1. Testing Generation at UPenn Model-Based Test Generation I. Model-based test generation for discrete systems [HLS02]. Temp. Prop. Translator Controller Model Checker ---------------------- Witness generator  1 Æ …… Æ  n ii i ² ii ² i Concretization TS={  1,……,  n } Specification Model Implementation Coverage Criteria Test Suite II. Current works, 1. Lift the restriction on  i. 1. What is a testable property? Must be a linear-witness ready property. Can we lift this restriction? 2. Use desirable properties directly as the coverage criteria.

2. Testing Generation at UPenn Testing Hybrid System: Phase I 1. Randomized test generator=Randomized Simulator+ Coverage Checker. Randomization is introduced when 1. Both the discrete transition and continue update available 1. f=1.5 ) Continue Stay in mode A or take b? 2. Multiple trans. Enabled. Which one should be chosen? 1. f=2.5 and decide to take a trans ) should take b or c? 3. How long we should remain in a mode? 1. F=1.5 and decide to stay in mode A ) 0.1 s? 0.2 s? … Mode A df/dt=1 a: True:f=0 b: 1<f<3:m=1 c: 2<f<4:m=2 2. Coverage checker will keep a trace only if it helps reach the coverage criteria. 3. Current Status, 1. A working test generator has been built as the part of CHARON simulator.

3. Testing Generation at UPenn Testing Hybrid System: Phase II System Modeling CHARON (Model) Discrete transition Continuous modeAbstraction Discrete Model Predicate abstract Qualitative abstraction Reachability test /Bounded BFS Converter Implementation Coverage criteria Traces Test Suite

4. Testing Generation at UPenn Current status of implementation A randomized test generator finished the first phrase of development, Generator is a part of Charon simulator. Test generation is based on randomized execution. Mode and transition coverage are supported. Currently we are investigating smarter model-checking-guided test generation. Model coverage: if a node is unable to be reached by a randomized execution mark it as the bad state. call model checker to find a counterexample. A counterexample-ready model checker for hybrid system has been developed by Rajeev’s group.

5. Testing Generation at UPenn Theoretical research Property-coverage testing, Testing criteria is directly presented as temporal property. Testing will yield some decisive result Does the system satisfy the property? Does the system conform to the specification. Testing+monitering, checking the property on every execution. Con: Generally cannot prove whether system satisfies the property. Pro: Cheap (easy to implement) and generic (available even the abstraction-based model check cannot give a decisive positive result.) What is a testable property? Other coverage criteria can be accommodated in model-based test generation.