Foundations of Software Testing

Chapter 1: Preliminaries
Aditya P. Mathur
Purdue University

These slides are copyrighted. They are for use

with the Foundations of Software Testing
book by Aditya Mathur. Please use the slides
but do not remove the copyright notice.

Last update: December 23, 2009

Program representation: Control flow graphs

©Aditya P. Mathur 2009

 Program representation: Basic blocks

A basic block in program P is a sequence of consecutive

statements with a single entry and a single exit point. Thus
a block has unique entry and exit points.
Control always enters a basic block at its entry point and exits
from its exit point. There is no possibility of exit or a halt at any
point inside the basic block except at its exit point. The entry
and exit points of a basic block coincide when the block
contains only one statement.

©Aditya P. Mathur 2009

 Basic blocks: Example
Example: Computing x raised to y

©Aditya P. Mathur 2009

 Basic blocks: Example (contd.)
Basic blocks

©Aditya P. Mathur 2009

 Control Flow Graph (CFG)

A control flow graph (or flow graph) G is defined as a finite set N of

nodes and a finite set E of edges. An edge (i, j) in E connects two
nodes ni and nj in N. We often write G= (N, E) to denote a flow
graph G with nodes given by N and edges by E.

©Aditya P. Mathur 2009

 Control Flow Graph (CFG)

In a flow graph of a program, each basic block becomes a node

and edges are used to indicate the flow of control between
blocks.

Blocks and nodes are labeled such that block bi corresponds to

node ni. An edge (i, j) connecting basic blocks bi and bj implies
that control can go from block bi to block bj.
We also assume that there is a node labeled Start in N that has no
incoming edge, and another node labeled End, also in N, that has
no outgoing edge.
©Aditya P. Mathur 2009
 CFG Example

N={Start, 1, 2, 3, 4, 5, 6, 7,
8, 9, End}
E={(Start,1), (1, 2), (1, 3), (2,4),
(3, 4), (4, 5), (5, 6), (6, 5),
(5, 7), (7, 8), (7, 9), (9, End)}

©Aditya P. Mathur 2009

 CFG Example

Same CFG with statements

removed.

N={Start, 1, 2, 3, 4, 5, 6, 7,
8, 9, End}
E={(Start,1), (1, 2), (1, 3), (2,4),
(3, 4), (4, 5), (5, 6), (6, 5),
(5, 7), (7, 8), (7, 9), (9, End)}

©Aditya P. Mathur 2009

 Paths

Consider a flow graph G= (N, E). A sequence of k edges, k>0,

(e_1, e_2, … e_k) , denotes a path of length k through the flow
graph if the following sequence condition holds.

Given that np, nq, nr, and ns are nodes belonging to N,

and 0< i<k, if ei = (np, nq) and ei+1 = (nr, ns) then nq = nr.
}

©Aditya P. Mathur 2009

 Paths: sample paths through the
exponentiation flow graph

Two feasible and complete paths:

p1= ( Start, 1, 2, 4, 5, 6, 5, 7, 9, End)
p2= (Start, 1, 3, 4, 5, 6, 5, 7, 9, End)
Specified unambiguously using edges:

p1= ( (Start, 1), (1, 2), (2, 4), (4, 5), (5,
6), (6, 5), (5, 7), (7, 9), (9, End))

Bold edges: complete path.

Dashed edges: subpath.
©Aditya P. Mathur 2009
 Paths: infeasible paths

A path p through a flow graph for

program P is considered feasible if
there exists at least one test case which
when input to P causes p to be
traversed.

p1= ( Start, 1, 3, 4, 5, 6, 5, 7, 8, 9, End)

p2= (Start, 1, 1, 2, 4, 5, 7, 9, , End)

©Aditya P. Mathur 2009

 Number of paths

There can be many distinct paths through a program. A

program with no condition contains exactly one path that
begins at node Start and terminates at node End.

Each additional condition in the program can increases the

number of distinct paths by at least one.

Depending on their location, conditions can have a

multiplicative effect on the number of paths.

©Aditya P. Mathur 2009

Test generation

©Aditya P. Mathur 2009

 Test generation

Any form of test generation uses a source document. In the

most informal of test methods, the source document resides
in the mind of the tester who generates tests based on a
knowledge of the requirements.

In most commercial environments, the process is a bit more

formal. The tests are generated using a mix of formal and
informal methods either directly from the requirements
document serving as the source. In more advanced test
processes, requirements serve as a source for the development
of formal models.
©Aditya P. Mathur 2009
 Test generation strategies

Model based: require that a subset of the requirements be

modeled using a formal notation (usually graphical). Models:
Finite State Machines, Timed automata, Petri net, etc.

Specification based: require that a subset of the requirements

be modeled using a formal mathematical notation. Examples:
B, Z, and Larch.

Code based: generate tests directly from the code.

©Aditya P. Mathur 2009

 Test generation strategies (Summary)

©Aditya P. Mathur 2009

Strings and languages

©Aditya P. Mathur
2009
 Strings
Strings play an important role in testing. A string serves as
a test input. Examples: 1011; AaBc; “Hello world”.

A collection of strings also forms a language. For example, a set

of all strings consisting of zeros and ones is the language of
binary numbers. In this section we provide a brief introduction to
strings and languages.

©Aditya P. Mathur 2009

 Alphabet

A collection of symbols is known as an alphabet. We use

an upper case letter such as X and Y to denote alphabets.

Though alphabets can be infinite, we are concerned only with

finite alphabets. For example, X={0, 1} is an alphabet consisting
of two symbols 0 and 1. Another alphabet is Y={dog, cat, horse,
lion}that consists of four symbols ``dog", ``cat", ``horse", and
``lion".

©Aditya P. Mathur 2009

 Strings over an Alphabet
A string over an alphabet X is any sequence of zero or
more symbols that belong to X. For example, 0110 is a
string over the alphabet {0, 1}. Also, dog cat dog dog lion
is a string over the alphabet {dog, cat, horse, lion}.

We will use lower case letters such as p, q, r to denote strings. The

length of a string is the number of symbols in that string. Given a string
s, we denote its length by |s|. Thus |1011|=4 and |dog cat dog|=3. A
string of length 0, also known as an empty string, is denoted by .

Note that  denotes an empty string and also stands for “element
of” when used with sets.
©Aditya P. Mathur 2009
 String concatenation

Let s1 and s2 be two strings over alphabet X. We write s1.s2 to

denote the concatenation of strings s1 and s2.

For example, given the alphabet X={0, 1}, and two strings 011
and 101 over X, we obtain 011.101=011101. It is easy to see that
|s1.s2|=|s1|+|s2|. Also, for any string s, we have s.  =s and .s=s.

©Aditya P. Mathur 2009

 Languages

A set L of strings over an alphabet X is known as a language. A

language can be finite or infinite.

The following sets are finite languages over the binary alphabet
{0, 1}:

: The empty set

{}: A language consisting only of one string of length zero
{00, 11, 0101}: A language containing three strings

©Aditya P. Mathur 2009

 Regular expressions

Given a finite alphabet X, the following are regular expressions

over X:

If a belongs to X, then a is a regular expression that denotes the set

{a}.

Let r1 and r2 be two regular expressions over the alphabet X that

denote, respectively, sets L1 and L2. Then r1.r2 is a regular
expression that denotes the set L1.L2.

©Aditya P. Mathur 2009

 Regular expressions (contd.)

If r is a regular expression that denotes the set L then r+ is a

regular expression that denotes the set obtained by concatenating
L with itself one or more times also written as L+ Also, r* known
as the Kleene closure of r, is a regular expression. If r denotes
the set L then r* denotes the set {} L+.

If r1 and r2 are regular expressions that denote, respectively, sets

L1 and L2, then r1r2 is also a regular expression that denotes the set
L1  L2.

©Aditya P. Mathur 2009

Formal Methods in SE
Problems with
Conventional Specification
 contradictions
 ambiguities
 vagueness
 incompleteness
 mixed levels of abstraction
Formal Specification
 Desired properties—consistency, completeness, and lack of
ambiguity—are the objectives of all specification methods
 The formal syntax of a specification language (Section 28.4)
enables requirements or design to be interpreted in only one
way, eliminating ambiguity that often occurs when a natural
language (e.g., English) or a graphical notation must be
interpreted
 The descriptive facilities of set theory and logic notation (Section
28.2) enable clear statement of facts (requirements).
 Consistency is ensured by mathematically proving that initial
facts can be formally mapped (using inference rules) into later
statements within the specification.
Formal Methods Concepts
 data invariant—a condition that is true throughout the execution of the
system that contains a collection of data
 state
 Many formal languages, such as OCL (Section 28.5) , use the notion of
states as they were discussed in Chapters 7 and 8, that is, a system can be
in one of several states, each representing an externally observable mode of
behavior.
 The Z language (Section 28.6)defines a state as the stored data which a
system accesses and alters
 operation—an action that takes place in a system and reads or writes
data to a state
 precondition defines the circumstances in which a particular operation is
valid
 postcondition defines what happens when an operation has completed its
action
Mathematical Concepts
 sets and constructive set specification
 set operators
 logic operators
 e.g., i, j: • i > j i2 => j2
 which states that, for every pair of values in
the set of natural numbers, if i is greater
than j, then i2 is greater than j2.
 sequences
 Sets and Constructive Specification
 A set is a collection of objects or elements and is used
as a cornerstone of formal methods.
 Enumeration

 {C++, Pascal, Ada, COBOL, Java}

 #{C++, Pascal, Ada, COBOL, Java} implies

cardinality = 5
 Constructive set specification is preferable to

enumeration because it enables a succinct

definition of large sets.
 {x, y : N | x + y = 10 (x, y2)}
Set Operators
 A specialized set of symbology is used to represent set and logic operations.
 Examples
 The P operator is used to indicate membership of a set. For example,
the expression
 xPX
 The operators , , and # take sets as their operands. The predicate
 A , B

 has the value true if the members of the set A are contained in the set
B and has the value false otherwise.
 The union operator, <, takes two sets and forms a set that contains all the
elements in the set with duplicates eliminated.
 {File1, File2, Tax, Compiler} < {NewTax, D2, D3, File2} is the set
 {Filel, File2, Tax, Compiler, NewTax, D2, D3}
Logic Operators
 Another important component of a formal method is logic: the algebra
of true and false expressions.
 Examples:
 V or
 ¬ not
 => implies
 Universal quantification is a way of making a statement about the
elements of a set that is true for every member of the set. Universal
quantification uses the symbol, . An example of its use is
 i, j : N i > j => i 2 > j 2
 which states that for every pair of values in the set of natural numbers,
if i is greater than j, then i2 is greater than j 2.