Test Cases Generation for Nondeterministic Duration
Systems
Lotfi Majdoub
1
and Riadh Robbana
2
1
LIP2 Laboratory, Tunisia
2
Tunisia Polytechnic School, Tunisia
Abstract. In this paper, we are interested in testing duration systems. Duration
systems are an extension of real-time systems for which delays that separate
events depend on the accumulated times spent by the computation at some par-
ticular locations of the system.
We present a test generation method for nondeterministic duration systems that
uses the approximation method. This method extends a model using an over ap-
proximation, the approximate model, containing the digitization timed words of
all the real computations of the duration system. Then, we propose an algorithm
that generates a set of test cases presented with a tree by considering a discrete
time.
1 Introduction
Duration systems are an extension of real-time systems for which in addition to con-
straints on delays separating certain events that must be satisfied, constraints on accu-
mulated times spent by computation must also be satisfied.
Timed automata constitute a powerful formalism widely adopted for modeling real-
time systems [2]. Duration Variables Timed Graphs with Inputs Outputs (DVTG-IOs)
are an extension of timed automata [3], which are used as a formalism to describe
duration systems. DVTG-IOs are supplied with a finite set of continuous real variables
that can be stopped in some locations and resumed in other locations. These variables
are called duration variables.
Testing is an important validation activity, particularly for real-time systems, which
aims to check whether an implementation, referred to as an Implementation Under Test
(IUT), conforms to its specification. Testing process is difficult, expensive and time-
consuming. A promising approach to improve testing consists in automatically generat-
ing test cases from formal models of specification. Using tools to automatically generate
test cases may reduce the cost of the testing process.
For testing real-time systems, most works borrow several techniques from the real-
time verification field due to similarities that exist between model-based testing and
system verification (e.g., symbolic techniques, region graph and its variations, model
checking techniques, etc.). Those techniques are used particularly to reduce the infinite
state space to a finite (or at least countable) state space. Then they adapt the existing
untimed test case generation algorithm. We cite as example [6][8][9].
Majdoub L. and Robbana R. (2009).
Test Cases Generation for Nondeterministic Duration Systems.
In Proceedings of the 7th International Workshop on Modelling, Simulation, Verification and Validation of Enterprise Information Systems, pages 13-22
DOI: 10.5220/0002196500130022
Copyright
c
 SciTePress

It is well known that the verification of real-time systems is possible due to the
decidability of reachability problem for real-time systems [1]. However, it has been
shown that the reachability problem is undecidable for timed graphs extended with one
duration variable [5] and, consequently, it is not possible to use classical verification
techniques to generate test cases for DVTG-IO.
We give in this paper a method for testing duration systems. We consider a nonde-
terministic duration system in the sense that the current state of the system is not known
precisely and the tester has the choice between several actions to experiment. We de-
scribe the specification as well as the implementation under test with DVTG-IO. In
order to reduce the infinite state space to a finite state space, we use the approximation
method that extends a given DVTG-IO specification to anohter called the approximate
model that contains the initial test cases as well as their discretisations. An algorithm of
generating a set of test cases is given. We present this set of test cases by a tree.
This paper is organized as follows: In the next section, we present the duration
variables timed graphs with inputs outputs. In section 3, we define the nondeterminism
concept. Section 4 shows the approximation method. Our testing method, is introduced
in section 5. Concluding remarks are presented in section 6.
2 Duration Variables Timed Graphs with Inputs Outputs
A DVTG-IO is described by a finite set of locations and a transition relation between
these locations. In addition, the system has a finite set of duration variables that are
constant slope continuous variables, each of them changing continuously with a rate
in {0,1} at each location of the system. Transitions between locations are conditioned
by arithmetical constraints on the values of the duration variables. When a transition is
taken, a subset of duration variables should be reset and an action should be executed.
This action can be either an input action, an output action or an unobservable action
[15].
2.1 Formal Definition
We consider X a finite set of duration variables. A guard on X is a boolean combination
of constraints of the form x ≺ c where x ∈ X, c ∈ N, ≺∈ {<, ≤, >, ≥}. Let
Γ (X) be the set of guards on X. A DVTG-IO describing duration systems is a tuple
S = (Q, q
0
, E, X, Act, γ, α, δ, ∂) where Q is a finite set of locations, q
0
is the initial
location, E ⊆ Q × Q is a finite set of transitions between locations, Act = Act
In
∪
Act
Out
∪ {ξ} is a finite set of input actions (denoted by ?a), output actions (denoted by
!a) and unobservable action ξ, γ : E −→ Γ (X) associates to each transition a guard
which should be satisfied by the duration variables whenever the transition is taken,
α : E −→ 2
X
gives for each transition the set of duration variables that should be reset
when the transition is taken, δ : E −→ Act gives for each transition the action that
should be executed when the transition is taken, ∂ : Q × X −→ {0, 1} associates with
each location q and each duration variable x the rate at which x changes continuously
in q.
15

δ : E −→ Act gives for each transition the action that should be executed when
the transition is taken, ∂ : Q × X −→ {0, 1} associates with each location q and
each duration variable x the rate at which x changes continuously in q.
Example. To illustrate DVTG-IO, we show on Figure 1 the specification of
a vending machine. This machine delivers a beverage after receiving a coin from
the user. It is composed of locations {q
0
, q
1
, q
2
, q
3
, q
4
, q
5
} where q
0
is the initial
location, transitions between locations and is supplied with a set of input actions
{?choose, ?coin}, output actions {!price, !accept, !deliver, !returncoin, !return,
!timeout} and three duration variables x, y, z. Duration variables x and y are
clocks used to make constraints on the time execution of the vending machine,
z is a duration variable, it is stopped (
.
z
= 0) in locations q
0
, q
2
and it is used to
make constraint on the time spent by the system.
? c h o o s e
!p ri c e
? co in
!a c ce p t
! de liv e r
! r e tu r n
!r e tu r n co in
!t im e ou t
x = 1
y: = 0
x = 2
y= 1
x = 2
x := 0 ,y := 0 ,z := 0
x >2
x := 0 , y := 0 ,z : = 0
x > 1
x := 0 ,y := 0 , z:= 0
x = 3∧ z= 2
x := 0 ,y := 0 , z:= 0
q
0
q
1
q
2
q
3
q
4
q
5
0=
•
z
10 ≤≤ x
21 ≤≤ x
0=
•
z
x >1
x := 0 , y := 0 ,z : = 0
!t im e o u t
!t im e o u t
Fig. 1. DVTG-IO of a vending machine
2.2 State graph
The semantic of DVTG-IO is defined in terms of a state graph over states of
the form s = (q, ν) where q ∈ Q and ν : X −→ R
+
is a valuation function that
assigns a real value to each duration variable. Let St
S
be the set of states of S.
We notice that St
S
is an infinite set due to the value of duration variables taken
Fig. 1. DVTG-IO of a vending machine.
Example. To illustrate DVTG-IO, we show on Figure 1 the specification of a vending
machine. This machine delivers a beverage after receiving a coin from the user. It is
composed of locations {q
0
, q
1
, q
2
, q
3
, q
4
, q
5
} where q
0
is the initial location, transitions
between locations and is supplied with a set of input actions {?choose, ?coin}, output
actions {!price, !accept, !deliver, !returncoin, !return, !timeout} and three duration
variables x, y, z. Duration variables x and y are clocks used to make constraints on the
time execution of the vending machine, z is a duration variable, it is stopped (
.
z
= 0) in
locations q
0
, q
2
and it is used to make constraint on the time spent by the system.
2.2 State Graph
The semantic of DVTG-IO is defined in terms of a state graph over states of the form
s = (q, ν) where q ∈ Q and ν : X −→ R
+
is a valuation function that assigns a real
value to each duration variable. Let St
S
be the set of states of S. We notice that St
S
is
an infinite set due to the value of duration variables taken on R
+
. A state (q, ν) is called
integer state if ν : X −→ N. We denote by N (St
S
) the set of integer states of S.
Given a valuation ν and a guard g, we denote by ν |= g the fact that valuation of g
under the valuation ν is true.
We define two families of transition between states : discrete transition (q, ν)
a
(q
0
, ν
0
) where (q, q
0
) ∈ E, δ(q, q
0
) = a, ν |= γ(q, q
0
) is true and ν
0
(x) = ν(x) ∀x ∈
X\α(q, q
0
) , ν
0
(x) = 0 ∀x ∈ α(q, q
0
), that corresponds to moves between locations
using transition in E, timed transition (q, ν)
t
(q, ν
0
) such that t ∈ R
+
and ν
0
(x) =
ν(x)+∂(q, x) ∗t ∀x ∈ X, that corresponds to transitions due to time progress at some
location q.
The state graph associated with S is (St
S
, ) where denotes the union of all
discrete and timed transitions.
16

2.3 Computation Sequences and Timed Words
A Computation sequence of a DVTG-IO is defined as a finite sequence of configu-
rations. A configuration is a pair (s, τ ) where s is a state and τ is a time value. Let
C
S
be the set of configurations of S. Intuitively, a computation sequence is a finite
path in the state graph of an extension of S by an observation clock that records the
global elapsed time since the beginning of the computation. Formally, if we extend
each transition relation from states to configurations, then a computation sequence of
S is σ = (s
0
, 0) (s
1
, τ
1
) ... (s
n
, τ
n
). Let CS(S) be the set of computations
sequences of S.
A timed word is a finite sequence of timed actions. A timed action is a pair aτ where
a ∈ Act and τ ∈ R
+
, meaning that action a takes place when the observation clock is
equal to τ. A timed action aτ is called integer timed action if τ ∈ N. A timed word is a
sequence ω = a
1
τ
1
a
2
τ
2
...a
n
τ
n
where a
i
is an action and τ
i
is a value of the observation
clock. We notice that τ
i
≤ τ
i+1
. Let L(S) be the set of timed words of S.
A sequence ω = a
1
τ
1
a
2
τ
2
...a
n
τ
n
is considered a timed word of L(S) if and only
if there exists a computation sequence σ = (s
0
, τ
0
) (s
1
, τ
1
) ... (s
n
, τ
n
) ∈
CS(S) such that a
i
= δ(q
i−1
, q
i
) for i = 1, .., n and s
i
= (q
i
, ν
i
). For simplicity, we
may write (s
0
, τ
0
)
ω
(s
n
, τ
n
).
Let ω = a
1
τ
1
a
2
τ
2
...a
n
τ
n
be a timed word and a ∈ Act, τ ∈ R
+
such that
τ
n
≤ τ then we denote by ω.aτ the timed word obtained by adding aτ to ω and we
have ω.aτ = a
1
τ
1
a
2
τ
2
...a
n
τ
n
aτ.
3 Nondeterministic Duration Variables Timed Graphs
In this section, we present the concept of nondeterminism used to characterize DVTG-
IO describing the specification of duration systems. Our study concerns three forms of
nondeterminism.
External Choice. A state in the state graph of a DVTG-IO has an external choice if,
from this state, the tester can choose between several input actions to experiment on the
implementation under test. A DVTG-IO S has an external choice iff ∃s ∈ St
S
, ∃a, b ∈
Act
In
, a 6= b such that s
a
and s
b
.
Observable Nondeterminism. The observable nondeterminism means that the output
action generated by the implementation under test is not unique. A DVTG-IO S is
observable nondeterministic iff ∃s ∈ St
S
, ∃a, b ∈ Act
Out
, a 6= b such that s
a
and s
b
.
Nondeterminism. A DVTG-IO is said nondeterministic if the current state is not nec-
essarily determined by observing their execution. A DVTG-IO S is nondeterministic iff
∃s, t, u ∈ St
S
, ∃a ∈ Act, t 6= u such that s
a
t and s
a
u.
4 Approximation
The approximation method is used in the verification of duration systems [13]. We adapt
this method to test duration systems.
17

4.1 Digitization
We present the notion of digitization [7], which is suitable for the systems in which we
are interested.
Let τ ∈ R
+
. For every  ∈ [0, 1[ called digitization quantum, we define the digiti-
zation of τ, [τ]

=if τ ≤ (bτ c + ) then bτ c else dτ e .
Given  ∈ [0, 1[, the digitization of a timed word ω = a
1
τ
1
a
2
τ
2
...a
n
τ
n
is [ω]

=
a
1
[τ
1
]

a
2
[τ
2
]

...a
n
[τ
n
]

Therefore, it is not difficult to see that: [ω.at]

= [ω]

.a[t]

Moreover, it is easier to relate digitizations of a computation sequence and its timed
word. If σ is a computation sequence and ω is its corresponding timed word then for
 ∈ [0, 1[, [ω]

is the corresponding timed word of [σ]

.
We denote by Digit(L(S)) the set of all the digitizations of all the real timed word
of S. We notice that Digit(L(S)) is finite.
The digitization is used to reduce the infinite set of states to a finite set of states. A
question that one may ask is whether Digit(L(S)) ⊆ L(S) or not.
Example. In the following example, we will see that we can have a DVTG-IO with
only one duration variable for which there exists a real timed word such that all their
digitizations are not timed words of the system.
Let ω =?choose 0.5 !price 1 ?coin 1.5 !accept 2 !deliver 2.5 !return 3 be the
real timed word of the DVTG given in the figure 1.
There are two digitizations of ω :
[ω]

=?choose 0 !price 1 ?coin 1 !accept 2 !deliver 2 !return 3 ; 0.5 <  < 1
[ω]

=?choose 1 !price 1 ?coin 2 !accept 2 !deliver 3 !return 3 ; 0 ≤  ≤ 0.5
It is easier to verify on the DVTG-IO given in figure 1 that ω is a timed word,
however their two digitizations [ω]

for 0.5 <  < 1 and 0.5 <  < 1 are not timed
words of the considered DVTG-IO.
4.2 Approximate Model
As we have seen in the previous example, some timed words of a DVTG-IO do not
have any digitizations in S. The idea given in [13] consists of over approximating the
model S by an approximate model S
0
such that Digit(L(S)) ⊆ L(S
0
).
Definition 1. The function β : X × E −→ N calculates for each variable x ∈ X and
each transition e = (q, q
0
) the maximum of restarts of x from the last reset of x until
the location q in each way.
A restart of a variable x is the change of its rate from 0 to 1. After a reset of a
variable x, if the rate of a variable x in the current location is 1, then the access to this
location is considered as a restart of x. For example, if in the first location x has a rate
equal to 1 then the access to the initial state is considered as restart. That is why, for the
clocks, the function β is equal to 1 for each transition.
Definition 2. The approximate model S
0
= App(S) is obtained from S by transforming
each guard of a transition e of the form u ≺ x ≺ w by the guard:
– if u − β(x, e) ≥ −1 then u − β(x, e) + 1 ≤ x ≤ w + β(x, e) − 1
18

? ch o o s e
!p r i c e
? co in
!a c ce p t
! de l iv e r
! r e t u r n
!r e t u r n co in
!t im e o u t
x = 1
y: = 0
x = 2
y= 1
x = 2
x := 0 ,y := 0 ,z := 0
x >2
x := 0 , y := 0 ,z := 0
x > 1
x := 0 , y: = 0 ,z := 0
x := 0 , y: = 0 ,z := 0
q
0
q
1
q
2
q
3
q
4
q
5
0=
•
z
10 ≤≤ x
21 ≤≤ x
0=
•
z
x >1
x := 0 , y := 0 ,z := 0
!t im e o u t
!t im e o u t
313 ≤≤∧= zx
Fig. 2. The approximate model
(q, ν)
1
 (q, ν

) labeled with a constant delay of time equal to 1. Notice that ν
and ν

∈ [X → N]. Clearly, the digitizations of all timed words Digit(L(S)) are
included in (N(St
S

),
1
 ∪
a
).
5.2 The test tree
We use the countable state graph (N(St
S

),
1
 ∪
a
) to generate a finite set of
test cases. This set of test cases is represented by a tree called test tree .
The test tree is composed by nodes that are sets of integer configurations and
transitions between those nodes. A node in the test tree is a finite set of integer
configurations (s, τ) such that s ∈ N (St
S

), τ ∈ N and represents the possible
current integer configurations of the IUT. The root is the initial configuration
of (N(St
S

),
1
 ∪
a
) that is (s
0
, τ
0
). We remember that we consider a nonde-
terministic duration system and that the current system configuration are not
known precisely. The transition between one node and its successor is labelled
with a timed action aτ such that a ∈ Act and τ ∈ N. A path from the root to
one leaf of the tree represents a digitization of a timed word.
Example. An example of test tree is given in figure 3. That is the test tree
constructed from the approximate model of figure 2. Each path of the test tree
from the root to a leaf corresponds to an integer computation sequence of the
approximate model.
Fig. 2. The approximate model.
– otherwise 0 ≤ x ≤ w + β(x, e) − 1
where u, w ∈ N, x ∈ X, and ≺∈ {<, ≤}
Example. If we apply the approximation method on the DVTG-IO of figure 1, we
obtain the approximate model of figure 2, that consists of replacing the guard x =
3 ∧ z = 2 associated to the transition (q
5
, q
0
) by the guard x = 3 ∧ 1 ≤ z ≤ 3, because
we have β(z, (q
5
, q
0
)) = 2.
It is easier to verify that the digitizations of the previous example belong to the
approximate model.
Proposition 1 demonstrates that for every timed word of the specification model, its
digitizations belong to the approximate model.
Proposition 1 [11]. ∀ ω ∈ L(S) we have [ω]

∈ L(S
0
) for each  ∈ [0, 1[ 
5 Testing Method
Here, we introduce our testing method for nondeterministic duration systems that is
based on the approximation method.
5.1 Test Generation with the Approximate Model
First, let us introduce the notion of an observation which is a sequence of controllable
(inputs) and observable (outputs) actions that are either executed or produced by the
IUT followed with its occurrence time. Formally, we describe an observation by a timed
word ω = a
1
τ
1
a
2
τ
2
...a
n
τ
n
where a
i
∈ Act and τ
i
∈ R
+
.
19

Our result is based on a reduction of the infinite state graph associated with S
0
=
App(S) to the countable state graph (N(St
S
0
),
1
∪
a
), where the space of states is
the set of integer states. Transitions between states are either discrete transition (q, ν)
a
(q
0
, ν
0
) labeled with action in Act, or timed transition (q, ν)
1
(q, ν
0
) labeled with a
constant delay of time equal to 1. Notice that ν and ν
0
∈ [X → N]. Clearly, the
digitizations of all timed words Digit(L(S)) are included in (N (St
S
0
),
1
∪
a
).
5.2 The Test Tree
We use the countable state graph (N(St
S
0
),
1
∪
a
) to generate a finite set of test
cases. This set of test cases is represented by a tree called test tree .
The test tree is composed by nodes that are sets of integer configurations and transi-
tions between those nodes. A node in the test tree is a finite set of integer configurations
(s, τ ) such that s ∈ N (St
S
0
), τ ∈ N and represents the possible current integer con-
figurations of the IUT. The root is the initial configuration of (N(St
S
0
),
1
∪
a
) that
is (s
0
, τ
0
). We remember that we consider a nondeterministic duration system and that
the current system configuration are not known precisely. The transition between one
node and its successor is labelled with a timed action aτ such that a ∈ Act and τ ∈ N.
A path from the root to one leaf of the tree represents a digitization of a timed word.
Example. An example of test tree is given in figure 3. That is the test tree constructed
from the approximate model of figure 2. Each path of the test tree from the root to a
leaf corresponds to an integer computation sequence of the approximate model.
! t im e o u t 2
? c h o o s e 0 ? c h o o s e 1
! p ri c e 1
! p r i c e 1
! ti m e o u t 2 ! t im e o u t 2
! ti m e o u t 3 ! t im e o u t 3
? c o in 1 ? c o in 2
? c o i n 1
? c o in 2
! re t u r n c o i n 2 ! re t u r n c o i n 2 ! r e tu r n c o in 2 ! r e t u r n c o in 2
! a c c e p t 2 ! a c c e p t 2 ! a c c e p t 2 ! a c c e p t 2
! d e l iv e r 2 ! d e li v e r 3 ! d e l iv e r 2 ! d e l iv e r 3
! re t u r n 3 ! r e t u r n 3 ! r e t u r n 3 ! r e t u r n 3
Fig. 3. The test tree
5.3 Algorithm of generating test tree
We adapt the untimed test generation algorithm of [15].
1 Input : N(G
S

) = (N(St
S

),
1
 ∪
a
)
2 Output : Test Tree T
3 T = {(s
0
,0)} the one-node tree
4 while T rue
5 for each leaf C of T distinct from pass
6 Out(C)
7 In(C)
8 if Out(C) ∪ In(C) = ∅ then
9 C = pass
10 else
11 do randomly {1; 2}
12 case 1 :
13 for each aτ ∈ Out(C) ∪ In(C)
14 C

= C after aτ
15 append edge C
aτ
 C

to T
16 case 2 :
17 C = pass
18 End while
Out(C) (resp. In(C)) is the set of all timed output actions (resp. the set of
all timed input actions) that can occur when the system is at configuration of
Fig. 3. The test tree.
20

5.3 Algorithm of Generating Test Tree
We adapt the untimed test generation algorithm of [15].
! t im e o u t 2
? c h o o s e 0 ? c h o o s e 1
! p ri ce 1
! p r i c e 1
! ti m e o u t 2 ! t i m e o u t 2
! ti m e o u t 3 ! t im e o u t 3
? c o in 1 ? c o i n 2
? c o i n 1
? c o in 2
! re t u r n c o i n 2 ! re t u r n c o i n 2 ! r e tu r n c o in 2 ! r e t u r n c o in 2
! a c c e p t 2 ! a c c e p t 2 ! a c c e p t 2 ! a c c e p t 2
! d e l iv e r 2 ! d e l i v e r 3 ! d e l iv e r 2 ! d e l i v e r 3
! re t u r n 3 ! r e t u r n 3 ! r e t u r n 3 ! r e t u r n 3
Fig. 3. The test tree
5.3 Algorithm of generating test tree
We adapt the untimed test generation algorithm of [15].
1 Input : N(G
S

) = (N(St
S

),
1
 ∪
a
)
2 Output : Test Tree T
3 T = {(s
0
,0)} the one-node tree
4 while T rue
5 for each leaf C of T distinct from pass
6 Out(C)
7 In(C)
8 if Out(C) ∪ In(C) = ∅ then
9 C = pass
10 else
11 do randomly {1; 2}
12 case 1 :
13 for each aτ ∈ Out(C) ∪ In(C)
14 C

= C after aτ
15 append edge C
aτ
 C

to T
16 case 2 :
17 C = pass
18 End while
Out(C) (resp. In(C)) is the set of all timed output actions (resp. the set of
all timed input actions) that can occur when the system is at configuration of
Out(C) (resp. In(C)) is the set of all timed output actions (resp. the set of all timed
input actions) that can occur when the system is at configuration of C. C after aτ
is the set of all configurations that can be reached from C after the execution of the
timed word aτ. Notice that Out(C), In(C) and C af ter aτ are finite sets. They are
calculated in N(G
S
0
) = (N (St
S
0
),
1
∪
a
).
The generating test tree algorithm operates as follows : initially the test tree contains
one node that is the initial configuration of S
0
: (s
0
, 0). For every leaf C of the tree,
the algorithm calculates the set of integer timed actions (In(C) and Out(C)) that can
be taken when the system is in C. For each timed action aτ the algorithm claculates
C
0
= C af ter aτ, the set of configurations obtained when aτ is executed, and appends
the edge C
aτ
C
0
to the tree. The algorithm can stop a path of the tree by appending
the node pass in the leaf.
Proposition 2 [12]. Let ω ∈ L(S) be a timed word and [ω]

∈ L(S
0
) its digitization
for  ∈ [0, 1[ if ∃ a ∈ Act and ∃τ
0
∈ N such that [ω]

.aτ
0
∈ L(S
0
) then ∀τ ∈
]τ
0
− 1 + , τ
0
+  ] we have ω.aτ ∈ L(S)
The test generation from the approximate specification model can give to the tester
the action and the integer time value of its execution on the IUT in discrete time. The
above proposition shows that if the tester executes the action (input or output) within a
real-time interval, defined by the proposition, then the conformance of the observation
recorded on the IUT is preserved according to the approximate model.
Proposition 3. Let ω = a
1
τ
1
a
2
τ
2
...a
n
τ
n
be a timed word that corresponds to a path
from the root to a leaf in T
S
.
then ∃ ω
0
∈ L(S) such that [ω
0
]

= ω
21

Proof.
We proceed by a recursif proof on the size of ω.
Let ω
i
= a
1
τ
1
a
2
τ
2
...a
i
τ
i
with i ≤ n be the timed word obtained in the level i of
the test tree, we have ω
n
= ω
For i = 0, ω
0
= ∅ the proposition is true because (ω
0
0
= ∅) ω
0
0
∈ L(S) and we
have [ω
0
0
]

= ω
0
For i < n we suppose that the proposition is true for i and we try to demonstrate
for i + 1
∃ ω
0
i
∈ L(S) such that [ω
0
i
]

= ω
i
Given aτ ∈ Out(S
0
after ω
i
) ∪ In(S
0
after ω
i
)
We have ω
i
.aτ ∈ L(S
0
)
From the proposition 2, ∀τ
0
∈] τ − 1 + , τ +  ] we have ω
0
i
.aτ
0
∈ L(S)
So [ω
0
i
.aτ
0
]

= ω
i
.aτ 
A path in the test tree is a discrete timed word obtained from the coutable state graph
(N(St
S
0
),
1
∪
a
) associated to the approximate model S
0
= App(S). In proposition
3, we demonstrate that a path in the test tree corresponds to a digistization of a timed
word belonging to the initial model S.
By considering this result and the result obtained in the proposition 2, we can use
the test tree to generate a discrete test case, then we can experiment it by considering
continuous time. For generating an input timed action that should be executed on the
IUT, the tester chooses one integer timed action aτ from the test tree. By proposition 2,
the action a can be applied within the real-time interval ]τ − 1 + , τ + ].
6 Conclusions
We have introduced a method for testing nondeterministic duration systems. First, we
used the DVTG-IO as a formalism to model specification. Second, we presented the
approximation method. This method extends a given DVTG-IO to another called ap-
proximate model that contains the initial test cases as well as their digitizations. Then,
we proposed an algorithm that generate a set of test cases presented in a tree by consid-
ering a discrete time, we demonstrated that test cases generated from the approximate
model correspond to the digitization of timed words of the specification model. At the
end, we showed how those test cases are executed on the implementation by considering
a continous time.
In the future work we plan to see how we can extend our approach to test dura-
tion systems with quiescence actions and how we can use this approach to test hybrid
systems.
References
1. Alur R., Courcoubetis C., and Dill D., Model-Checking for Real-Time Systems, 5th Symp.
on logic in Computer Science, 1990.
2. Alur R.and Dill D., A Theory of Timed Automata, Theoretical Computer Science, 126 : 183-
235, 1994.
22

3. Bouajjani A., Echahed R., Robbana R., Verifying Invariance Properties of Timed Systems
with Duration Variables, Formal Techniques in Real-Time and Fault Tolerant Systems, 1994.
4. Cassez F., Larsen K.G, The Impressive Power of Stopwatches, In Proc. Conference on Con-
currency Theory (CONCUR’00), Penssylvania, USA, 2000
5. Cerans K., Decidability of Bisimulation Equivalence for Parallel timer Processes, In Proc.
Computer Aided Verification (CAV’92), Springer-Verlag, 1992, LNCS 663.
6. En-Nouaary A., Dssouli R., Khender F., and Elqortobi A., Timed Test cases generation based
on state characterisation technique, In RTSS’98. IEEE, 1998.
7. Henzinger T., Manna Z., and Pnuelli A., What good are digital clocks?, In ICALP’92, LNCS
623, 1992.
8. Hessel A., Pettersson P., A Test Case Generation Algorithm for Real-Time Systems, In Proc.
4th international Conference on Quality software, pp. 268-273, 2004.
9. Krichen M, Tripakis S., Black-Box Conformance Testing for Real-Time Systems, SPIN’04
Workshop on Model Checking Software, 2004.
10. Majdoub L. and Robbana R., Test Purpose of Duration Systems, 4th MSVVEIS, pages 67-75,
Cyprus, May 2006.
11. Majdoub L. and Robbana R., Testing Duration Systems using an Approximation Method,
Depcos-RELCOMEX, pp.119-126, Szklarska Poreba, Poland, June 2007.
12. Majdoub L. and Robbana R., Testing Duration systems, Journal Europ
´
een des Syst
`
emes Au-
tomatis
´
es, Approches formelles pour la validation de syst
`
emes temps-r
´
eel, vol 42 n
◦
9/2008,
pp. 1111-1134, November 2008.
13. Robbana R, Verification of Duration Systems using an Approximation Approach, Journal
Computer Science and Technology, Vol 18, N
◦
2, pp. 153-162, March 2003.
14. Springintveld J., Vaandrager F., and D’Argenio P., Testing Timed Automata, Theoretical
Computer Science, 254, 2001.
15. Tretmans J., Testing Concurrent Systems : A Formal Approach, CONCUR’99 , 10th Int,
conference on Concurrency Theory, pages 46-65, 1999.
23