1. White-Box Testing Techniques III
Software Testing and Verification
Lecture 9
Prepared by
Stephen M. Thebaut, Ph.D.
University of Florida

2. White-Box Testing Topics
Logic coverage (lecture I)
Dataflow coverage (lecture II)
Path conditions and symbolic evaluation (lecture III)
Other white-box testing strategies (e.g., “fault-based testing”) (lecture IV)

3. Path Conditions
With a little luck, at least some white-box coverage goals will have been met by executing test cases designed using black-box strategies. (How would you know if this were the case or not?)
Designing additional test cases for this purpose involves identifying inputs that will cause given program paths to be executed. This can be difficult...

4. Path Conditions (cont’d)
To cause a path to be executed requires that the test case satisfy the path condition.
For a given path, the PATH CONDITION is the conjunction of branch predicates that are required to hold for all the branches along the path to be taken.

5. Consider an example… (1) input(A,B) if (A>0) then (2) Z := A else
end_if_else
if (B>0) then
(4) Z := Z+B
end_if
(5) output(Z)
What is the path condition for path <1,2,5>?

6. Consider ANOTHER example…
(1) input(A,B)
if (A>B) then
(2) B := B*B
end_if
if (B<0) then
(3) Z := A
else
(4) Z := B
end_if_else
(5) output(Z)
What is the path condition for path <1,2,3,5>?

7. Conclusions
To be useful, path conditions should be expressed in terms that reflect relevant state changes along the path.
A path is INFEASIBLE if its path condition reduces to FALSE.
Question: if a path is infeasible, does this imply the presence of “dead code”?

8. Symbolic Evaluation
Symbolic evaluation provides a technique for systematically tracking state changes for the purpose of expressing path conditions in useful terms.

9. Notation
A variable A will have a succession of symbolic values, A0, A1, A2, ..., as a path is traversed.
Subscripts refer to the number of the previous program statement (or block of statements) executed, so some numbers may be skipped.
With loops, statements may be executed more than once, so double subscripts will be used when necessary.

10. Notation (cont’d)
At each statement, the same notation is used to represent program variables regardless of path, but the symbolic values will usually be different. For example:
The notation used for the symbolic value of variable X immediately after executing statement 5 is always denoted “X5”; how-ever, the symbolic value itself depends on which execution path is taken to statement 5.

11. Example 1 There are 4 paths. PATH T,T (1) X1 = X02 Y1 = Y02
if (X<=0) or (Y<=0) then
(1) X := X**2
Y := Y**2
else
(2) X := X+1
Y := Y+1
end_if_else
if (X<1) or (Y<1) then
(3) X := X+1
(4) X := X-1
Y := Y-1
There are 4 paths.
PATH T,T
(1) X1 = X02
Y1 = Y02
(3) X3 = X1 + 1 = X02 + 1
Y3 = Y1 + 1 = Y02 + 1 T

12. Example 1 (cont’d) There are 4 paths. PATH T,F (1) X1 = X02 Y1 = Y02
if (X<=0) or (Y<=0) then
(1) X := X**2
Y := Y**2
else
(2) X := X+1
Y := Y+1
end_if_else
if (X<1) or (Y<1) then
(3) X := X+1
(4) X := X-1
Y := Y-1
There are 4 paths.
PATH T,F
(1) X1 = X02
Y1 = Y02
(4) X4 = X1 - 1 = X02 - 1
Y4 = Y1 - 1 = Y02 - 1 F

13. Example 1 (cont’d) There are 4 paths. PATH F,T (2) X2 = X0 + 1
if (X<=0) or (Y<=0) then
(1) X := X**2
Y := Y**2
else
(2) X := X+1
Y := Y+1
end_if_else
if (X<1) or (Y<1) then
(3) X := X+1
(4) X := X-1
Y := Y-1
There are 4 paths.
PATH F,T
(2) X2 = X0 + 1
Y2 = Y0 + 1
(3) X3 = X2 + 1 = X0 + 2
Y3 = Y2 + 1 = Y0 + 2 T

14. Example 1 (cont’d) There are 4 paths. PATH F,F (2) X2 = X0 + 1
if (X<=0) or (Y<=0) then
(1) X := X**2
Y := Y**2
else
(2) X := X+1
Y := Y+1
end_if_else
if (X<1) or (Y<1) then
(3) X := X+1
(4) X := X-1
Y := Y-1
There are 4 paths.
PATH F,F
(2) X2 = X0 + 1
Y2 = Y0 + 1
(4) X4 = X2 - 1 = X0
Y4 = Y2 - 1 = Y0 F

15. Path Conditions Revisited
Having symbolically evaluated the program variables along a path, we can now symbolically represent the branch predicates that are required to hold in order for the path to be traversed.
The symbolic variable values used in each branch predicate are the values which the variables have when the branch predicate is encountered.

16. Path Conditions Revisited
To simplify the task of identifying inputs that will cause the path to be executed, path conditions should be expressed in terms of the initial symbolic values of variables.

17. Example 1 (revisited) T if (X<=0) or (Y<=0) then (1) X := X**2
Y := Y**2
else
(2) X := X+1
Y := Y+1
end_if_else
if (X<1) or (Y<1) then
(3) X := X+1
(4) X := X-1
Y := Y-1
PATH T,T
Variable values:
X1 = X Y1 = Y02
X3 = X Y3 = Y02 + 1
Path Condition:
= ((X0 £ 0) or (Y0 £ 0)) and
((X1 < 1) or (Y1 < 1))
((X02 < 1) or (Y02 < 1))
= ((X0 £ 0) or (Y0 £ 0) ) and
((-1 < X0 < 1) or (-1 < Y0 < 1)) T

18. Example 1 (revisited) T if (X<=0) or (Y<=0) then (1) X := X**2
Y := Y**2
else
(2) X := X+1
Y := Y+1
end_if_else
if (X<1) or (Y<1) then
(3) X := X+1
(4) X := X-1
Y := Y-1
PATH T,F
Variable values:
X1 = X Y1 = Y02
X4 = X Y4 = Y02 - 1
Path Condition:
= ((X0 £ 0) or (Y0 £ 0)) and
((X1 ≥ 1) and (Y1 ≥ 1))
((X02 ≥ 1) and (Y02 ≥ 1))
= ((X0 £ 0) or (Y0 £ 0)) and
((X0 £ -1) or (X0 ≥ 1)) and
((Y0 £ -1) or (Y0 ≥ 1)) F

19. Example 1 (revisited) F if (X<=0) or (Y<=0) then (1) X := X**2
Y := Y**2
else
(2) X := X+1
Y := Y+1
end_if_else
if (X<1) or (Y<1) then
(3) X := X+1
(4) X := X-1
Y := Y-1
PATH F,T
Variable values:
X2 = X Y2 = Y0 + 1
X3 = X Y3 = Y0 + 2
Path Condition:
= ((X0 > 0) and (Y0 > 0)) and
((X2 < 1) or (Y2 < 1))
((X0 + 1 < 1) or (Y0 + 1 < 1))
((X0 < 0) or (Y0 < 0))
= FALSE T

20. Example 1 (revisited) F if (X<=0) or (Y<=0) then (1) X := X**2
Y := Y**2
else
(2) X := X+1
Y := Y+1
end_if_else
if (X<1) or (Y<1) then
(3) X := X+1
(4) X := X-1
Y := Y-1
PATH F,F
Variable values:
X2 = X Y2 = Y0 + 1
X4 = X Y4 = Y0
Path Condition:
= ((X0 > 0) and (Y0 > 0)) and
((X2 ≥ 1) and (Y2 ≥ 1))
= ((X0 > 0) and (Y0 > 0)) and
((X0+1 ≥ 1) and (Y0+1 ≥1))
((X0 ≥ 0) and (Y0 ≥ 0))
= (X0 > 0) and (Y0 > 0) F

21. Summary of Path Conditions
TT: ((X0 £ 0) or (Y0 £ 0) ) and ((-1 < X0 < 1) or (-1 < Y0 < 1))
TF: ((X0 £ 0) or (Y0 £ 0)) and ((X0 £ -1) or (X0 ≥ 1)) and
((Y0 £ -1) or (Y0 ≥ 1))
FT: FALSE
FF: (X0 > 0) and (Y0 > 0)
The path domains in the (X0 ,Y0 ) plane may also be depicted graphically.

22. Graph of Path Domains

23. Incremental Generation of Path Conditions
Path conditions can also be generated incrementally, by considering the branches taken in a piecemeal fashion.

24. Example 2 PARTIAL PATH T Variable values: if (B > A+1) then
Partial path condition:
(B0 > A0+1)
if (B > A+1) then
(1) A := A+1
else
(2) B := B-1
end_if_else
if (B > -A+2) then
(3) A := A+2
(4) B := B+1
if (B <= 0) then .

25. Example 2 PARTIAL PATH F Variable values: if (B > A+1) then
Partial path condition:
(B0  A0+1)
if (B > A+1) then
(1) A := A+1
else
(2) B := B-1
end_if_else
if (B > -A+2) then
(3) A := A+2
(4) B := B+1
if (B <= 0) then .

26. Partial Path Domains B0 T A0
B0 = A0 + 1 F

27. Example 2 (cont’d) . PARTIAL PATH TT Variable values:
A1 = A0 +1
B1 = B0
Partial path condition:
(B0 > A0+1) and
(B1 > -A1+2)
= (B0 > A0+1) and
(B0 > -A0+1)
if (B > A+1) then
(1) A := A+1
else
(2) B := B-1
end_if_else
if (B > -A+2) then
(3) A := A+2
(4) B := B+1
if (B <= 0) then . T

28. Example 2 (cont’d) . PARTIAL PATH TF Variable values:
A1 = A0 +1
B1 = B0
Partial path condition:
(B0 > A0+1) and
(B1  -A1+2)
= (B0 > A0+1) and
(B0  -A0+1)
if (B > A+1) then
(1) A := A+1
else
(2) B := B-1
end_if_else
if (B > -A+2) then
(3) A := A+2
(4) B := B+1
if (B <= 0) then . F

29. Example 2 (cont’d) . PARTIAL PATH FT Variable values:
A2 = A0
B2 = B0-1
Partial path condition:
(B0 A0+1) and
(B2 > -A2+2)
= (B0  A0+1) and
(B0 > -A0+3)
if (B > A+1) then
(1) A := A+1
else
(2) B := B-1
end_if_else
if (B > -A+2) then
(3) A := A+2
(4) B := B+1
if (B <= 0) then . T

30. Example 2 (cont’d) . PARTIAL PATH FF Variable values:
A2 = A0
B2 = B0-1
Partial path condition:
(B0 A0+1) and
(B2  -A2+2)
= (B0  A0+1) and
(B0  -A0+3)
if (B > A+1) then
(1) A := A+1
else
(2) B := B-1
end_if_else
if (B > -A+2) then
(3) A := A+2
(4) B := B+1
if (B <= 0) then . F

31. Partial Path Domains (cont’d)B0
B0 = -A0 + 1 TT FT TF A0
B0 = -A0 + 3
B0 = A0 + 1 FF

32. Example 2 (cont’d) . PARTIAL PATH TTT Variable values:
A1 = A0 +1
A3 = A1 + 2 = A0 + 3
B3 = B1 = B0
Partial path condition:
(B0 > A0+1) and
(B0 > -A0+1) and
(B3  0) = (B0  0)
= FALSE
if (B > A+1) then
(1) A := A+1
else
(2) B := B-1
end_if_else
if (B > -A+2) then
(3) A := A+2
(4) B := B+1
if (B <= 0) then . T T

33. Loops
In general, the simplification of path conditions involving loops is very difficult.
The simplest form that is obtainable for N iterations of a loop may involve N terms.
“N iterations” =
While loop body executes N-1 times
Repeat_Until loop body executes N times

34. Example 3 (1) C := 0 Variable values: (Y does not change)
while (X>=Y) do
(2) X := X-Y
C := C+1
end_while
Variable values: (Y does not change)
(1) X1 = X0
C1 = 0
(2,1) X2,1 = X1 – Y1 = X0 – Y0
C2,1 = C1 + 1 = 1
(2,2) X2,2 = X2,1 – Y2,1 = (X0 – Y0) - Y0 = X0 – 2Y0
C2,2 = C2,1 + 1 = 2

35. Example 3 (cont’d) (1) C := 0 Variable values: (cont’d)
while (X>=Y) do
(2) X := X-Y
C := C+1
end_while
Variable values: (cont’d)
(2,2) X2,2 = X0 – 2Y0
C2,2 = 2
(2,3) X2,3 = X2,2 – Y2,2 = (X0 – 2Y0) - Y0 = X0 – 3Y0
C2,3 = C2,2 + 1 = 3
(2,N) X2,N = X0 – NY0
C2,N = N

36. Example 3 (cont’d)
(1) C := 0
while (X>=Y) do
(2) X := X-Y
C := C+1
end_while
Path Condition for Path F: (loop body executed 0 times)
(X1 < Y1) = X0 < Y0
Path Condition for Path T,F: (loop body executed 1 time)
(X1 ≥ Y1) and (X2,1 < Y2,1)
= (X0 ≥ Y0) and (X0 - Y0 < Y0)
= (X0 ≥ Y0) and (X0 < 2Y0)
= Y0 ≤ X0 < 2Y0
Variable values:
X1= X0 C1= 0
X2,N = X0 – NY0
C2,N = N

37. Example 3 (cont’d) Variable values: X1= X0 C1= 0
while (X>=Y) do
(2) X := X-Y
C := C+1
end_while
Variable values:
X1= X0 C1= 0
X2,N = X0 – NY0 C2,N = N
Path Condition for Path T,T,F: (loop body executed 2 times)
(X1 ≥ Y1) and (X2,1 ≥ Y2,1) and (X2,2 < Y2,2)
= (X0 ≥ Y0) and (X0 - Y0 ≥ Y0) and (X0 - 2Y0 < Y0)
= (X0 ≥ Y0) and (X0 ≥ 2Y0) and (X0 < 3Y0)
= (X0 ≥ Y0) and (2Y0 ≤ X0 < 3Y0)
= 2Y0 ≤ X0 < 3Y0 since (2Y0 < 3Y0 ) => Y0 > 0 => (X0 ≥ 2Y0 => X0 ≥ Y0)

38. Example 3 (cont’d)
Path Condition for N>1 iterations of the loop:
(X1 ≥ Y1) and (X2,1 ≥ Y2,1) and … and (X2,N-1 ≥ Y2,N-1) and (X2,N < Y2,N)
It can be proven by induction that this condition may be expressed in CLOSED FORM as:
(N-1)Y0 ≤ X0 < NY0
with the implied (eventual termination) condition that Y0 > 0.

39. Path Conditions & Symbolic Evaluation Summary
To cause a path to be executed requires that the test case satisfy its path condition.
The path condition is the conjunction of branch predicates that are required to hold for all the branches along the path.
In general, the simplification of path conditions for loops is very difficult. (The simplest form that is obtainable for N iterations of a loop may involve N terms.)

40. Path Conditions & Symbolic Evaluation Summary (cont’d)
A path is infeasible if its path condition reduces to FALSE.
Symbolic evaluation provides a systematic method for expressing path conditions in terms of the initial symbolic values of program variables.

41. Path Conditions & Symbolic Evaluation Summary (cont’d)
This simplifies the task of identifying inputs that will cause the path to be executed.
But this “satisfiability problem” can be very difficult to solve…

42. Exactly HOW Difficult…?
Given a Boolean expression E, decide if there is some assignment to the variables in E such that E will be true.
This was the first problem shown to be NP-complete!

43. White-Box Testing Techniques III
Software Testing and Verification
Lecture 9
Prepared by
Stephen M. Thebaut, Ph.D.
University of Florida