graph called the symbolic observation graph. The second algorithm completes the observable paths in order to explicitly cover the whole set of system’s transitions. The approach is implemented within an available prototype, and the preliminary experiments are promising.

Appendices

A Proof of Lemma 1

Proof

Let t be an unobservable transition, p be a place in $t^{\sim }$ and $t'\in {p}^\bullet$. Assume that there exists a firing sequence $\sigma .t'$. Given that place p is not marked initially and that no transition, except t, can produce a token in p, t must be fired before $t'$ to produce the necessary token in p.

B Proof of Lemma 2

Proof

Let $(\mathcal {N},m_0)$ be a marked Petri net, $t_0 \in UnObs$ be an unobservable transition, $p\in t_0^\sim$ be an output place of $t_0$ having $t_0$ as unique input transition, and $t_1\in {p}^\bullet$ be an output transition of p. Then, by Lemma 1, $t_1\triangleright t_0$. If $t_1$ is observable, then the lemma is proved. Else, by an iterative application of this reasoning, by the transitivity of the coverage relation $\triangleright$ and by the fact that the number of transitions in a Petri net is finite, we end on two possible cases: (1) there exists a transition $t_n \in Obs$ s.t. $t_n \triangleright t_{n-1} \triangleright \dots \triangleright t_0$, or (2) $t_0$ belongs to an unobservable cycle, which proves the Lemma.

C Proof of Lemma 3

Proof

Let t be a transition of the cycle, and $p\in \,\!^\bullet {t}$ be the input place of t that belongs to the cycle. p is initially empty because the (unique) transition $t'\in \,\!^\bullet {p}$ belongs to the cycle and hence is unobservable. Thus, place p will never be marked because $t'$ is dead by a successive application of Corollary 1 from t.

D Proof of Theorem 2

Proof

Assume that $Obs ' \subset Obs$ is the smallest subset of transitions satisfying Theorem 1. Let $t \in Obs \setminus Obs '$, there exists then a transition $t' \in Obs '$ s.t. $t'\triangleright t$, i.e., $\forall$ firing sequence $t_1 \dots t_n.t'$ (for $n \ge 1$), $\exists i\in \{1,\dots ,n\}$ s.t., $t=t_i$. Let $p\in {t}^\bullet \cap \,\!^\bullet {t^\prime }$. Then, by Definition 7, p is necessarily not marked, otherwise the sequence $t_{i+1}\dots t_n.t'$ is a firing sequence that does not contain t. Also, there exists a transition $t_i'\ne t$ in $\,\!^\bullet {p}$, otherwise t is unobservable. If $t_i'$ is observable, then there exists a firing sequence $\beta .t_i'$ which makes the sequence $\beta .t_i'.t_{i+1} \dots t_n.t'$ a firing sequence not involving t, and that is not possible. If $t_i'$ is unobservable, then, by using Lemma 2, there exists a transition $t_i'' \in Obs$ s.t. $t_i'' \triangleright t_i'$. By hypothesis, there exists a sequence $\alpha .t_i'.\gamma .t_i''$. Thus, the sequence $\alpha .t_i'.t_{i+1}\dots t_n.t'$ covers $t'$ but not t, which is impossible. To conclude, such a transition t could not exist and $Obs '$ is necessarily equal to $Obs$.