No abstract

Three approaches to the problem of testing synchronous critical software are presented, based on the data-$ow language LUSTRE. The first approach automatically transforms a set of LUSTRE invariant properties characterizing the environment into a constrained random generator of test data sequences. The second approach consists in analyzing the required safety properties (written in LUSTRE) of the software. This analysis may result, in specific cases, in automatic generators of relevant test data. The third approach considers that LUSTRE is used for the implementation of the software. Usual structure-based testing criteria are adapted to the operator net associated with LUSTRE nodes. Moreover, an automatic test data generation process is described for this last approach using LEM, a tool designed to automatically prove the satiqaction of safety properties on L U n m programs.

We advocate the use of the synchronous declarative language LUSTRE as a unique language for specifying and programming real-time systems. Furthermore, we show that the finite automaton produced by the LUSTRE compiler may be used for verifying many logical properties, by model checking. The paper deals with an example program, extracted from a railways regulation system.

We describe a uniform approach to specijj operational profiles for synchronous reactive software and to automatically generate random software inputs according to these profiles. The approach is general enough to allow realistic description of the operating environment : as the environment behavior is often characterized by properties expressing causal temporal dependencies, the operational profile specijication technique gives a means to assign to the next event issued by the environment a probability depending on any sequence of previous events. Two examples of reactive software controlling respectively a temperature control system and an elevator are used to illustrate the technique.

No abstract