8. BEHAVIORAL EQUIVALENCE MODELS
Based on behavioral equivalence
Two objects x and y are behaviorally equivalent if and
only if for every possible sequence s made of
modifiers and ending with an observer s(x) = s(y)
Built exploring exhaustively a small scope
Hypothesis: A small but Precise Finite-State Model
captures “by example” all the relevant behavior of a
component
7
13. BEHAVIORAL EQUIVALENCE MODELS
PROs CONs
Precise description of the Limited to the observed
component behavior (small) scope
9
14. BEHAVIORAL EQUIVALENCE MODELS
PROs CONs
Precise description of the Limited to the observed
component behavior (small) scope
NEED FOR MORE
GENERAL MODELS!
9
15. PROTOCOL BEHAVIOR MODELS
Abstraction of the information in the
Behavioral Equivalence Models
Normal or exceptional result
Effects on component’s state
10
16. PROTOCOL BEHAVIOR MODELS
pop push
push
Stack S0 S1
pop
pop
State push pop size top
Observer Abstraction
S0 — EmptyStackException — EmptyStackException
S1 — — — —
Modifier Behavior Abstraction
S0 Variant Invariant Invariant Invariant
S1 Variant Variant Invariant Invariant
11
17. PROTOCOL BEHAVIOR MODELS
No parameters
pop push
push
Stack S0 S1
pop
pop
State push pop size top
Observer Abstraction
S0 — EmptyStackException — EmptyStackException
S1 — — — —
Modifier Behavior Abstraction
S0 Variant Invariant Invariant Invariant
S1 Variant Variant Invariant Invariant
11
18. PROTOCOL BEHAVIOR MODELS
No parameters
pop push
push
Stack S0 S1
pop
Result type pop
State push pop size top
Observer Abstraction
S0 — EmptyStackException — EmptyStackException
S1 — — — —
Modifier Behavior Abstraction
S0 Variant Invariant Invariant Invariant
S1 Variant Variant Invariant Invariant
11
19. PROTOCOL BEHAVIOR MODELS
No parameters
pop push
push
Stack S0 S1
pop
Result type pop
State push pop size top
Observer Abstraction
S0 — EmptyStackException — EmptyStackException
S1 — — — —
Modifier Behavior Abstraction
S0 Variant Invariant Invariant Invariant
S1 Variant Variant Invariant Invariant
Effects on state
11
20. A MORE COMPLEX EXAMPLE
void putNextEntry(Entry entry);
void write(String data);
void close();
StorageService
Exception thrown on not allowed operations
Set-like behavior and complex interaction protocol
12
21. INITIAL MODEL*
c, w w, pE S2
c c, w, pE
pE c
pE c
S S0 S1 pE S4 S5
pE pE
w, pE
w c
w S3
Legend: S:StorageService, w:write, c:close, pE:putNextEntry
State close putN extEntry write
Observer Abstraction
S0 ZipException — ZipException
S1 — [−, ZipException] —
S2 — [−, ZipException] ZipException
S3 — ZipException —
S4 — ZipException ZipException
S5 — IOException IOException *derived from
Modifier Behavior Abstraction test cases
S0 Invariant Variant Invariant containing
S1 Variant Variant Invariant
S2 Variant Invariant Invariant
entries e, f
S3 Variant Variant Invariant and writing
S4 Variant Invariant Invariant “0” 13
S5 Invariant Invariant Invariant
22. INITIAL MODEL*
c, w w, pE S2
c c, w, pE
pE c
pE c
S S0 S1 pE S4 S5
pE pE
w, pE
w c
w S3
First entry inserted
Legend: S:StorageService, w:write, c:close, pE:putNextEntry
State close putN extEntry write
Observer Abstraction
S0 ZipException — ZipException
S1 — [−, ZipException] —
S2 — [−, ZipException] ZipException
S3 — ZipException —
S4 — ZipException ZipException
S5 — IOException IOException *derived from
Modifier Behavior Abstraction test cases
S0 Invariant Variant Invariant containing
S1 Variant Variant Invariant
S2 Variant Invariant Invariant
entries e, f
S3 Variant Variant Invariant and writing
S4 Variant Invariant Invariant “0” 13
S5 Invariant Invariant Invariant
23. INITIAL MODEL* blocks write
Duplicate entry
c, w w, pE S2
c c, w, pE
pE c
pE c
S S0 S1 pE S4 S5
pE pE
w, pE
w c
w S3
First entry inserted
Legend: S:StorageService, w:write, c:close, pE:putNextEntry
State close putN extEntry write
Observer Abstraction
S0 ZipException — ZipException
S1 — [−, ZipException] —
S2 — [−, ZipException] ZipException
S3 — ZipException —
S4 — ZipException ZipException
S5 — IOException IOException *derived from
Modifier Behavior Abstraction test cases
S0 Invariant Variant Invariant containing
S1 Variant Variant Invariant
S2 Variant Invariant Invariant
entries e, f
S3 Variant Variant Invariant and writing
S4 Variant Invariant Invariant “0” 13
S5 Invariant Invariant Invariant
24. INITIAL MODEL* blocks write
Duplicate entry
c, w w, pE S2
c c, w, pE
pE c
pE c
S S0 S1 pE S4 S5
pE pE
w, pE
w c
w S3
First entry inserted Two valid entries inserted
Legend: S:StorageService, w:write, c:close, pE:putNextEntry
State close putN extEntry write
Observer Abstraction
S0 ZipException — ZipException
S1 — [−, ZipException] —
S2 — [−, ZipException] ZipException
S3 — ZipException —
S4 — ZipException ZipException
S5 — IOException IOException *derived from
Modifier Behavior Abstraction test cases
S0 Invariant Variant Invariant containing
S1 Variant Variant Invariant
S2 Variant Invariant Invariant
entries e, f
S3 Variant Variant Invariant and writing
S4 Variant Invariant Invariant “0” 13
S5 Invariant Invariant Invariant
25. INITIAL MODEL* blocks write
Duplicate entry
c, w w, pE S2
c c, w, pE
pE c
pE c
No more valid
S S0 S1 pE S4 S5
entries
pE pE
w, pE available?
w c
w S3
First entry inserted Two valid entries inserted
Legend: S:StorageService, w:write, c:close, pE:putNextEntry
State close putN extEntry write
Observer Abstraction
S0 ZipException — ZipException
S1 — [−, ZipException] —
S2 — [−, ZipException] ZipException
S3 — ZipException —
S4 — ZipException ZipException
S5 — IOException IOException *derived from
Modifier Behavior Abstraction test cases
S0 Invariant Variant Invariant containing
S1 Variant Variant Invariant
S2 Variant Invariant Invariant
entries e, f
S3 Variant Variant Invariant and writing
S4 Variant Invariant Invariant “0” 13
S5 Invariant Invariant Invariant
31. CHECKING THE PROTOCOL
OPERATION OUTCOME STATE
s = StorageService(); - S0
c, w w, pE S2
c c, w, pE
pE
s.putNextEntry(a) - S1 c
pE c
s.putNextEntry(a) - ? S S0 S1 pE S4 S5
pE pE
w, pE
w c
w S3
Legend: S:StorageService, w:write, c:close, pE:putNextEntry
State close putN extEntry write
Observer Abstraction
S0 ZipException — ZipException
S1 — [−, ZipException] —
S2 — [−, ZipException] ZipException
S3 — ZipException —
S4 — ZipException ZipException
S5 — IOException IOException
Modifier Behavior Abstraction
S0 Invariant Variant Invariant
S1 Variant Variant Invariant
S2 Variant Invariant Invariant
S3 Variant Variant Invariant
S4 Variant Invariant Invariant
S5 Invariant Invariant Invariant
19
32. CHECKING THE PROTOCOL
OPERATION OUTCOME STATE
s = StorageService(); - S0
c, w w, pE S2
c c, w, pE
pE
s.putNextEntry(a) - S1 c
pE c
s.putNextEntry(a) - ? S S0 S1 pE S4 S5
pE pE
w, pE
w c
w S3
Legend: S:StorageService, w:write, c:close, pE:putNextEntry
State close putN extEntry write
Observer Abstraction
S0 ZipException — ZipException
S1 — [−, ZipException] —
S2 — [−, ZipException] ZipException
S3 — ZipException —
S4 — ZipException ZipException
S5 — IOException IOException
Modifier Behavior Abstraction
S0 Invariant Variant Invariant
S1 Variant Variant Invariant
S2 Variant Invariant Invariant
S3 Variant Variant Invariant
S4 Variant Invariant Invariant
S5 Invariant Invariant Invariant
19
33. CHECKING THE PROTOCOL
OPERATION OUTCOME STATE
s = StorageService(); - S0
c, w w, pE S2
c c, w, pE
pE
s.putNextEntry(a) - S1 c
pE c
s.putNextEntry(a) - ? S S0 S1 pE S4 S5
pE pE
w, pE
w c
w S3
Legend: S:StorageService, w:write, c:close, pE:putNextEntry
State close putN extEntry write
Observer Abstraction
S0 ZipException — ZipException
S1 — [−, ZipException] —
S2 — [−, ZipException] ZipException
S3 — ZipException —
S4 — ZipException ZipException
S5 — IOException IOException
Modifier Behavior Abstraction
S0 Invariant Variant Invariant
S1 Variant Variant Invariant
S2 Variant Invariant Invariant
S3 Variant Variant Invariant
S4 Variant Invariant Invariant
S5 Invariant Invariant Invariant
19
34. CHECKING THE PROTOCOL
OPERATION OUTCOME STATE
s = StorageService(); - S0
c, w w, pE S2
c c, w, pE
pE
s.putNextEntry(a) - S1 c
pE c
s.putNextEntry(a) - ? S S0 S1 pE S4 S5
pE pE
w, pE
It depends on the w
w S3 c
outcome of next Legend:
State close
S:StorageService, w:write, c:close, pE:putNextEntry
putN extEntry write
operations S0 ZipException
Observer Abstraction
— ZipException
S1 — [−, ZipException] —
S2 — [−, ZipException] ZipException
S3 — ZipException —
Check on the clone S4
S5
—
—
ZipException
IOException
Modifier Behavior Abstraction
ZipException
IOException
results of a S0
S1
Invariant
Variant
Variant
Variant
Invariant
Invariant
discriminating operation
S2 Variant Invariant Invariant
S3 Variant Variant Invariant
S4 Variant Invariant Invariant
with known instances S5 Invariant Invariant Invariant
19
35. PROTOCOL VIOLATION (1)
OPERATION OUTCOME STATE
s = StorageService(); - S0
c, w w, pE S2
c c, w, pE
S1 pE
s.putNextEntry(a) - c
pE c
s.putNextEntry(a) - S2 S S0 S1 pE S4 S5
pE pE
w, pE
s.putNextEntry(b) - S2
w c
w S3
s.write(data) - ?
Legend: S:StorageService, w:write, c:close, pE:putNextEntry
State close putN extEntry write
Observer Abstraction
S0 ZipException — ZipException
S1 — [−, ZipException] —
S2 — [−, ZipException] ZipException
S3 — ZipException —
S4 — ZipException ZipException
S5 — IOException IOException
Modifier Behavior Abstraction
S0 Invariant Variant Invariant
S1 Variant Variant Invariant
S2 Variant Invariant Invariant
S3 Variant Variant Invariant
S4 Variant Invariant Invariant
S5 Invariant Invariant Invariant
20
36. PROTOCOL VIOLATION (1)
OPERATION OUTCOME STATE
s = StorageService(); - S0
c, w w, pE S2
c c, w, pE
S1 pE
s.putNextEntry(a) - c
pE c
s.putNextEntry(a) - S2 S S0 S1 pE S4 S5
pE pE
w, pE
s.putNextEntry(b) - S2
w c
w S3
s.write(data) - ?
Legend: S:StorageService, w:write, c:close, pE:putNextEntry
State close putN extEntry write
Observer Abstraction
S0 ZipException — ZipException
S1 — [−, ZipException] —
S2 — [−, ZipException] ZipException
S3 — ZipException —
S4 — ZipException ZipException
S5 — IOException IOException
Modifier Behavior Abstraction
S0 Invariant Variant Invariant
S1 Variant Variant Invariant
S2 Variant Invariant Invariant
S3 Variant Variant Invariant
S4 Variant Invariant Invariant
S5 Invariant Invariant Invariant
20
37. PROTOCOL VIOLATION (1)
OPERATION OUTCOME STATE
s = StorageService(); - S0
c, w w, pE S2
c c, w, pE
S1 pE
s.putNextEntry(a) - c
pE c
s.putNextEntry(a) - S2 S S0 S1 pE S4 S5
pE pE
w, pE
s.putNextEntry(b) - S2
w c
w S3
s.write(data) - ?
Legend: S:StorageService, w:write, c:close, pE:putNextEntry
State close putN extEntry write
Observer Abstraction
S0 ZipException — ZipException
S1 — [−, ZipException] —
S2 — [−, ZipException] ZipException
S3 — ZipException —
S4 — ZipException ZipException
S5 — IOException IOException
Modifier Behavior Abstraction
S0 Invariant Variant Invariant
S1 Variant Variant Invariant
S2 Variant Invariant Invariant
S3 Variant Variant Invariant
S4 Variant Invariant Invariant
S5 Invariant Invariant Invariant
20
38. PROTOCOL VIOLATION (1)
OPERATION OUTCOME STATE
s = StorageService(); - S0
c, w w, pE S2
c c, w, pE
S1 pE
s.putNextEntry(a) - c
pE c
s.putNextEntry(a) - S2 S S0 S1 pE S4 S5
pE pE
w, pE
s.putNextEntry(b) - S2
w c
w S3
s.write(data) - ?
Legend: S:StorageService, w:write, c:close, pE:putNextEntry
State close putN extEntry write
Observer Abstraction
S0 ZipException — ZipException
S1 — [−, ZipException] —
As seen before the test S2
S3
S4
—
—
—
[−, ZipException]
ZipException
ZipException
—
ZipException
ZipException
scope was too small, but S5 — IOException
Modifier Behavior Abstraction
IOException
we can fix the model!
S0 Invariant Variant Invariant
S1 Variant Variant Invariant
S2 Variant Invariant Invariant
S3 Variant Variant Invariant
S4 Variant Invariant Invariant
S5 Invariant Invariant Invariant
20
39. PROTOCOL VIOLATION (2)
OPERATION OUTCOME STATE
s = StorageService(); - S0
c, w w, pE S2
c c, w, pE
pE
s.write(“”) - ? c
pE c
S S0 S1 pE S4 S5
pE pE
w, pE
w c
w S3
Legend: S:StorageService, w:write, c:close, pE:putNextEntry
State close putN extEntry write
Observer Abstraction
S0 ZipException — ZipException
S1 — [−, ZipException] —
S2 — [−, ZipException] ZipException
S3 — ZipException —
S4 — ZipException ZipException
S5 — IOException IOException
Modifier Behavior Abstraction
S0 Invariant Variant Invariant
S1 Variant Variant Invariant
S2 Variant Invariant Invariant
S3 Variant Variant Invariant
S4 Variant Invariant Invariant
S5 Invariant Invariant Invariant
21
40. PROTOCOL VIOLATION (2)
OPERATION OUTCOME STATE
s = StorageService(); - S0
c, w w, pE S2
c c, w, pE
pE
s.write(“”) - ? c
pE c
S S0 S1 pE S4 S5
pE pE
w, pE
w c
w S3
Legend: S:StorageService, w:write, c:close, pE:putNextEntry
State close putN extEntry write
Observer Abstraction
S0 ZipException — ZipException
S1 — [−, ZipException] —
S2 — [−, ZipException] ZipException
S3 — ZipException —
S4 — ZipException ZipException
S5 — IOException IOException
Modifier Behavior Abstraction
S0 Invariant Variant Invariant
S1 Variant Variant Invariant
S2 Variant Invariant Invariant
S3 Variant Variant Invariant
S4 Variant Invariant Invariant
S5 Invariant Invariant Invariant
21
41. PROTOCOL VIOLATION (2)
OPERATION OUTCOME STATE
s = StorageService(); - S0
c, w w, pE S2
c c, w, pE
pE
s.write(“”) - ? c
pE c
S S0 S1 pE S4 S5
pE pE
w, pE
w c
w S3
Legend: S:StorageService, w:write, c:close, pE:putNextEntry
ZipException expected! State close putN extEntry
Observer Abstraction
write
S0 ZipException — ZipException
S1 — [−, ZipException] —
S2 — [−, ZipException] ZipException
Special values are S3
S4
S5
—
—
—
ZipException
ZipException
IOException
—
ZipException
IOException
unknown in advance S0 Invariant
Modifier Behavior Abstraction
Variant Invariant
S1 Variant Variant Invariant
S2 Variant Invariant Invariant
S3 Variant Variant Invariant
S4 Variant Invariant Invariant
S5 Invariant Invariant Invariant
21
43. IS THE VIOLATION A CHANGE?
We can tell it replaying the
traces contained in the
Behavioral Equivalence Model
Everything still works: Different results:
previously unobserved behavior change detected
23
45. MODEL UPDATES
Old Behavior
Equivalence Model
Trace exposing
new behavior
24
46. MODEL UPDATES
Old Behavior
Equivalence Model
Extended scopes
for existing models
Trace exposing
new behavior
24
47. MODEL UPDATES
Old Behavior
Equivalence Model
Set of Behavior
Extended scopes
Equivalence
for existing models
Models
Trace exposing
new behavior
24
48. MODEL UPDATES
Old Behavior
Equivalence Model
Set of Behavior
Extended scopes
Equivalence
for existing models
Models
Trace exposing
new behavior
Incremental
Add only new information
24
49. MODEL UPDATES
Old Behavior
Equivalence Model
Set of Behavior
Extended scopes Updated Protocol
Equivalence
for existing models Behavior Model
Models
Trace exposing
new behavior
Incremental
Add only new information
24
50. UPDATED MODEL
c, w pE, w c
pE w, pE
pE c
S S0 S1 pE S2
c S5
pE pE c
pE c, w, pE
S3 S4
w w, pE
Legend: S:StorageService, w:write, c:close, pE:putNextEntry
State close putN extEntry write
Observer Abstraction
S0 ZipException — ZipException
S1 — [−, ZipException] —
S2 — [−, ZipException] ZipException
S3 — ZipException —
S4 — ZipException ZipException
S5 — IOException IOException
Modifier Behavior Abstraction
S0 Invariant Variant Invariant
S1 Variant Variant Invariant
S2 Variant Invariant Invariant
S3 Variant Variant Invariant
S4 Variant Invariant Invariant
S5 Invariant Invariant Invariant 25
51. UPDATED MODEL
c, w pE, w c
pE w, pE
pE c
S S0 S1 pE S2
c S5
pE pE c
First entry inserted pE c, w, pE
S3 S4
w w, pE
Legend: S:StorageService, w:write, c:close, pE:putNextEntry
State close putN extEntry write
Observer Abstraction
S0 ZipException — ZipException
S1 — [−, ZipException] —
S2 — [−, ZipException] ZipException
S3 — ZipException —
S4 — ZipException ZipException
S5 — IOException IOException
Modifier Behavior Abstraction
S0 Invariant Variant Invariant
S1 Variant Variant Invariant
S2 Variant Invariant Invariant
S3 Variant Variant Invariant
S4 Variant Invariant Invariant
S5 Invariant Invariant Invariant 25
52. UPDATED MODEL c
c, w pE, w Duplicate entry
pE w, pE
pE c
S S0 S1 pE S2
c S5
pE pE c
First entry inserted pE c, w, pE
S3 S4
w w, pE
Legend: S:StorageService, w:write, c:close, pE:putNextEntry
State close putN extEntry write
Observer Abstraction
S0 ZipException — ZipException
S1 — [−, ZipException] —
S2 — [−, ZipException] ZipException
S3 — ZipException —
S4 — ZipException ZipException
S5 — IOException IOException
Modifier Behavior Abstraction
S0 Invariant Variant Invariant
S1 Variant Variant Invariant
S2 Variant Invariant Invariant
S3 Variant Variant Invariant
S4 Variant Invariant Invariant
S5 Invariant Invariant Invariant 25
53. UPDATED MODEL c
c, w pE, w Duplicate entry
pE w, pE
pE c
S S0 S1 pE S2
c S5
pE pE c
First entry inserted pE c, w, pE
S3 S4
w w, pE Scope effects
Legend: S:StorageService, w:write, c:close, pE:putNextEntry
State close putN extEntry write
Observer Abstraction
S0 ZipException — ZipException
S1 — [−, ZipException] —
S2 — [−, ZipException] ZipException
S3 — ZipException —
S4 — ZipException ZipException
S5 — IOException IOException
Modifier Behavior Abstraction
S0 Invariant Variant Invariant
S1 Variant Variant Invariant
S2 Variant Invariant Invariant
S3 Variant Variant Invariant
S4 Variant Invariant Invariant
S5 Invariant Invariant Invariant 25
54. CHANGE DETECTION
Effectiveness of change
detection proved injecting
faults in the component
Always working and always exceptional
implementation for each method
26