This paper studies testing based on labelled transition systems, using the assumption that implementations communicate with their environment via inputs and outputs. Such implementations are formalized by restricting the class of transition systems to those systems that can always accept input actions, as in input/output automata. Implementation relations, formalizing the notion of conformance of these implementations with respect to labelled transition system specifications, are defined analogous to the theory of testing equivalence and preorder. A test generation algorithm is given, which is proved to produce a sound and exhaustive test suite from a specification, i.e., a test suite that fully characterizes the set of correct implementations.

Abstract. Model based testing is one of the promising technologies to meet the challenges imposed on software testing. In model based testing an implementation under test is tested for compliance with a model that describes the required behaviour of the implementation. This tutorial chapter describes a model based testing theory where models are expressed as labelled transition systems, and compliance is defined with the 'ioco' implementation relation. The ioco-testing theory, on the one hand, provides a sound and well-defined foundation for labelled transition system testing, having its roots in the theoretical area of testing equivalences and refusal testing. On the other hand, it has proved to be a practical basis for several model based test generation tools and applications. Definitions, underlying assumptions, an algorithm, properties, and several examples of the ioco-testing theory are discussed, involving specifications, implementations, tests, the ioco implementation relation and some of its variants, a test generation algorithm, and the soundness and exhaustiveness of this algorithm.

This paper discusses the use of formal methods in testing of concurrent systems. It is argued that formal methods and testing can be mutually profitable and useful. A framework for testing based on formal specifications is presented. This framework is elaborated for labelled transition systems, providing formal definitions of conformance, test execution and test derivation. A test derivation algorithm is given and its tool implementation is briefly discussed. This research is supported by the Dutch Technology Foundation STW under project STW TIF.4111: Côte de Resyste -COnformance TEsting of REactive SYSTEms; URL: http://fmt.cs.utwente.nl/CdR.

Compositional testing concerns the testing of systems that consist of communicating components which can also be tested in isolation. Examples are component based testing and interoperability testing. We show that, with certain restrictions, the ioco-test theory for conformance testing is suitable for compo sitional testing, in the sense that the integration of fully conformant components is guaranteed to be correct. As a consequence, there is no need to re-test the inte grated system for conformance. This result is also relevant for testing in context, since it implies that every failure of a system embedded in a test context can be reduced to a fault of the system itself. * This research was supported by Ordina Finance and by the dutch research programme PROGRESS under project: TES5417: Atomyste-ATOm splitting in eMbedded sYStems TEsting. Another scenario, with similar characteristics, is testing in context. This refers to the situation that a tester can only access the implementation under test through a test context [7,8,9]. The test context interfaces between the implementation under test and the tester. As a consequence the tester can only indirectly observe and control the iu t via the test context. This makes testing weaker, in the sense that there are fewer pos sibilities for observation and control of the iu t. With testing in context, the question is whether faults in the iu t can be detected by testing the composition of iu t and test context, and whether a failure of this composition always indicates a fault of the iut. This question is the converse of compositional testing: when testing in context we wish to detect errors in the iu t-a component-by testing it in composition with the test context, whereas in compositional testing we wish to infer correctness of the integrated system from conformance of the individual components. This paper studies the above mentioned compositionality properties of ioco for two operations on labeled transition systems: parallel composition and hiding. if ioco has this compositionality property for these operations, it follows that correctness of the parts (the components) implies correctness of the whole (the integrated system), or that a fault in the whole (iut and test context) implies a fault in the component (iut). This compositionality property is formally called a pre-congruence. We show that ioco is a pre-congruence for parallel composition and hiding in the absence of underspecification of input actions. One way to satisfy this condition is to only allow specifications which are input enabled. Another way is to make the under specification explicit by completion. We show that, in particular, demonic completion is suitable for this purpose. As a final result we show how to use the original (uncom pleted) specifications and still satisfy the pre-congruence property. This leads to a new implementation relation, baptized ioco v which is slightly weaker than ioco. This paper has two main results. First we show a way to handle underspecifica tion of input actions wh...

This paper studies testing based on iabelled transition systems, presenting two test generation algorithms with their corresponding implementation relations. The first algorithm assumes that implementations communicate with their environment via symmetric, synchronous interactions. It is based on the theory of testing equivalence and preorder, as is most of the testing theory for labelled transition systems, and it is found in the literature in some slightly different variations. The second algorithm is based on the assumption that implementations communicate with their environment via inputs and outputs. Such implementations are formalized by restricting the class of labelled transition systems to those systems that can always accept input actions. For these implementations a testing theory is developed, analogous to the theory of testing equivalence and preorder. It consists of implementation relations formalizing the notion of conformance of these implementations with respect to labelled transition system specifications, test cases and test suites, test execution, the notion of passing a test suite, and the test generation algorithm, which is proved to produce sound test suites for one of the implementation relations.