Constructing checking sequences for distributed testing

Transcription

1 DOI /s BCS 2006 Formal Aspects of Computing (2006) 18: Formal Aspects of Computing Constructing checking sequences for distributed testing Hasan Ural and Craig Williams School of Information Technology and Engineering, University of Ottawa, Ottawa, Ontario, K1N 6N5, Canada Abstract. The objective of testing is to determine whether an implementation under test conforms to its specification. In distributed test architectures involving multiple remote testers, this objective can be complicated by the fact that testers may encounter coordination problems relating to controllability (synchronization) and observability during the application of tests. Based on a finite state machine (FSM) specification of the externally observable behaviour of a distributed system and a distinguishing sequence, this paper proposes a method for constructing a checking sequence where there is no potential controllability or observability problems, and where the use of external coordination message exchanges among testers is minimized. The proposed method does not assume a reliable reset feature in the implementations of the given FSM to be tested by the resulting checking sequence. Keywords: Distributed testing; Distributed test architectures; Controllability and observability problems; Test coordination; Finite state machine-based testing; Checking sequence 1. Introduction Finite state machine (FSM) model has been widely used to specify behaviour of various types of systems including distributed systems. A distributed system is an event-driven system whose functionality is well-characterized by state-based models in terms of its externally observable behaviour. Such a system has a number of interfaces, called ports, that are remote to each other. Programs or users at these ports are sources of inputs and destinations of outputs of the system. An FSM M models the externally observable behaviour of a distributed system N in terms of the sequences of inputs and outputs exchanged between a black box representing N and its environment at these ports. When testing a distributed system to ensure its correct functionality, a distributed test architecture is needed where a tester is placed at each port of the system under test (SUT) N and a checking sequence (i.e., a sequence of inputs constructed from the FSM M modeling the expected externally observable behaviour of the SUT N)is applied. A checking sequence constructed from M determines whether N is a correct or faulty implementation of M [Gil62, Hen64]. Note that there is nothing in the FSM model for the SUT that explicitly represents the distribution of testers to the remote ports, and this is only introduced once the assumptions are made that separate testers should be connected to the different ports, and that these testers need to communicate. A checking sequence of an FSM M is constructed in such a way that the output sequence produced by an implementation N of M in response to the application of the checking sequence provides sufficient information to Correspondence and offprint requests to: H. Ural, School of Information Technology and Engineering, University of Ottawa, Ottawa, Ontario, K1N 6N5, Canada. ural@site.uottawa.ca, phone: (Extn)6684, Fax:

2 Constructing checking sequences for distributed testing 85 verify that every state transition of M is implemented correctly by N. That is, in order to verify the implementation of a transition from state a to state b under input x, firstly, N must be transferred to the state recognized as state a of M; secondly, when the input x is applied, the output produced by N in response to x must be as specified in M; i.e., there must not be an output fault; and thirdly, the state reached by N after the application of x must be recognized as state b of M; i.e., there must not be a transfer fault. Hence, a crucial part of testing the correct implementation of each transition is recognizing the starting and terminating states of the transition which can be achieved by a distinguishing sequence [Hen64], a characterization set [Hen64] or a unique input output (UIO) sequence [SaD88]. It is known that a distinguishing sequence may not exist for every minimal FSM [Koh78], and that determining the existence of a distinguishing sequence for an FSM is PSPACE-complete [LeY94]. Nevertheless, based on distinguishing sequences, various methods have been proposed for FSM based testing (for example, [Hen64, Gon70, UWZ97]). During the application of a checking sequence to N in a distributed test architecture, the existence of multiple testers brings out the possibility of coordination problems among remote testers known as controllability and observability problems. These problems occur if a tester cannot determine either when to apply a particular input to an SUT, or whether a particular output from an SUT is generated in response to a specific input, respectively. Without loss of generality, let us consider a distributed architecture where there are two testers called, for instance, the lower tester (L) and the upper tester (U). In this architecture, U and L are two remote testers that are required to coordinate the application of a checking sequence. The controllability (synchronization) problem manifests itself when L (or U) is expected to send an input to N after N responds to an input from U (or L) with an output to U (or L), but L (or U) is unable to determine whether N sent that output. It is therefore important to construct a synchronizable checking sequence (i.e., a checking sequence that causes no controllability problems during its application in the distributed test architecture). However, for some FSMs, there may not exist a checking sequence in which no two consecutive inputs will cause a controllability problem [GuU95]. In this case, it is necessary for testers to communicate directly by exchanging external coordination messages over a dedicated channel during the application of the checking sequence such that testers can determine when to apply their own inputs. During the application of even a synchronizable checking sequence in a distributed test architecture, the observability problem manifests itself when L (or U) is expected to receive an output from N in response to either the previous or current input and because L (or U) is not the one to send the current input, L (or U) cannot determine when to start and stop waiting. Such observability problems hamper the detectability of output shift faults in N; i.e., an output associated with the current input is generated by N in response to either the previous input (when the shift is backward) or the next input (when the shift is forward). To ensure the detectability of output shift faults in N, a checking sequence needs to be augmented either by additional input sequences selected from FSM M [LDB94] or by exchanging external coordination messages between testers such that during the application of the checking sequence testers can determine whether the output observed is received in response to the correct input as specified in M. Controllability and observability problems in distributed testing are considered in the literature mainly by the methods for constructing a test sequence; i.e., an input sequence that assumes no transfer faults and thus, does not need to recognize the starting and terminating states of transitions. Among these methods, [SaB84, BoU91, UrW93, ChU95, TaY98] address solely the controllability problem whereas [LDB94, YoT98, CaR99, Hie01, UrW03a] consider both the controllability and observability problems. When the detection of both output and transfer faults is sought, then a checking sequence needs to be constructed. Among the checking sequence construction methods reported in the literature, [GuU95] considers only the controllability problem whereas [HiU03, UrW03b] address both the controllability and observability problems. [GuU95] and [HiU03] construct a checking sequence by assuming that external coordination message exchanges between testers are not available; that there is a UIO sequence starting with an input from each tester at each state; and that the SUT has a reliable reset feature. Each of these assumptions potentially restricts the applicability of these methods because there are FSMs for which there is no checking sequence that can be formed without using external coordination message exchanges; there is no UIO sequence for some states; and the SUT does not have a reliable reset feature. [UrW03b] relaxes the first two assumptions given above by allowing the use of external coordination message exchanges among remote testers and by utilizing a distinguishing sequence. However, it is only applicable to a SUT that has a reliable reset feature. This paper, without making any of the assumptions above, proposes a method for constructing a checking sequence that does not pose controllability and observability problems during its application in a distributed test architecture. Specifically, the proposed method yields a checking sequence where a distinguishing sequence is used for state recognition, where there is no potential controllability or observability problems, and where the

3 86 H. Ural and C. Williams use of external coordination message exchanges among testers is minimized. The minimization of the number of external coordination message exhanges is important due to the cost associated with the use of such messages. The rest of the paper is organized as follows. Related terminology is reviewed in Sect. 2. In Sect. 3, the proposed method is presented along with an illustrative example. Sect. 4 compares the proposed method to related existing work and Sect. 5 concludes with a summary and future research directions. 2. Preliminaries 2.1. FSM and its graphical representation For ease of presentation and readability, the proposed method will be presented using a 2-port FSM. The generalization of the method to n-port (n 2) FSM is simply a matter of adapting a different notation as the one given in [UrW03a]. A 2-port Finite State Machine (2 p-fsm) M =(S,,Ɣ,δ,λ, s 1 ) where S is a finite set of states of M. s 1 S is the initial state of M. = U L, where U(L) is the input alphabet of port U (or L), and U L =, let I = U L. Ɣ = Ɣ U Ɣ L, where Ɣ U(L) is the output alphabet of port U (or L), and Ɣ U Ɣ L =, let O = {< a U, a L a U(L) Ɣ U(L) { }}, where means no output is expected at port U (or L). δ is the transition function that maps S I to S, i.e., δ: S I S. λ is the output function that maps S I to O, i.e., λ: S I O. Henceforth, a 2p-FSM M or N will be called simply FSM M or N, respectively. This definition only allows multiple outputs, and not multiple inputs. This implies that there is no possibility of two inputs arriving at the ports simultaneously, and hence that when one input has been accepted there must be some delay before another arrives, so that there can be no queuing or buffering of inputs. An FSM M is deterministic if, for each input x I, there is at most one transition defined at each state of M. An FSM M is said to be minimal if none of its states are equivalent (i.e., s i, s j S, s i s j, an input sequence X I* such that λ(s i, X) λ(s j, X)). An FSM M is said to be completely specified if, for each input x I, there is a transition defined at each state of M. The 2p-FSM defined above is deterministic and completely specified. An FSM M can be represented by a directed graph (digraph) G =(V, E) where a set of vertices V represents the set S of states of M, and a set of directed edges E represents all transitions of M.Atransition t of an FSM M is a triple (s j, s k ; x/y), where s j,s k S, x I, and y O such that δ(s j,x)=s k,λ(s j,x)=y, and x/y is known as an input/output pair. Each edge e =(v j,v k ; x/y) E represents a transition t from state s j to state s k with input x and output y where the input/output pair x/y is the label of e, denoted label(e), v j is called the head of e, denoted head(e), and v k is called the tail of e, denoted tail(e). In this paper, each edge of a directed graph is associated with a cost (or length). Unless stated otherwise, the cost (or length) of an edge is the number of input/output pairs in its label. In particular, the cost (or length) of each edge of G =(V, E), representing an FSM M, is1. A path P =(v 1, v 2 ; x 1 / y 1 )(v 2, v 3 ; x 2 / y 2 ) (v k 1, v k ; x k 1 / y k 1 ), k >1,inG =(V, E) is a finite sequence of adjacent (but not necessarily distinct) edges in G, where v 1 and v k are head(p) and tail(p). The input/output sequence X/Y= x 1 / y 1, x 2 / y 2,...,x k 1 / y k 1 is called the label of P, denoted label(p), and is said to induce P at v 1. The path P is represented by (v 1, v k ; X/Y) where X/Y is x 1 / y 1 x 2 / y 2 x k 1 / y k 1, input sequence X = x 1, x 2,...,x k 1 is the input portion of X/Y, and output sequence Y = y 1, y 2,...,y k 1 is the output portion of X/Y. In this case, the input sequence X = x 1, x 2,...,x k 1 is said to induce P at v 1. The cost of a path (or length of a path) P in G is the sum of the costs (or lengths) of edges included in P and is denoted cost(p). The first transition (v 1, v 2 ; x 1 / y 1 )ofpathp is denoted first(p) and its last transition is denoted last(p). The concatenation ofapath A andapathb is denoted A@ B. A sequence i 1, i 2,...,i k is a subsequence of x 1, x 2,...,x m if there exists a, 0 m k, such that for all j,1 j k, i j = x j+. The subsequence i 1, i 2,..., i k is a prefix of x 1, x 2,...,x m if i 1 = x 1. A digraph G =(V, E)isstrongly connected if, for any pair of vertices v j and v k, there exists a path from v j to v k ; i.e., there are no sink nodes or states in G.Atour of G isapathing that starts and ends at the same vertex of G.AnEuler tour of G is a tour that contains every edge of E exactly once. A postman tour (PT) of G is a tour that contains every edge in E at least once. A rural postman tour (RPT) of G over a set E E is a tour traversing every edge in E at least once. A rural Chinese postman tour (RCPT) of G over a set E E is a minimum-cost RPT over E. Given a vertex v V, the in-degree of v, in-degree(v), is defined as {(u, v): (u, v) E} and the out-degree of v,

4 Constructing checking sequences for distributed testing 87 out-degree(v), is defined as {(v, w): (v, w) E}. A digraph G =(V, E) is symmetric if in-degree(v) = out-degree(v), v V. Given a postman tour P of G, let χ(v j,v k ; x/y) 1 be the number of times edge (v j,v k ; x/y) is contained in P. If edge (v j,v k ; x/y) is replicated χ(v j,v k ; x/y) times, a symmetric graph G, called a symmetric augmentation of G, is obtained and P is an Euler tour of G. Some supplementary labels must be used in G to distinguish the different replicates of an edge. A minimal symmetric augmentation of G is achieved by replicating edges of G such that G is symmetric and the replications of edges are minimized Controllability (synchronization) problem Let Q = x 1 / y 1 x 2 / y 2 x m / y m be the label of a path P of a digraph G foragivenfsmm, where x i I and y i O, 1 i m. There exists a controllability (synchronization) problem in Q when, in the labels x j / y j and x j+1 / y j+1 of any two consecutive transitions in P, there exists a tester L (or U) that sends x j+1 that is neither the one sending x j nor the one receiving an output belonging to y j,1 j m 1. Let U (or L) be the tester that sends x j. As it will be used in the proposed method, the solution to the synchronization problem is to insert an external coordination message exchange C L(U),+C U(L) relating to controllability between x j / y j and x j+1 / y j+1 in Q where C L(U) denotes the sending of an external coordination message C (implying you can send your input x j+1 ) to tester L (or U) from tester U (or L), and + C U(L) denotes the receipt of C from tester U (or L) by tester L (or U) [CaR99]. Any two consecutive transitions t and t in P whose labels are x j / y j and x j+1 / y j+1 in Q form a synchronizable pair of transitions if t can follow t without causing a synchronization problem. Any (sub)sequence of transitions in which every pair of consecutive transitions is synchronizable is called a synchronizable transition (sub)sequence. An input/output sequence is said to be synchronizable if it is the label of a synchronizable transition sequence Observability problem Let Q = x 1 / y 1 x 2 / y 2 x m / y m be the label of a path P of a digraph G foragivenfsmm, where x i I and y i O,1 i m.a1-shift output fault in an implementation N of M exists when, in the labels x j / y j and x j+1 / y j+1 of any two consecutive transitions in P, there exists one a L(U) Ɣ L(U) in y j of M which occurs in y j+1 in N (and not in y j in N in which case the shift is called a forward shift) or there exists one a L(U) Ɣ L(U) in y j+1 of M which occurs in y j in N (and not in y j+1 in N in which case the shift is called a backward shift), 1 j m 1. An instance of the observability problem manifests itself as an undetectable 1-shift output fault if there is a 1-shift output fault related to a L(U) Ɣ L(U) in any two consecutive transitions in P whose labels are x j / y j and x j+1 / y j+1 in Q, such that tester L (or U) satisfies the condition (a L(U) is in y j XOR a L(U) is in y j+1 ) AND x j+1 L(U). In this case, we say that tester L (or U)isinvolved in the shift, and would not be able to detect it. Let U (or L)be the tester that sends x j+1. As it will be used in the proposed method, the solution to the observability problem is to insert an external coordination message exchange B L(U),+B U(L) relating to observability between x j / y j and x j+1 / y j+1 in Q where B L(U) denotes the sending of an external coordination message B to tester L (or U) from tester U (or L), and + B U(L) denotes the receipt of B from tester U (or L) by tester L (or U) [CaR99]. By this exchange of the external coordination message B, tester U (or L) informs tester L (or U) that it should expect receiving an output from N (in the case of a backward shift) or that it must have received an output from N by now (in the case of a forward shift) Checking sequences Given an FSM M, let (M) be the set of FSMs each of which has at most S states and the same input and output sets as M. Let N be an FSM of (M). N is isomorphic to M if there is a one-to-one and onto function f on the state sets of M and N such that for any state transition (s i, s j ; x/y)ofm,(f(s i ), f(s j ); x/y) is a transition of N. A checking sequence of M is an input sequence starting at the initial state s 1 of M that distinguishes M from any N of (M) that is not isomorphic to M. In the context of testing, this means that in response to this input sequence, any faulty implementation N from (M) will produce an output sequence different from the expected output, thereby indicating the presence of a fault(s). As stated earlier, a crucial part of testing the correct implementation of each transition of M in N from (M) is recognizing the starting and terminating states of the transition which lead to the notions of state recognition and transition verification used in algorithms for constructing checking

5 88 H. Ural and C. Williams sequences (for example, [UWZ97], [HiU02]). These notions are defined below in terms of a given distinguishing sequence D for FSM M. Given an FSM M, an input sequence X is a distinguishing sequence (D) form if the output sequence Y produced by M in response to X is different for each state of M (i.e., s i, s j S, s i s j,λ(s i, D) λ(s j, D)). Let DS(s i ) denote the transition sequence induced by (the application of) D at state s i. Now, consider the digraph G =(V, E) representing M and let Q be the label of a path P in G starting at v 1. A vertex v of P is said to be recognized (in Q) as a state s of M, if the label T of a subpath R of P starting at v has a prefix D/λ(s, D). This rule says that head(r) is recognized as state s if label(r) has a prefix D/λ(s, D). Alternatively, if P 1 =(v i, v j ; T) and P 2 =(v k, v; T) are two subpaths of P such that v i and v k are recognized as state s of M and v j is recognized as state s of M, then v is said to be recognized (in Q) as state s of M. This rule says that tail(p 2 ) is recognized as state s if head(p 1 ) and head(p 2 ) are recognized as state s and tail(p 1 ) is recognized as state s; i.e., if P 1 and P 2 are induced by the same input/output sequence at their starting vertices which are recognized as the same state s of M, then their terminating vertices correspond to the same state s of M. An edge (v i, v j ; x i /y i )ofpis said to be verified (in Q) as a transition (s, s ; x/y) ofm if v i is recognized as state s, v j is recognized as state s, x i = x, and y i = y; i.e., v i is recognized as state s of M and there is a subpath P of P starting at v i whose label is xd/λ(s, xd). The subpath P is called the test segment for the transition (s, s ; x/y); i.e., P is the transition sequence induced by (the application of) the input sequence xd at state s. Accordingly, the following result will form the basis of the checking sequence construction method proposed in this paper. Theorem 1 (Theorem 1, [UWZ97]) Let P beapathofgrepresenting an FSM M that starts at s 1 and Q = label(p). If every edge of G is verified in Q, then the input portion of Q is a checking sequence of M. Let Q = X/Y be the label of a path P in G starting at v 1 such that Q contains S subsequences of the form D/λ(s i, D), (1 i S ). Since D is a distinguishing sequence for M, each of these subsequences of the form D/λ(s i, D), (1 i S ), is unique. If Q induces a path starting at the initial state of N from (M) then, since N has at most S states, D must also be a distinguishing sequence for N. This says that if S different responses to D are observed in N, then D defines a one-to-one correspondence between the states of N and M. In this case, we say that the uniqueness of the response of each of the S states of N to D is verified and hence N has S distinct states [InU99]. The subsequences of Q of the form D/λ(s i, D), (1 i S ) can be connected to each other is a succinct manner to form the elements of an α -set = {α 1,α 2,...,α q } where each α k (1 k q) is called an α -sequence [HiU02]. Let T i, called henceforth T-sequence, belabel(r i ) where R i = DS(s i )@ P i and P i is a (possibly empty) sequence of transitions of G starting at tail(ds(s i )), (1 i S ). Since a T-sequence T i is a sequence of input/output pairs with a prefix label(ds(s i )) = D/λ(s i, D), it may be used to recognize the tail state of any transition terminating at state s i [UWZ97]. An α -sequence α k is of the form T i1, T i2,..., with the sequence stopping once it gets back to a T j,1 i1, i2, j S, that appears in one of the α -sequences. Let P k =(v, v ; α k ) be a subpath of a path P whose label is Q; i.e., P k is the path induced by α k at a vertex v, (1 k q). Then, α -sequences for an α -set = {α 1,α 2,...,α q } are subsequences of Q with the following properties: 1. Since α k starts with a T i that has a prefix D/λ(s i, D), head(p k ) is recognized in Q. 2. Since every α -sequence α k is a subsequence of Q, tail(p k) is recognized in Q. 3. Since every T i is in some α k, head(r i) is recognized in Q. 4. Since every T i is followed by a T j in some α k, tail(r i) is recognized in Q. 5. Since α k starts with a T i that has a prefix D/λ(s i, D), α k may be used to recognize the tail state of any transition terminating at state s i [HiU02]. 3. The proposed method Let M =(S,,Ɣ,δ,λ, s 1 ) hereafter stand for a minimal, completely specified 2p-FSM which is represented by a strongly connected digraph G =(V, E) and has a distinguishing sequence D. The proposed method for the construction of a checking sequence of M where there is no potential controllability or observability problems, and where the use of external coordination message exchanges among testers is minimized is based on a general approach given in [HiU02] which constructs a reduced-length checking sequence using a distinguishing sequence and does not assume the existence of a reliable reset feature in the FSMs in Φ (M). The approach in [HiU02] first builds a digraph G =(V, E )fromg =(V, E), where V = V U, E = E C E α E T E by:

6 Constructing checking sequences for distributed testing 89 replicating each vertex v in V as a vertex v in U to represent the recognized version of v, replacing each edge (v i, v j ; x/y)ofeby an edge (v i, v j ; x/y)ine C so that the transition to be verified starts at the recognized vertex v i, inserting an edge (v i, v j ; α k )ine α for each P k =(v i, v j ; α k ), (1 k q) so that P k ends at the recognized vertex v j, inserting an edge (v i, v j ; T m)ine T for each R m =(v i, v j ; T m ), (1 m S )) so that R m ends at the recognized vertex v j, inserting an edge (v i, v j ; x/y)ine for each edge (v i, v j ; x/y) in a subset of edges of E such that G =(U, E ) does not have a tour and G is strongly connected. Note that in G each edge in E C is followed by an edge from E α E T to form a test segment for the transition corresponding to that edge of E C. Then, the approach in [HiU02] forms a minimal symmetric augmentation G of the digraph induced by E α E C by adding replications of edges from E.IfG, with its isolated vertices removed, is connected, then G has an Euler tour. Otherwise, a heuristic such as the one given in [UWZ97] is applied to make G connected and an Euler tour of this new digraph is formed. On the basis of Theorem 1, it is argued in [HiU02] that the input portion of the label of the Euler tour of G starting at vertex v 1 is a checking sequence of M. The proposed method is composed of five phases: Phase 1 finds the set of all potential controllability problems and the set of all potential observability problems for M. Phase 2 finds the transition sequence DS(s i ) induced by D at each state s i of M, and resolves any potential controllability and observability problems which may occur within DS(s i ) and between each transition t terminating at s i and first(ds(s i )). Phase 3 constructs an auxiliary graph G =(V, E ) which is then used to generate a T-sequence T j for each state s j of M where T j is the label of a transition sequence R j that starts at s j and that has the form DS(s j )@ P j with P j being a (possibly empty) sequence of transitions of G starting at tail(ds(s j )). Phase 4 constructs a set {α 1,α 2,...,α q } of α -sequences from the T-sequences generated in Phase 3 where each α k (1 k q) is the label of a transition sequence P k that has the form R i1 R i2..., with the sequence stopping once it gets back to an R j,1 i1, i2, j S, that already appears in one of the paths P m being formed, 1 m q. Phase 5 constructs a digraph G =(V, E ) in a manner similar to the construction of G in [HiU02]. A minimal symmetric augmentation G =(V, E ) of the digraph induced by E α E C is found by adding edges from E, and an Euler tour of G starting at v 1, representing an RCPT over the subset of edges E α E C of E, and terminating with an edge in E C is constructed. As it will be shown, the input portion of the label of this Euler tour, when followed by a D, is a synchronizable checking sequence with no potential undetectable 1-shift output faults Identifying controllability and observability problems In Phase 1 of the proposed method, the set of all controllability problems, T C, and the set of all observability problems, T O, are generated from the digraph G =(V, E) of the given FSM M. The set T C is constructed as follows: for each vertex v j Vdo for each edge e (say t)=(v i, v j ; x j /y j ) entering vertex v j do for each edge e (say t )= (v j, v k ; x j+1 /y j+1 ) leaving vertex v j do if x j U AND x j+1 L AND y j = a U, then add (t, t, C L,+C U ) to T C else if x j L AND x j+1 U AND y j =, a L then add (t, t, C U,+C L ) to T C Each triple (t, t, C L(U),+C U(L) ) added to T C corresponds to a controllability problem in the label of a transition sequence tt. The elements of T C are used in the subsequent phases of the proposed method as follows. Suppose that a path P on G needs to be formed. The input/output sequence representing label(p) can be

7 90 H. Ural and C. Williams Fig. 1. Digraph G =(V, E) of2p-fsm M1 made synchronizable as follows. For each pair of consecutive labels in the input/output sequence, say label(t) and label(t ) of a pair of transitions t and t,if(t, t, C L(U),+C U(L) ) T C then insert the external coordination message exchange C L(U),+C U(L) relating to controllability between label(t) and label(t ) in the input/output sequence. Consider the FSM M1 shown in Figure 1. Applying the above procedure results in a set T C consisting of two triples corresponding to controllability problems in the labels of transition sequences t8 t7 and t9 t5; i.e.: T C {(t8,t7, C U, +C L ), (t9,t5, C U, +C L )} The set T O of all triples corresponding to transition pairs with a potential undetectable 1-shift output fault is found next. The set T O is constructed from G =(V, E) as follows: for each vertex v j Vdo for each edge e (say t)=(v i, v j ; x j /y j ) entering vertex v j do for each edge e (say t )= (v j, v k ; x j+1 /y j+1 ) leaving vertex v j do if for some output a L(U) Ɣ L(U),(a L(U) is in y j XOR a L(U) is in y j+1 ) AND x j+1 L(U) AND (t, t, C U(L),+C L(U) ) T C then add (t, t, B L(U),+B U(L) ) to T O where U (or L) is the tester sending the input x j+1 in t and L (or U) is the tester involved in the shift. This algorithm is a special case of the one for n testers given on p137 of [UrW03a]. The set T O identifies only the necessary subset of all potential undetectable 1-shift output faults in G as defined in Sect Specifically, the if-statement in the above procedure limits T O to only those transition pairs that form a synchronizable pair of transitions in G. Given the input and output alphabets shown in Fig. 1, consider a pair of adjacent transitions t and t with label(t)=a/,2 and label(t )=b/ 0,. This transition pair exhibits a potential undetectable forward shift fault of the output 2 ; i.e., L cannot determine whether 2 is output by a correctly implemented t, orby faulty implementations of both t and t, i.e., label(t)= a/, and label(t )= b/ 0,2. However, note that any instance of t followed by t would not form a synchronizable pair of transitions and hence would require the insertion of an external coordination message exchange C U,+C L relating to controllability. If we justifiably assume that L waits to receive the 2 from t before sending the external coordination message C U relating to controllability to U, the observability problem is resolved; i.e., if L waits and does not receive 2 before it sends C U, we conclude that the implementation of t is faulty.

8 Constructing checking sequences for distributed testing 91 Applying the above procedure to FSM M1 produces a set T O of triples corresponding to six potential undetectable 1-shift output faults, i.e.: T O {(t1,t8, B U, +B L ), (t3,t9, B U, +B L ), (t7,t9, B U, +B L ), (t8,t6, B U, +B L ), (t9,t4, B U, +B L ), (t10,t8, B U, +B L )} Each triple (t, t, B L(U),+B U(L) ) added to T O corresponds to an observability problem in the label of a transition sequence tt, or more specifically, to a potential undetectable 1-shift output fault in the transition sequence tt. The elements of T O are used in the subsequent phases of the proposed method as follows. Suppose that a path P on G needs to be formed. For each pair of consecutive labels in the input/output sequence representing label(p), say label(t) and label(t ) of a pair of transitions t and t,if(t, t, B L(U),+B U(L) ) T O then insert the external coordination message exchange B L(U),+B U(L) relating to observability between label(t) and label(t )inlabel(p). Since the insertion of B L(U),+B U(L) makes the potential undetectable 1-shift output fault in the transition sequence tt detectable, there is no need to insert B L(U),+B U(L) for the subsequent occurrences of the transition sequence tt in the remaining phases of the proposed method and therefore (t, t, B L(U),+B U(L) )isremovedfromt O. Removing triples from T O ensures that the remaining phases of the proposed method do not unnecessarily attempt to avoid transition pairs whose potential undetectable 1-shift output fault is already made detectable. In contrast, due to the nature of the controllability problem, C L(U), + C U(L) from (t, t, C L(U),+C U(L) ) T C needs to be inserted for each occurrence of the transition sequence tt in forming subpaths of G in the subsequent phases, and thus T C is not altered throughout the proposed method. It is important to note that a high cost, represented by w 1, is associated with some transition sequences, created in the subsequent phases, which contain controllability (or observability problems) so that such transition sequences may then be used the least number of times in the construction of a checking sequence, thus reducing the total number of external coordination message exchanges in the resulting checking sequence Resolving problems in DS(s i ) and test segments In Phase 2, for each state s i, the transition sequence induced by D at s i, denoted DS(s i ), is found; and the observability and controllability problems within DS(s i ) as well as those between each transition t terminating at state s i and first(ds(s i )) are resolved by inserting the corresponding external coordination message exchanges from T O or T C, respectively. Formally, Phase 2 consists of the following two steps: Step 1. For each state s i, find the transition sequence DS(s i ) induced by D on G at v i. Initially, cost(ds(s i ))=0. For each pair of consecutive transitions tt in DS(s i ): If(t, t, C L(U),+C U(L) ) T C then insert the external coordination message exchange C L(U),+ C U(L) between label(t) and label(t )inlabel(ds(s i )) and let cost(ds(s i )) = cost(ds(s i )) + w, If(t, t, B L(U),+B U(L) ) T O then insert the external coordination message exchange B L(U),+ B U(L) between label(t) and label(t )inlabel(ds(s i )) and remove (t, t, B L(U),+B U(L) )fromt O, Step 2. For each edge e (say t)=(v i, v j ; x j /y j )ine If (t, first(ds(s j )), C L(U),+C U(L) ) T C then pre test(t)=label(t) C L(U),+C U(L) else if (t, first(ds(s j )), B L(U),+B U(L) ) T O then pre test(t)=label(t) B L(U),+B U(L) remove (t, first(ds(s j )), B L(U),+B U(L) )fromt O else pre test(t)=label(t). Note that in Step 2, pre test(t) denotes only transition t and any external coordination message exchange required between t terminating at state s j and first(ds(s j )), not a complete test segment t@ DS(s j ). The name pre test(t) is meant to be an abbreviation for prefix of the test segment for transition t. Test segments for each transition will be formed in Phase 5 based on the same graph construction technique as in [HiU02]. The distinguishing sequence D for 2p-FSM M1 isab. The transition sequence DS(s i ) and its cost for each state s i is shown in Table 1, and the transition sequence whose label is pre test(t) for each transition t is shown in Table 2. It is important to note that the triples (t3, t9, B U,+B L ), (t7, t9, B U,+B L ), (t8, t6, B U,+ B L ), (t9, t4, B U,+B L )areremovedfromt O in Step 2, resulting in an updated T O =(t1, t8, B U,+B L ), (t10, t8, B U,+B L ).

9 92 H. Ural and C. Williams Table 1. DS(s i ) and cost(ds(s i )) for 2p-FSM M1 State s i DS(s i ) cost(ds(s i )) Outputs δ(s i, D) s 1 t1 t7 0 1,3 0,2 s 4 s 2 t4 t2 0 1,3 0,3 s 1 s 3 t6 t2 0 0,2 0,3 s 1 s 4 t9 C U,+C L t5 w,2 0,3 s 1 Table 2. pre test(t) for 2p-FSM M1 Transition t pre test(t) t1 label(t1) t2 label(t2) t3 label(t3) B U,+B L t4 label(t4) t5 label(t5) t6 label(t6) t7 label(t7) B U,+B L t8 label(t8) B U,+B L t9 label(t9) B U,+B L t10 label(t10) t11 label(t11) 3.3. Construction of digraph G In Phase 3, a digraph G =(V, E ) is constructed to generate a T-sequence T j for each state s j of M where T j is the label of a transition sequence R j that starts at s j and that has the form DS(s j )@ P j with P j being a (possibly empty) sequence of transitions of G starting at tail(ds(s j )). G is constructed such that problems relating to controllability and observability in T-sequences generated in Phase 3, and thus also those in α -sequences to be generated in Phase 4 by using T-sequences, are minimized. That is, G is constructed to avoid choosing T j = label(r j = DS(s j )@ P j ) where, for example, DS(tail(R j )) has a high cost w, since tail(r j ), for each R j, must be recognized by applying D in an α -sequence. The purpose of Step 1 below is to assign costs for calculating the cost of terminating each R j with each possible P j. Step 1 achieves this by first assigning a cost to solid edges e in E based on the controllability and observability problems caused by each pair of adjacent transitions in G. Then, Step 1 creates a vertex Z to terminate each possible P j,1 j S, and assigns the cost of following each (non-self-loop) transition t in G by DS(tail(t)) as the cost of the corresponding dashed edge z in E. Step 2 below utilizes the costs assigned in Step 1 to determine the cost of each possible P j to select the least costly P j to form R j. If multiple min-cost paths P j exist on G then a tie-break is performed by choosing the path whose last transition causes the fewest observability and controllability problems when followed by transitions starting at tail(r i ), thereby potentially reducing the number of external coordination message exchanges in the resulting checking sequence. More specifically, Phase 3 consists of the following two steps: Step 1. Construct the digraph G =(V, E )fromg =(V, E) as follows: for each vertex v j V for each edge e (say t)=(v i, v j ; x j /y j ) entering vertex v j in V, head(e) v j : for each edge e (say t )=(v j, v k ; x k /y k ) leaving vertex v j V, tail(e ) v j : create a vertex labelled v i t v j in V if one does not exist already create a vertex labelled v j t v k inv if one does not exist already add an edge e =(v i t v j,v j t v k ; t )ine if a triple (t, t, B L(U),+B U(L) ) T O OR a triple (t, t, C L(U),+C U(L) ) T C then cost(e )=1+w else cost(e )=1 create a vertex labeled Z in V for each vertex(v i t v j ) in V create a dashed edge z=((v i t v j ), Z;, ) if (t, first(ds(s j )), C L(U),+C U(L) ) T C then cost(z) =cost(ds(s j )) + w else cost(z)=cost(ds(s j ))

10 Constructing checking sequences for distributed testing 93 Table 3. cost(z) for 2p-FSM M1 Edge z =((v i t v j ), Z;, ) cost(z) ((v 1 t1 v 3 ), Z;, ) 0 ((v 1 t3 v 4 ), Z;, ) w ((v 2 t4 v 1 ), Z;, ) 0 ((v 2 t5 v 1 ), Z;, ) 0 ((v 3 t6 v 1 ), Z;, ) 0 ((v 3 t7 v 4 ), Z;, ) w ((v 4 t9 v 2 ), Z;, ) 0 ((v 4 t10 v 3 ), Z;, ) 0 ((v 4 t11 v 2 ), Z;, ) 0 Fig. 2. Digraph G =(V, E )of2p-fsm M1 Step 2. For each state s i, the T-sequence T i is selected as follows: OnG, find the min-cost path P i from the vertex in V representing the last edge of DS(s i ) (i.e., (head(last (DS(s i ))) last(ds(s i )) tail(last(ds(s i )))) to Z. If there is more than one such min-cost path, P i is chosen as the path for which the last transition in the path occurs least often as transition t in elements (t, t, B L(U),+B U(L) ) T O and (t, t, C L(U), + C U(L) ) T C. Let R i = DS(s i )@P i and let T i = label(r i ). For each pair of consecutive transitions t and t in the subsequence last(ds(s i ))... last(p i ) If(t, t, C L(U),+C U(L) ) T C then insert the external coordination message exchange C L(U), + C U(L) between label(t) and label(t )int i, If(t, t, B L(U),+B U(L) ) T O then insert the external coordination message exchange B L(U), + B U(L) between label(t) and label(t )int i and remove (t, t, B L(U),+B U(L) )fromt O. For 2p-FSM M1, the cost(z) for each dashed edge in G is shown in Table 3, and digraph G =(V, E ) is shown in Fig. 2. To improve readability, only dashed edges with a cost greater than 0 are shown; there are two such edges,

11 94 H. Ural and C. Williams Table 4. R i for 2p-FSM M1 State s i R i = DS(s i )@P i Tail of R i s 1 t1 t7 t11 s 2 s 2 t4 t2 s 1 s 3 t6 t2 s 1 s 4 t9 C U,+C L t5 s 1 Table 5. α -sequence α i for 2p-FSM M1 α 1 label(r R R 1 ) label(t1 t7 t11 t4 t2 t1 t7 t11) α 2 label(r R 1 ) label(t6 t2 t1 t7 t11) α 3 label(r R 1 ) label(t9 C U,+C L t5 t1 t7 t11) both of which represent DS(s 4 ), which contains a controllability problem. As a result of Step 2, T-sequences for states s 2, s 3 and s 4 consist of only the label of DS(s i ), i = 2,3,4. For state s 1, three min-cost paths from v 3 t7 v 4 to Z exist; applying either t9, t10 or t11 will avoid the controllability problem that is encountered if D were to be applied at s 4. The transition t11 is chosen as it is not the first transition in any triples in T O or T C, and so T1 = label(t1 t7 t11). The application of Phase 3 to 2p-FSM M1 yields the R i shown in Table Construction of α -sequences In Phase 4, a set of α -sequences is constructed from the T-sequences formed in Phase 3. An α -sequence α k (1 k q) is the label of a transition sequence P k that has the form R i1 R i2..., with the sequence stopping once it gets back to an R j,1 i1, i2, j S, that already appears in one of the paths P m being formed, 1 m q. Phase 4 is as follows: Let S be the set of states not yet recognized in some α -sequence, and let α k = label(p k)bethe α -sequence currently under construction. Initially, S = s 1... s n and k = 1. Perform the following steps: Step 1. Choose some state s i S. Step 2. Let P k = R i, where R i is as constructed in Phase 3 Remove s i from S and let s j = tail(r i ). Step 3. Let old last = last(p k ) Let P k = P R j If (old last, first(r j ), B L(U),+B U(L) ) T O then insert the external coordination message exchange B L(U),+B U(L) between label(old last)& label (first(r j )) in label(p k ) and remove (old last, first(r j ), B L(U),+B U(L) )fromt O, If (old last, first(r j ), C L(U),+C U(L) ) T C then insert the external coordination message exchange C L(U),+C U(L) between label(old last)& label (first(r j )) in label(p k ). Step 4. If s j S then remove s j from S, let s j = tail(r j ) and go to Step 3, else (This completes P k ) let α k = label(p k). If S is not empty then let k = k + 1 and go to Step 1. Let X i denote the input portion of the input/output sequence T i. The above procedure (Steps 1 through 4) ensures that every state s i is recognized (i.e., λ(s i, D) is as expected), and for every state s i,δ(s i, X i ) is recognized in some α k. Therefore tail(r i), for each R i, is recognized in some α k since tail(r i)isδ(s i, X i ). Similarly, tail(p k )for each P k is recognized since P k ends with a subsequence X i which is followed by the application of D in some P k. Also, because every T-sequence and every α -sequence begins with D, a test segment for transition t terminating at state s j can be formed by following pre test(t) with either T j,ortheα -sequence that begins at s j (if it exists). Applying this phase to 2p-FSM M1 yields three α -sequences as shown in Table 5.

12 Constructing checking sequences for distributed testing Generating the checking sequence In Phase 5, a digraph G =(V, E ) is constructed in a manner similar to the construction of G in [HiU02]; i.e., V = V U, E = E C E T E α E S where U is the set of vertices representing the recognized versions of vertices in V; E C, E T, and E α are the sets of edges representing each pre test(t), T-sequence and α -sequence, respectively; and E S is the set of edges representing each edge (v i,v j ; x/y) in a subset of edges of E such that the digraph G S = (U, E S ) does not have a tour and G is strongly connected. A minimal symmetric augmentation G =(V, E ) of the digraph induced by E α E C is found; and an Euler tour of G starting at v 1, representing an RCPT over the subset of edges E α E C of E, and terminating with an edge in E C is constructed. As it will be shown below, the input portion of the label of this Euler tour, when followed by a D, is a synchronizable checking sequence with no potential undetectable 1-shift output fault. Phase 5 proceeds as follows: Step 1. Let V = V U where U = {v i : for every v i V}. Step 2. For each edge e (say t)=(v i,v j ; x/y) E, create an edge (v i, v j ; pre test(t)) in E. Denote this set of edges E C. Step 3. For each T-sequence T i =label(r i ), create an edge (head(r i ), tail(r i ) ; T i )ine. Denote this set of edges E T. Step 4. For each α -sequence α k = label(p k), create an edge (head(p k ), tail(p k ) ; α k )ine. Denote this set of edges E α. Step 5. CreateE S =(v i, v j ; x/y):(v i, v j ; x/y) a subset of E such that G S =(U, E S ) has no tour and G is strongly connected. E S can be constructed as follows. Use a breadth-first search to find a spanning tree ST of G with a root v = tail(p k ) for some α -sequence α k. Then, add as many edges of G as possible to ST without forming a tour and let E S = {(v i, v j ; x/y):(v i, v j ; x/y) ST}. Transitions which appear in the fewest triples in T C and T O are chosen here in order to minimize potential controllability and observability problems in the resulting Euler tour. Step 6. Find the minimal symmetric augmentation G =(V, E ) of the digraph induced by E α E C by adding one or more copies of some edges from E S E T to E which can be determined in a standard manner by using linear programming. Step 7. Find an Euler tour ET of G which starts at v 1, terminates with an edge in E C, and represents an RCPT over E α E C in G, subject to the following: Each time an edge e k leaving a vertex v i is added to ET: Let last trans(e j ) denote the last transition in the transition sequence represented by e j, where e j is the edge immediately preceding e k in ET, and let first trans(e k ) denote the first transition in the transition sequence represented by e k If(last trans(e j ), first trans(e k ), C L(U),+C U(L) ) T C then insert the external coordination message exchange C L(U),+C U(L) between label(e j ) and label(e k )inlabel(et), If(last trans(e j ), first trans(e k ), B L(U),+B U(L) ) T O then insert the external coordination message exchange B L(U),+B U(L) between label(e j ) and label(e k )inlabel(et) and remove (last trans(e j ), first trans(e k ), B L(U),+B U(L) )fromt O. Theorem 2 Let ET be an Euler tour obtained according to the proposed method from a given FSM M. Let Q = label(et)@ D/λ(s 1, D). Then the input portion of Q is a checking sequence of M. Proof. The proof is similar to the proof of Theorem 2 in [UWZ97]. Since ET of G which starts at v 1 terminates with an edge in E C, and represents an RCPT over E α E C in G, Q covers all of the α -sequences in E α, which is necessary to ensure that all states are recognized, and that Q covers all of the test segments in E C (including the transition corresponding to the last edge of E C ), which is necessary to verify all transitions of M. Then, by Theorem 1, the input portion of Q is a checking sequence of M. Digraphs G =(V, E ) and G =(V, E ) shown in Figs. 3 and 4, respectively, are obtained when the first six steps of Phase 5 are applied to 2p-FSM M1. Steps 1 through 4 create the set of vertices V and sets E C, E T, and E α of edges representing each pre test(t), T j and α k. These sets are shown by solid edges in both digraphs. Note that pre test(t) for a transition t starts at the recognized version of head(t) ing. Note also that pre test(t) for a transition t terminating at state s j can only be followed by T j or an α k starting at state s j in G and since every T j and α k begins with the application of D, this forms a test segment for t. Recall that controllability and observability problems between a transition t terminating at state s j and first(ds(s j )) are resolved as pre test(t) includes any necessary external coordination message exchange relating to controllability or observability.

13 96 H. Ural and C. Williams Fig. 3. Digraph G =(V, E )of2p-fsm M1 Fig. 4. Digraph G =(V, E )of2p-fsm M1 In Step 5, E S = {(2,1 ; a/ 1,3 ), (1,3 ; a/ 1,3 ), (1,4 ; c/ 1,2 ), (3,4 ; b/ 0,2 )} (shown by dashed edges in both figures) is formed by following the procedure given in Step 5 to ensure that G S =(U, E S ) has no tour and G is strongly connected. Note that E S is based on a spanning tree ST of G rooted at 2 = tail(p 1 ) where label(p 1 ) = α 1. Step 6 generates the minimal symmetric augmentation G =(V, E ) of the digraph induced by E α E C by adding replications of edges from E S E T in G. Note that the dashed edge (3,4 ; b/ 0,2 ) ing is not used in G because it is determined by minimal symmetric augmentation that it is not needed to make G symmetric. All other edges in E S E T are appearing at least once in G, i.e., the ones appearing more than once are marked by#* where# is the number of times the edge is needed to make G symmetric.

14 Constructing checking sequences for distributed testing 97 Table 6. Detection of potential 1-shift output faults External Coordination Message: Problem rendered detectable by subsequence Rationale (t1, t8, B U,+B L ) T1 =t1 t7 t11 U will not receive missing 1 in faulty t1 =a/,3 (t3, t9, B U,+B L ) t3(= c/ 1,2 ) pre test(t11) = t3 t11 U will not receive missing 1 in faulty t3 =c/,2 (t7, t9, B U,+B L ) T1 =t1 t7 t11 U will not receive missing 0 in faulty t7 =b/,2 (t8, t6, B U,+B L ) pre test(t10) T3 =t10 t6 t2 U will not receive missing 0 in faulty t6 =a/,2 (t9, t4, B U,+B L ) pre test(t11) T2 =t11 t4 t2 U will not receive missing 1 in faulty t4 =a/,3 Step 7 then finds an Euler tour ET of G =(V, E ) which starts at v 1, terminates with an edge in E C, and resolves potential controllability and observability problems between edges by checking for transition pairs in T C and T O. This check only occurs at vertices in U as problems between t and first(ds(s j )) for each transition t terminating at state s j are resolved in pre test(t) as noted above. The label of an Euler tour ET of G starting at 1 and terminating with pre test(t4) is: α 1 pre test(t5) T1 a/ 1,3 pre test(t2) T1 a/ 1,3 pre test(t3) α 3 a/ 1,3 a/ 1,3 pre test(t6) T1 a/ 1,3 a/ 1,3 pre test(t7) T4 a/ 1,3 B U,+B L pre test(t8) T3 c/ 1,2 pre test(t9) T2 c/ 1,2 pre test(t10) T3 c/ 1,2 pre test(t11) T2 pre test(t1) α 2 pre test(t4). Note that Step 7 results in the insertion of the external coordination message exchange B U,+B L between a/ 1,3 (= label(t1)) and pre test(t8) in label(et). Let Q = label(et)@ D/λ(s 1, D 1 ). The checking sequence of M1 is the input portion of Q = label(et)@ D/λ(s 1, D 1 ) which consists of 60 inputs, five external coordination message exchanges relating to observability and two external coordination message exchanges relating to controllability. After the input portion of Q = label(et)@ D/λ(s 1, D) is formed as a checking sequence, one can eliminate any external coordination message exchanges in the resulting checking sequence that relate to potential undetectable 1-shift output faults that can be rendered detectable by some subsequence in the checking sequence, as in [LDB94]. This post-processing of the checking sequence can be achieved as follows: Consider Q=label(ET)@D/λ(s 1,D) whose input portion is a checking sequence of M. Eliminate B L(U), + B U(L) from the input portion of Q=label(ET)@D/λ(S 1,D) for each subsequence label (t i ) B L(U), +B U(L) label (t j ) in Q which satisfies the following. Let tail (t i )bestatesofm. 1. label(t i ) label(t k ) is a subsequence of Q for a transition t k starting (but not terminating) at s which has either an input at port L(or U) or a non-empty output at port L (or U) (for the case when B L(U), +B U(L) is for a potential undetectable forward shift an output at port L (or U)). 2. label(t k ) label(t i ) is a subsequence of Q for a transition t k terminating (but not starting) at s which has a nonempty output at port L (or U) (for the case when B L(U), +B U(L), is for a potential undetectable backward shift of an output at port L (or U)). The application of this post-processing removes external coordination message exchanges relating to observability for any potential undetectable 1-shift output faults which are rendered detectable by some subsequence of the checking sequence. For FSM M1, this results in the elimination of all five external coordination message exchanges relating to observability; the subsequences which render these potential undetectable 1-shift output faults detectable are shown in Table 6. Note that (t10, t8, B U,+B L ) does not appear in Table 6 because the transition sequence t10 t8 does not appear in the Euler tour ET of G. The resulting checking sequence therefore requires only two external coordination message exchanges relating to controllability which are two occurrences of C U,+C L in α 3 = label(t9 C U,+C L t5 t1 t7 t11) and T4 =label(t9 C U,+C L t5), respectively. The rationales given in Table 6 can be explained as follows: a potential undetectable 1-shift output fault consists of two successive transition faults, one in which an output is not produced when it should be, and the other in which an output is produced when it should not be. Hence, if it can be shown that one of these two faults can be detected by some other sequence, then the other fault can be detected as an ordinary fault without using an external coordination message exchange relating to observability. 4. Comparison with other methods The method proposed in this paper relaxes the restrictive assumptions made by the previous methods [GuU95, HiU03, UrW03b] that considered the controllability and observability problems during the construction of a checking sequence. [GuU95] (which considers only the controllability problem) and [HiU03] (which addresses both the controllability and observability problems), construct a checking sequence by assuming that external coordination message exchanges between testers are not available; that there is a UIO sequence starting with an