JP2590277B2 - System test equipment - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION [Purpose of the Invention] (Field of Industrial Application) The present invention relates to a system test apparatus that automatically verifies whether a system under test is operating as required.

2. Description of the Related Art Conventionally, when a test of a device under test is performed, data is created in advance according to items to be tested, and a method of confirming that the device under test operates as it is has been performed.
That is, the data to be provided to the device under test for each test item based on the design specification and the expected value of the data to be output according to the data provided by the device to be tested are created along the time axis.

 FIG. 5 shows an outline of a conventional system test method.

FIG. 5 (A) is a diagram showing a configuration of the test apparatus. The test apparatus 1 has a signal output unit 3 for providing setting data to the device under test 2 and a signal input for inputting detection data output from the device under test 2. And a comparison section 5 for comparing the detection data input to the signal input section 4 with an expected value of the detection data output corresponding to the setting data given to the device under test.

Here, it is assumed that the device under test 2, for example, a refrigerator has design specifications as shown in FIG. 5 (B). According to this setting specification, "the switch is pressed on the device under test"
This means that the signal at the terminal of SW6 changes from 5V to 0V.

“Rotating the motor” means changing the signal of the terminal of the motor 7 from 5V to 0V.

"Lighting the LED" means that the signal of the terminal of LED8 is 0
Change from V to 5V.

The “sensor voltage” is the voltage of the terminal of the sensor 9 and changes linearly.

Given these conditions, the test data creator
The setting data 10 corresponding to the SW 6 and the sensor 9 and the expected value 11 corresponding to the motor 7 and the LED 8 shown in FIG. The setting data 10 is held in the signal output unit 3, and the expected value 11 is held in the comparison unit 5.

Next, the operation of the conventional test apparatus 1 for checking the operation of the device under test 2 will be described.

First, the terminal of SW6 is initialized to 5V in the first step, and subsequently, the terminal of SW6 is changed to 0V in the second step to create a state where SW6 is pressed. Here, when 5 V is input in the first step and 0 V in the second step as a signal of the terminal of the motor 7 from the device under test 2 to the signal input unit 4, the signal is input to the signal input unit 4 in the comparison unit 5. The detected data is compared with the expected value 11 held in the comparing unit 5, and in the second step, the verification data of the design specification of "rotate the motor when the switch is pressed" is completed.

As described above, the SW6 or the sensor 9 shown in FIG.
Is sequentially supplied to the device under test 2 while the motor 7 or the LED 8 output from the device under test 2 is provided.
By monitoring the signal data and comparing it with the expected value 11, it was verified that the device was operating as designed.

(Problems to be Solved by the Invention) However, in the above-described verification device, the verification of the system is performed by collating the expected value and the detected value of the system operation along the time axis. There is information that cannot be strictly determined with respect to time due to an error or the like.

For example, if the system under test handles temperature and approves the condition that the temperature will be -21.5 ° C, the temperature is detected by the sensor, but the sensor has an error and the performance is ± 0.5 ° C. If an error is allowed, it is considered that the above-mentioned state is reached at any time between −21.0 ° C. and −22.0 ° C. However, there is a problem that it is not possible to determine at which time −21.5 ° C. has been reached.

In order to automate the verification of this type of system, it is necessary to handle information including such errors, but at present, no technique has been established for this.

Furthermore, there are cases where the system specifications themselves include redundancy. For example, the specification of FIG. 6 indicates that the compressor should be run when the timer has passed 6 minutes and the temperature has exceeded -13.degree. When two types of events, timer and temperature, occur at the same time, the state ST is set so that the same result will be obtained regardless of which system is processed first.
1. An intermediate state called ST2 is provided.

In such a case, it is difficult to externally determine whether the operation state of the system is ST1 or ST2, and a test technique for a system including redundancy has not been established.

The present invention has been made in view of the above circumstances, and has as its object to provide a system test apparatus that can automatically verify the operation of a system that handles information including errors and redundancy.

[Configuration of the Invention] (Means for Solving the Problems) A system test apparatus of the present invention stores expected information in specifications required of a system under test, including time information, in a description based on a finite state machine model. Storage means for performing the operation, and detecting means for detecting operation information comprising a combination of an event and an action in the system under test; receiving the operation information detected by the detecting means; and estimating the state of the system under test from the operation information. Based on a non-deterministic automaton that executes a finite state machine model corresponding to the estimated state of the system under test and a finite state machine model executed by the non-deterministic automaton,
The operation information is compared with the specifications of the system under test, and if inconsistencies are found during that time, another combination of events and actions in the system under test is selected as operation information going back to the stage of estimating the state of the system under test. And
A verification means for re-estimating the state of the system under test from the selected operation information and performing the verification again is provided.

(Operation) In the present invention, while the expected information in the specification required for the system under test is stored in a description based on the finite state machine model including the time information, the operation information of the system under test is detected. The state of the system under test is estimated from the detected operation information.

Then, a finite state machine model corresponding to the estimated state of the system under test is executed, the specification of the system under test stored in advance is compared with the state, and it is verified whether there is any contradiction.

The operation information to be verified here is regarded as series information in which possible events and actions that can occur from the start to the end of the test are combined.

As this combination, one of the possible combinations of the event and the action that overlap each other in the time interval that occurred is selected, and the state of the system under test (what kind of event occurs, Action is triggered).

Next, the estimated state is collated and verified according to a finite state machine model describing the specifications of the system under test.

The matching according to the finite state machine model is performed by the automaton, and is verified by the verification unit.

If the verification results in an error, the automaton is returned to the stage of selecting one of the possible combinations of events and actions (hereinafter referred to as backtracking), and the system under test is returned. Recheck and verify again for another possible state.

The error in the verification result is between the state of the system under test estimated by the automaton and the expected information in the specification of the system under test that "if such an event occurs, such an action should occur." An inconsistency occurs when all possible states during the test time are verified by running the automaton, and when the result in all these cases is an error,
For the first time, the system under test is determined to be defective.

Therefore, it is possible to automate the verification of the system including the measurement error such as the error of the sensor and the error of the operation detection and the redundancy while actually executing the system.

Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

FIG. 1 is a block diagram showing a configuration of a system test apparatus according to one embodiment of the present invention.

In this figure, this system test device is a test device.
The device comprises a test device 21 and a device under test 22. In this embodiment, a refrigerator is used as the device under test 22.

In the refrigerator as the device under test 22, the refrigerator control unit 24 controls the rotation of a motor 25 for driving a compressor (not shown) based on the temperature measured by a sensor 23 that measures the temperature of the freezer compartment. From the device under test 22 to the test device 21, the signal of the power switch 26, the temperature data measured by the sensor 23, the rotation data of the motor 25, and the signal of a timer (not shown) in the refrigerator control unit 24 indicate the operation of the refrigerator. It is output as a detection signal.

The detection signal is input to a signal input unit 27 of the test apparatus 21. From the detection signal input to the signal input unit 27, an event is extracted based on a finite state machine model into an event extraction unit 28.
And the action is extracted to the action extraction unit 29.

On the other hand, the specification required for the device under test 22 is stored in the specification data file 30 as expected information in a description based on the finite state machine model. Data extracted in the event extraction unit 28 and the action extraction unit 29, according to the automaton 31 that manages the state of the device under test 22 based on the specifications stored in the specification data file 30,
The verification is performed by the verification unit 32 by collating with the specification.

The specification data file 30 has a table format.
For example, event data including various event names, occurrence modes, allowable errors, etc., action data, and state transition data are stored.

The automaton 31 uses a non-deterministic automaton. That is, the event extraction unit 28 and the action extraction unit 29
In the case where there are a plurality of sets of operation information of the device under test 22 consisting of the data extracted in the above, the information is sequentially executed, and if inconsistency occurs, the information is backtracked to the information selection stage and executed again. It is.

The verification result in the verification unit 32 is input to the display unit 33 and the report unit 34 via the automaton 31 and is displayed on the CRT display 35 and the report file 36
Is stored in

Here, the finite state machine model will be described. A finite state machine model is represented by a set of state transitions caused by the occurrence of a finite number of states and events (input signals). A model in which some action (operation on an input signal) is caused at the time of state transitions for the occurrence of an event. In this case, in consideration of the range of the measurement error and the like and the redundancy of the system specifications, the occurrence time of the event or the action is expressed not as a time point but as a possible time interval.

That is, the occurrence time of the event is expressed by the time when the possibility of occurrence of the event occurs and the time when the event is completed. For example, the event "freezer temperature> -21.5 ° C" occurs when the temperature of the freezer is higher than -21.5 ° C, which is identified by a sensor measuring the temperature of the freezer.

By the way, the sensor usually has a measurement error, and if this measurement error is ± 0.5 ° C., “freezing room temperature>
The event “−21.5 ° C.” must occur somewhere between −21 ° C. and −22 ° C. and cannot be detected accurately. Therefore, considering a measurement error of ± 0.5 ° C. with the sensor, FIG. 2 (A), as the error range (B), the event end time from the event start time T _ES T
The section up to _EE is treated as the occurrence time. Actions are also captured in time intervals, similar to events.

As described above, FIG. 3 shows the correspondence between the event and the action, which is captured in the time interval in which the event and the action can occur.

As shown in FIG. 3, FIG. 3 (A) and FIG. 3 (B)
Between T _S and T _E determined by the theoretical product of the occurrence time of the event and the action in, there is a correspondence between the event and the action, and this section transits to the state where the action for the occurrence of the event has been triggered It shows that. As described above, the time (state time) when the state transits to a certain state can be expressed by the time interval by the correspondence between the event and the action. That is, in FIGS. 3A and 3B, a section from T _S to T _E is a state time.

On the other hand, in FIG. 3 (C), there is no correspondence between events and actions, and there is no state time. In this case, it indicates that a contradiction has occurred in the system.

FIG. 3D shows an example in which there are a plurality of pairs of events and actions that can occur, and it cannot be determined which pair actually occurred first. In this example, there are four possible combinations of two types of events and two types of actions. Actually, when there are a plurality of combinations excluding an unacceptable combination among these combinations, it is uncertain.

When the state becomes uncertain, select an arbitrary (or high-probability) one from among the possible combinations, and proceed with the verification. If inconsistency occurs, go back to the previous uncertain state and make an event Select another combination of and action and perform the verification again.

In this way, the event, action, and state time are captured in time intervals, and in the uncertain state, one possible combination of event and action is selected as the operation information of the system under test, and if a contradiction occurs later, By backtracking to the selection stage and re-selecting the operation information, it is also possible to verify a system including errors and redundancy.

It should be noted that even in a system in which events, actions, and state times are accurately captured by time, redundancy can be verified by applying the present invention.

Next, an example in which the system test apparatus having the above configuration is applied to a refrigerator and actually verified will be described.

The refrigerator used here shall have the following specifications.

 Always operate the compressor when turning on the power.

When the freezing room temperature rises above -20 ° C, the compressor is operated to lower the room temperature.

When the freezing room temperature falls below -30 ° C, the compressor is stopped and the room temperature is not further reduced.

Once the compressor stops, it does not resume operation for 5 minutes.

When the freezer door is opened, the compressor runs until it is closed.

FIG. 4 shows the above specifications in a state transition diagram.
The operation of the refrigerator will be described with reference to FIG.

First, from the state 0 (STO), the correspondence between “event: power ON” and “action: compressor operation” is determined based on the event data and action data extracted by the event extraction unit 28 and the action extraction unit 29, and the specification data file 30.
The verification is performed by comparing the expected information stored in the verification unit 32 with the expected information.

When the automaton 31 confirms that the correspondence in the STO has been taken, the state transits to ST1. In this transition, a detection error is added. The verification by the verification unit 32 is also performed in each of the following states.

In ST1, "event: freezing room temperature -30 ° C or less" and "action: compressor stop, compressor protection timer initialization" are taken. At this point, taking into account the error of the temperature sensor and the detection error, a correspondence between the event and the action is taken using the concept of the occurrence time. If the correspondence is established, the state transits from ST1 to ST3.

In ST3, the state time of ST3 is determined by the correspondence between the event and the action.
Minute ”is detected, and the process transits to ST2. The internal timer is treated as an internal event.

In ST2, if "Event 1: freezer compartment temperature -20 ° C or higher", take the action of "Action: Compressor operation", and if "Event 2: Freezer compartment door open", take the same action of "Action: Compressor operation". Transition to ST4.

In ST4, if "event: freezer compartment door closed", a response of "action: compressor stoppage, compressor protection timer initialization" is detected, and a transition is made to ST3.

In ST2, (Event 1, Action), (Event 2,
It is assumed that the two combinations (action) can be caused (selectable). When (Event 1, Action) is selected first, the process transitions to ST1, but Event 2 which was not evaluated that the freezer compartment temperature did not reach -30 ° C, a door closing event, a compressor stop action, etc. are recognized. Suppose that a contradiction was found from the relationship between the possible occurrence times.

In this case, the process returns to the previous ST2, selects (event 2, action) in the future, transits to ST4, and thereafter repeats this operation.

In this example, since the door was opened in ST2, the temperature exceeded -20 ° C, and the event of exceeding -20 ° C does not need to be evaluated. This is a reduction arising from the redundancy of the system specification, but using the method nevertheless makes it verifiable.

In this way, based on the finite state machine model describing the specifications of the system under test, a possible combination of an event and an action is considered as the system under test and operation information, and if uncertain, one pair is selected first. Automatically verifies the system including errors such as sensor errors, motion detection errors, and redundancy by causing the automaton to execute and returning to an uncertain state if inconsistencies are found be able to.

The system test apparatus of the present invention is not limited to the above embodiment, but can be variously changed.

[Effects of the Invention] As described above, in the system test apparatus of the present invention, the specification of the system under test is described by a finite state machine model, and the automaton is considered in consideration of the influence of the error of the system or the inspection equipment on the verification. An extended non-deterministic automaton is introduced.

By using this non-deterministic automaton to repeatedly execute all possible states of the system under test, it is possible to automate the system test and improve the reliability.

[Brief description of the drawings]

FIG. 1 is a diagram showing a configuration of a system test apparatus according to an embodiment of the present invention, FIG. 2 is a diagram showing a range of a sensor error, and FIG.
The figure shows the correspondence between events and actions.
FIG. 5 is a state transition diagram showing a state transition in one embodiment of the present invention, FIG. 5 is a diagram showing a configuration of a conventional system test apparatus, and FIG. 6 is a state transition diagram showing redundancy of system specifications. 21 Test device 22 Device under test 27 Signal input unit 28 Event extraction unit 29 Action extraction unit 30 Specification data file 31 Automaton 32 Verification unit

Continued on the front page (72) Inventor Fumiaki Teshima 70, Yanagicho, Saiwai-ku, Kawasaki-shi, Kanagawa Prefecture Inside the Toshiba Yanagicho Plant Co., Ltd. (72) Inventor Takuya Kishimoto 8 Shinsugita-machi, Isogo-ku, Yokohama-shi, Kanagawa Prefecture Toshiba Audio-Video Engineering Co., Ltd. Development Office (56) References JP-A 1-260544 (JP, A) JP 1-260545 ( JP, A)

Claims (1)

(57) [Claims] 1. A storage means for storing expected information in specifications required for a system under test, including time information, in a description based on a finite state machine model, and a combination of an event and an action in the system under test. Detecting means for detecting the operation information, and receiving the operation information detected by the detection means; estimating the state of the system under test from the operation information; and a finite state machine model corresponding to the estimated state of the system under test. Based on the finite state machine model executed by the nondeterministic automaton, the operation information is checked against the specification of the system under test, and when an inconsistency is found therebetween, the system under test Going back to the stage of estimating the state of the Select a different combination as the operation information, system test apparatus characterized by comprising a verification means for performing again the match by estimating the state of the system under test again selected operation information.