JP2011008628A - Program model inspection method and program model inspection program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a program model inspection which avoids a phenomenon in which functions to be inspected are not executed owing to the order of inspection of program models, safely restricts the number of execution times of the functions, and reduces the execution time for program model inspection.SOLUTION: In the program model inspection device, the program model inspection executes steps of: suppressing function execution to end the inspection of execution sequence of functions and associating the function with the current state to record the function suppressing the execution in an execution suppressing function table with the function suppressing the execution defined therein when the number of execution times of executable functions in the current state is equal to or more than the upper limit of execution times; determining whether there is a combination of the current state and executable functions in the current state in the execution suppressing function table when transition to the current station is already done in the other function execution sequence; and executing the functions only when such a combination is found in the determination step.

Description

  The present invention relates to a program model checking method and a program model checking program for reducing an inspection time of program model checking.

  In the program model check, the check time increases as the size of the target program increases. That is, as the scale of the target program increases, the state transition graph to be searched becomes huge, and the search time becomes enormous.

  Therefore, conventionally, a method of limiting the search range to a scale that can be calculated in a realistic time by setting a limit on the number of times the function is executed is used. For example, when a function to be executed is selected, a technique is known that reduces the scale by excluding a function that has been called N times in a function execution sequence that reaches that state.

  The following two examples are not examples of program model checking, but are examples of techniques in which the scale to be processed is suppressed by limiting the number of executions of a function. For example, there is known a high-speed logic verification method that can avoid unnecessary repetition of simulation without requiring manual re-creation of simulation vectors or software. In other words, the simulation model of the simulator performs software simulation by operating the main routine. When the tracer traces the operation of the main routine by the simulation model and detects that the same routine is repeated, the tracer instructs the agent to substitute the routine. The agent executes the routine on its behalf and passes the result to the simulation model.

  As a program test method, a method is known in which the repeated measurement of frequent paths included in a test target program is suppressed and unnecessary overhead is avoided. In other words, the coverage measurement control program of the information processing apparatus determines whether or not the number of passages of each instruction or at least a branch instruction passed through the execution of the measurement target program has reached the upper limit number of measurements. The coverage measurement program is called when the instruction has not reached the number of measurements, and updates the number of times the instruction has passed.

  However, when checking is performed by limiting the number of executions of a function in program model checking, the state transition graph obtained as a result of the search may differ depending on the selection order of functions to be executed from a certain state. For example, when two functions can be executed from a certain state, if one function is searched first, all functions can be executed, but if the other function is executed first and searched, one function and the other function are not included. In some cases, the search ends due to a limit on the number of executions before calling this function.

  FIG. 21 shows a state transition diagram and a table for performing the inspection by limiting the number of executions of the function in the program model inspection. In the example shown in FIGS. 21A, 21B, and 21C, there are a start function, a product selection function, an input completion function, and a purchase function as executable functions. Each function is preset with a limit of the number of execution times. Suppose that

  First, in FIG. 21A, in the initial state, (1) when the start function is executed, the state transits to state 1, and the execution count 1 is recorded in association with the start function (see the table of A). Next, in FIG. 21B, in state 1, (2) the product selection function is executed and the state shifts to state 2, and the execution count 1 is recorded in association with the product selection function (see table B). Next, when the product selection function is to be executed in the state 2, since the product selection function has already been executed, the execution of the product selection function is restricted based on the preset limit number of one. Therefore, in the state 2 of FIG. 21B, the input completion function is selected and the state is changed to the state 3. In state 3, a purchase function is selected and executed.

  In the example shown in FIG. 21C, in the initial state, (1) the start function executes and transitions to state 1, and in state 1 (3) the input completion function executes and transitions to state 4. At this time, the number of executions 1 is recorded in association with the start function and the input completion function (see table C). In this case, since the start function and the input completion function are restricted from executing the start function and the input completion function based on a preset limit number of times, (4) the product selection function is selected and the state transitions to state 2. . However, since the start function, the input completion function, and the product selection function are already executed once when the state 2 is transitioned to, it becomes impossible to transition to the state 3 (see table C). In other words, since the purchase function cannot be executed even if the state is shifted to the state 3 due to the limited number of times, the search ends without executing the function to be inspected, and the inspection cannot be performed sufficiently.

JP 2000-20346 A JP-A-2005-339204

  It was made in view of the above situation, and it is possible to avoid the phenomenon that the function to be checked is not executed due to the search order of the program model checking, and to safely limit the number of times the function is executed. Another object of the present invention is to provide a program model checking method and a program model checking program for reducing the execution time of program model checking.

  In the program model check, a function that can be executed from each state in a test target program having a plurality of function execution series is executed with the number of executions within the function execution series being less than the upper limit of execution times. If the number of executions of a function that can be executed from the current state is equal to or greater than the upper limit value of the number of executions, the execution of the function is suppressed and the inspection of the function execution sequence is terminated, and the function is brought into the current state. Record in the execution suppression function table that defines the functions that are associated and suppress execution. In another function execution sequence, when transition to the current state has already been performed, whether or not there is a combination of the current state and a function executable from the current state in the execution suppression function table The function is executed only when there is a combination in the determination.

  In addition, when a function associated with a predetermined number or more states is detected in the execution suppression function table, the upper limit value of the number of executions of the function is increased.

  It is possible to avoid the phenomenon that the function to be checked is not executed due to the search order of the program model checking, to safely limit the number of times the function is executed, and to reduce the execution time of the program model checking.

It is the figure shown about an example of the structure of the program model test | inspection apparatus. It is a figure which shows the structure of the program model test | inspection apparatus of Example 1. FIG. A is a figure which shows the display screen of a goods ordering system. B is a figure which shows the state transition of a goods order system. C is a figure which shows an example of the state transition graph management table of a goods ordering system. The figure which shows operation | movement of a program control part is shown (program control processing). A is a figure which shows a state transition in case a start function is performed in an initial state, and it changes to the state 1. FIG. B is a diagram showing an execution option table in an initial state. C is a diagram showing an execution option table in state 1. FIG. A is a diagram showing a state transition in a case where the start function is executed in the initial state and the state transitions to the state 1, and the state selection transitions from the state 1 to the state 2 by executing the product selection function. B is a diagram showing an execution sequence table in states 1 and 2. FIG. A is a figure which shows the state transition which returns to the state 2 even if it selects goods in the state 2. B is a diagram showing an execution sequence table. C is a diagram showing an execution option table. A is a diagram showing a flow of narrowing down options based on the number of executions by the executable function narrowing unit. B is a diagram showing an execution sequence table. C is a diagram showing an execution count table. D and F are diagrams showing an execution option table. E is a diagram showing an execution inhibition function table. It is a figure which shows the example of the state transition for demonstrating executable function narrowing-down process. It is a flowchart which shows the operation | movement of an executable function narrowing-down process. It is a figure which shows the example of the state transition for demonstrating executable function narrowing-down process. A is a diagram showing a flow of narrowing down options according to the number of execution times of the executable function narrowing unit when the execution of the function is inhibited again according to the number of executions. B is a diagram showing an execution sequence table. C is a diagram showing an execution count table. D and F are diagrams showing an execution option table. E is a diagram showing an execution inhibition function table. It is a figure which shows an execution suppression function table. It is a figure which shows the structure of the program model test | inspection apparatus of Example 2. FIG. A shows the flowchart which shows operation | movement of Example 2. FIG. B is a diagram showing an execution count upper limit table. It is a figure which shows the structure of the program model test | inspection apparatus of Example 3. It is a flowchart which shows operation | movement of Example 3 (model check re-execution process). A is a diagram illustrating a first state transition. B is a diagram showing an execution inhibition function table. C is a diagram illustrating an execution count upper limit table. A is a diagram showing a second state transition. B is a diagram showing an execution inhibition function table. C is a diagram illustrating an execution count upper limit table. It is a figure which shows an example of the hardware constitutions of the computer which can implement | achieve the apparatus of embodiment. FIGS. 8A to 8C are a transition diagram and a table showing a conventional example in which checking is performed by limiting the number of executions of a function in program model checking.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
Example 1
(Constitution)
FIG. 1 is a diagram showing an example of a program model checking apparatus. FIG. 1 is a diagram showing a configuration example used when program model checking is performed. Here, program model checking involves extracting the behavior of the test target system from the design document / specification, creating software (pseudo system) described in the model checking dedicated language, and inputting test data to the pseudo system. It is a test to be performed. In order to perform program model checking, a driver for moving the target program and a stub for abstracting an external environment such as a database or a network are generally required.

The program model checking device 5 inputs the input data 6 imitating the user operation with respect to the inspection target program 2 instead of the client via the driver 1 to the inspection target program 2, and the inspection target program 2, the database stub 3, Exhaustive inspection is performed on the network stub 4. Then, the program model checking device 5 checks whether or not the check result satisfies the content (functional specification) stored in the property 7 and makes a determination.
Note that the program model checking device 5 may be a device in which software for executing the above-described program model checking is installed in a computer (such as a PC).

  FIG. 2 is a diagram showing the configuration of the program model checking device 5. The program model checking device 5 includes a program control unit 21, a program execution unit 22, an executable function narrowing unit 23, and a recording unit 24. In addition, the program control part 21, the program execution part 22, and the executable function narrowing down part 23 can also be implement | achieved using CPU and a programmable device. Further, software that realizes the functions of the program control unit 21, the program execution unit 22, and the executable function narrowing unit 23 may be installed in a computer (such as a PC). The recording unit 24 may be a memory built in the CPU or a recording device provided outside.

  The program control unit 21 acquires the internal state and the executable function from the inspection target program, instructs the executable function narrowing unit 23 to narrow down the executable functions, and selects one function from the narrowed execution option table 26. Select and instruct the program execution unit 22 to execute the function.

The program execution unit 22 executes the program using a function instructed by the program control unit 21.
The executable function narrowing unit 23 refers to the execution sequence table 27, deletes the function whose number of executions has reached the upper limit from the execution option table 26, and adds it to the execution suppression function table 29. In addition, a function recorded in the execution suppression function table 29 without reaching the upper limit of the number of executions in another execution series is deleted from the execution suppression function table 29 and added to the execution option table 26.

The recording unit 24 includes a state transition graph management table 25, an execution option table 26, an execution series table 27, an execution frequency table 28, and an execution suppression function table 29.
The state transition graph management table 25 is a table showing a state transition graph by “transition source state”, “execution function”, and “transition destination state”. In the “transition source state” of the state transition graph management table 25, an identification number indicating the state of the transition source program is recorded every time the program function is executed, and the executed function is identified in the “execution function”. Therefore, the function name and the like are recorded, and the current program state is recorded in the “transition destination state”. The “transition source state”, “execution function”, and “transition destination state” are recorded by the program control unit 21 in association with the “transition source state”.

The generation of the state transition graph will be described using an example in which the inspection target program is a product ordering system and a product is purchased from the display screen shown in FIG.
In the merchandise ordering system, a merchandise code corresponding to a merchandise to be purchased is entered into an input box 32 of a merchandise purchase screen 31 displayed on a display such as a PC and the merchandise is ordered. In the product ordering system, after the product code is input, when the user presses (selects) the “product selection” button 33 on the screen, the “input completion” button 34 and the “input change” button 35 are activated. In this state, when the “input complete” button 34 is pressed (selected) on the screen, a product to be purchased is determined, the “purchase” button 36 becomes active, and when the “purchase” button 36 is pressed (selected) on the screen. An order is placed through the network. When the “input change” button 35 is pressed (selected) on the screen, a transition is made to a state in which a product code is input again.

  It should be noted that when the information (product code, “product selection” button 33, “input completion” button 34, “input change” button 35, “purchase” button 36) input on the product purchase screen 31 is selected, The internal state of the system determined by the input information) is called the internal state.

FIG. 3B shows the state transition of the product ordering system described above, and FIG. 3C shows the state transition graph management table 25 of the product ordering system.
In the example of the state transition shown in FIG. 3B, “Start” is executed in the initial state, and the current state is changed to “State 1”. At this time, in the state transition graph management table 25, “initial state” is recorded in “transition source state”, “start” is recorded in “execution function”, and “state 1” is recorded in “transition destination state”.

  Here, the state indicated by “state 1” means that the product purchase screen 31 is displayed on the display, and the product code corresponding to the product to be purchased can be input from the input box 32. When the product code is input, “product selection” is entered. The button 33 and the “input complete” button 34 can be selected.

  Next, from the state shown in “state 1”, there are a case where the “product selection” button 33 is selected and transition is made to “state 2”, and a case where the “input completion” button 34 is transited to “state 5”. Conceivable. Therefore, in the example of FIG. 3C, “product selection” is recorded in “execution function” in association with “state 1” of “transition source state”, and “state 2” is recorded in “transition destination state”. . Furthermore, “input completion” is recorded in “execution function” in association with “state 1” of “transition source state”, and “state 5” is recorded in “transition destination state”. Similarly, the contents of “execution function” and “transition destination state” are recorded in association with “transition source state” for “state 2” to “state 5” of “transition source state”.

  In this example, the contents to be recorded are described as “initial state”, “start”, “state 1”, etc. for convenience, but “initial state” is included in the cells corresponding to the actual “transition source state” and “transition destination state”. An identification number or code corresponding to “state 1”... Is recorded. The “execution function” uses a function name used in the program source.

  The execution option table 26 has a “state” that records the current state and a “option” that records the function name of a function that can be executed in the current state in association with the current “state”. Further, in the “state” and “option” of the execution option table 26, the state identification number and the function name of the executable function are recorded in association with each other by the program control unit 21.

  The execution sequence table 27 records the execution sequence of functions from the initial state to the current state. The execution sequence table 27 includes an “transition source state” for recording an identification number for identifying a transition source state, an “execution function” for recording a function name of an executed function, and an identification number for identifying a transition destination state. Etc. have a “transition destination state”. Then, in the “transition source state”, “execution function”, and “transition destination state” of the execution sequence table 27, the function name of the function that can be executed in association with the identification number of the transition source state and the identification number of the transition destination state are the program control unit. 21 is recorded.

  The execution count table 28 records the number of times each function is executed in the current execution sequence. The execution count table 28 has a “function” that records the function name of the function and an “execution count” that records the number of times the target function has been executed. The number of times the target function is executed in association with the function name is recorded by the executable function narrowing unit 23.

  The execution suppression function table 29 records a function that has not been executed due to the execution frequency restriction in each state. The execution suppression function table 29 has a “state” that records an identification number for identifying the current state, and a “suppression function” that records a function name of a function excluded as an option. In addition, in “state” and “number of executions”, the function name of the function excluded as an option in association with the identification number of the current state is recorded by the executable function narrowing unit 23.

(Description of operation)
In the program model check, the program control unit 21 records the state after execution of the function of the program to be checked that has executed the program model check in the recording unit up to the current state. Then, the executable function narrowing unit 23 determines that the function is a deterrence function that inhibits execution when the number of times the function is executed in each state is equal to or greater than a preset upper limit of the number of executions. The information is recorded in the execution suppression function table of the recording unit in association with the above state. Also, when the current state after the execution of the function has already been executed, it is determined whether execution of the function executable in the current state is suppressed based on the suppression function and the state in the execution suppression function table Re-evaluate execution suppression.

  Then, an executable function is extracted from the current state, the number of times the extracted function is executed is smaller than a preset upper limit of the number of executions, and a function whose execution is suppressed is detected. The program execution unit 21 executes one of the functions detected from the above.

FIG. 4 shows the operation of the program control unit 21 (program control processing).
In step S <b> 1, when the transition from the initial state to the next state is made, the program control unit 21 extracts the current internal state in which the program model check has been performed on the inspection target program 2 and records it in the recording unit 24.

  For example, when the product ordering system 31 executes the start function in the initial state shown in FIG. 5A and transitions to the state 1, information on the function executable by the program control unit 21 in the initial state, input data, etc. Are extracted as the internal state corresponding to the initial state and recorded in the recording unit 24.

In step S2, the program control unit 21 detects an executable function from the current state and records it in the execution option table 26 in association with the current state.
For example, when the program model check is performed on the product ordering system described above and the current state is the initial state shown in FIG. 5A, the program control unit 21 is a function that can be executed from the internal state corresponding to the “initial state”. Detect a start function. Then, “start” corresponding to the start function is recorded in “option” of the execution option table 26 in association with the “initial state” (B in FIG. 5).

  Further, when the process proceeds from step S10 described later, for example, when the current state is state 1 shown in FIG. 5A, the program control unit 21 is an input that is a function that can be executed from the internal state corresponding to “state 1”. A selection function and a product selection function are detected. Then, “product selection” and “input completion” corresponding to the input selection function and the product selection function are recorded in “option” of the execution option table 26 in association with “state 1” (C in FIG. 5).

  In step S3, the program control unit 21 refers to the state transition graph management table 25 to determine whether the state has already been executed, that is, whether the state has already been changed to the state in the function execution sequence examined in the past. If not, the process proceeds to step S4, and if completed, the process proceeds to step S5.

  For example, the “transition source state” in the state transition graph management table 25 is compared with the current state to search for a match. If they match, the process proceeds to step S5 because it has been executed. If there is no match, it is determined that it has not been executed and the process proceeds to step S4.

  In step S4 (executable function narrowing process), the executable function narrowing unit 23 narrows down the options. The executable function narrowing unit 23 compares the number of execution times of each function executed at the time of the program model check with a preset execution number upper limit value, and detects a function that has reached the execution number upper limit value. Next, the corresponding function is detected from the “option” in the execution option table 26 using the corresponding function as a key, and the “state” associated with the “option” and the contents of the “option” are deleted. The details of the selection of options (executable function screening process) will be described later.

  In step S5 (execution suppression re-evaluation process), it is determined whether the executable function narrowing unit 23 has suppressed the execution of the function, and the execution option table 26 and the execution suppression function table 29 are controlled based on the determination result. Details of the execution suppression re-evaluation (execution suppression re-evaluation process) will be described later.

  In step S6, the program control unit 21 determines whether or not an executable function (option) corresponding to the current state remains. If it remains, the process proceeds to step S7, and if not, the process proceeds to step S11.

  For example, the program control unit 21 searches the execution option table 26 for “state” using the current state as a key, and if there is a corresponding state, the option remains, so the process proceeds to step S7, and there is no corresponding state. If no option remains, the process proceeds to step S11.

  In step S <b> 7, the program control unit 21 selects an arbitrary function from the executable functions (options) corresponding to the current state, and deletes the selected function from the execution option table 26.

  For example, in the case of the execution option table 26 shown in C of FIG. 5, since there is “input completed” and “product selection” associated with “state 1”, either one of the functions is selected and selected. An instruction to execute the function is sent from the program control unit 21 to the program execution unit 22. Thereafter, for example, if “product selection” is selected, the state “state 1” corresponding to the input completion function is deleted from the execution option table 26.

In step S8, the program execution unit 22 receives an instruction to execute the inspection target program from the program control unit 21, and executes the inspection target program 2.
In step S9, the current internal state changed by the inspection target program 2 executed in step S8 is recorded in the recording unit 24. As shown in A of FIG. 6, when the product selection function is executed from state 1 to state 2, the internal state (input data, executable function, display screen information, etc.) corresponding to state 2 is recorded. 24.

  In step S10, the program control unit 21 sets the “transition source state” indicating the previous state, the “execution function” corresponding to the selected function, and the current state in the state transition graph management table 25 and the execution sequence table 27. Record the corresponding "transition destination state".

  In the case of B in FIG. 6, when transitioning from the initial state to the state 1, the program control unit 21 starts the “initial state” corresponding to the initial state in the “transition source state” of the execution sequence table 27 in the “execution function”. “Start” corresponding to the function is recorded, and “State 1” corresponding to the current state is recorded in “Transition destination state”. Further, when the state transitions from state 1 to state 2, the program control unit 21 causes the “transition source state” of the execution sequence table 27 to be “state 1” corresponding to the state 1 and “execution function” to correspond to the product selection function “ “State 2” corresponding to the current state is recorded in “Product selection” and “Transition destination state”.

  When the process of step S10 is completed, the process proceeds to step S2. When the process proceeds to step S5 in step 3 and the process proceeds to step S6 by the process of step S5, the process after step S6 is performed. When the process proceeds to step S11, the following process is performed.

  In step S <b> 11, the program control unit 21 deletes the line whose current state is the transition source from the execution sequence table 27. As shown in FIG. 7A, when the product selection in state 2 returns to state 2 as shown in FIG. 7, the program control unit 21 displays “state 2”, “product selection”, and “state 2” as shown in FIG. 7B. Delete the line consisting of. Note that the current state is the transition source, for example, when the value of a variable used in the program does not change.

In step S12, the program control unit 21 changes the previous state to the current state. In the case of B in FIG. 7, since the previous state is “state 2”, the state transitions to the “state 2” state.
In step S13, the program control unit 21 determines whether or not an executable function (option) remains in the current state. If it remains, the process proceeds to step S7, and if not, the process proceeds to S14. For example, in the case of A in FIG. 7, since “input completion” corresponding to the input completion function in state 2 is recorded in the execution option table 26 of C in FIG. 7, the process proceeds to step S <b> 7.

  In step S14, the program control unit 21 determines whether the current state is the initial state (execution option table 26 is empty). If the initial state, the program model check is terminated. If not, the process proceeds to step S11. .

(Explanation of executable function narrowing process)
An operation for narrowing down options according to the number of executions of the executable function narrowing unit 23 will be described. FIG. 8A is a diagram illustrating a flow of narrowing down options according to the number of executions of the executable function narrowing unit 23.

In step S <b> 21, the executable function narrowing unit 23 aggregates the number of times each execution function is called from the execution sequence table 27 and updates the execution number table 28.
For example, the execution sequence table 27 is updated as follows. First, when the state transitions from the initial state of FIG. 9 to state 1 and the current state is state 1, only “start” is recorded in the “execution function” of the execution sequence table 27. The executable function narrowing unit 23 records “start” in the “function” of the execution count table 28 and also indicates that the start function corresponding to “start” has been executed once in the “execution count” of the execution count table 28. To record.

  Next, when an input completion function is selected and transitioned from state 1 to state 5 shown in FIG. 9, “input completion” is recorded in “execution function” of the execution sequence table 27 in addition to “start”. The possible function narrowing unit 23 records “input completion” in “function” of the execution frequency table 28. Further, the fact that “input completion” has been executed once is recorded in “execution count” of the execution count table 28.

  Next, when a product selection function is selected and transitioned from state 5 to state 2 shown in FIG. 9, “product selection” is recorded in addition to “execution function” in the execution sequence table 27. The inserting unit 23 records “product selection” in the “function” of the execution frequency table 28. Further, the fact that “input completion” has been executed once is recorded in “execution count” of the execution count table 28.

  When the current state reaches state 2 by updating the execution number table 28 as described above, the execution number table 28 indicates “start”, “input completion”, “product selection” as shown in C of FIG. “1”, “1”, and “1” are recorded in the number of executions corresponding to.

In step S <b> 22, the executable function narrowing unit 23 selects one row corresponding to the current state from the execution option table 26.
In step S23, the executable function narrowing unit 23 acquires the number of executions of the function from the execution number table 28 using the function recorded in the “option” of the row selected in step S22 as a key.

  In step S24, it is determined whether the number of executions of the function selected by the executable function narrowing unit 23 in step S22 is equal to or greater than a preset designated number (execution number upper limit). If the specified number of times is exceeded, the process proceeds to step S25, and if the specified number has not been reached, the process proceeds to step S27.

In step S <b> 25, the executable function narrowing unit 23 records the function excluded from the current state and options in the execution inhibition function table 29.
In step S26, the executable function narrowing unit 23 deletes the line selected in step S22 from the execution option table 26.

In step S <b> 27, it is determined whether the executable function narrowing unit 23 has processed all the rows corresponding to the current state of the execution option table 26.
For example, when the state transits to the state 2 in FIG. 9, the recorded content of the execution option table 26 becomes a state as shown in D of FIG. In step S22, the executable function narrowing-down unit 23 selects one of the rows having “state 2”, “input completed” or “state 2” “product selection” corresponding to the state 2 from the execution option table 26 in FIG. Select. In this example, “state 2” and “input completed” are selected.

  In step S <b> 23, the executable function narrowing down unit 23 acquires “1” recorded in “execution count” corresponding to “input completion” in the execution count table 28 using “input completion” as a key. In step S24, the number of executions “1” corresponding to “input completion” is compared with the preset number of executions upper limit “1”. Since the number of executions has reached the number of executions upper limit, the process proceeds to step S25. . In step S <b> 25, the executable function narrowing unit 23 determines that the input completion function has already been executed, and deletes the “status 2” and “input completion” rows from the execution option table 26. In step S <b> 26, the executable function narrowing unit 23 records “state 2” and “input completed” in the locations corresponding to “state” and “suppression function” in the execution suppression function table 29. In step S <b> 27, it is determined whether the executable function narrowing unit 23 has processed all the rows corresponding to the current state of the execution option table 26. In this example, since there are still “state 2” and “product selection” in the execution option table 26, the process proceeds to step S22.

For “state 2” and “product selection” in the execution option table 26, the processes of steps S22 to S27 are performed in the same manner as described above. As a result, the execution suppression function table 29 and the execution option table 26 are updated as indicated by E and F in FIG. 8, and the executable function narrowing process is terminated.
Note that “x” in FIG. 9 indicates a inhibited function.

(Explanation of execution suppression re-evaluation of executable function screening processing)
FIG. 10 is a flowchart showing the operation of step S5 (executable function narrowing process) in FIG.
In step S3 of FIG. 4, when the process proceeds to step S5 due to the state recorded in the state transition graph management table 25, the processes of steps S31 to S38 are performed.

  Execution suppression re-evaluation of the executable function narrowing process will be described with reference to FIG. FIG. 11 shows that when the process proceeds to step S5, a program model check from initial state-state 5 to state 2 is performed, and after that, the product selection function is executed in state 1 and a transition to state 2 is made. FIG.

  In step S31, the executable function narrowing unit 23 determines whether there is a row corresponding to the current state in the execution inhibition function table 29. If there is a current state in the execution suppression function table 29, the process proceeds to step S32. If not, the process proceeds to step S11 in FIG.

  For example, if the current state is state 2, the executable function narrowing unit 23 searches for “state 2” in the “state” of the execution suppression function table 29 in FIG. 11B. Since there is “state 2” in the execution inhibition function table 29 of FIG. 11B, the process proceeds to step S32.

In step S32, as in step 4, the executable function narrowing unit 23 narrows down options based on the number of executions.
FIG. 12A is a diagram illustrating a flow of narrowing down options according to the number of execution times of the executable function narrowing unit 23 when the function execution suppression state is reached again according to the number of executions.

  In step S21, the executable function narrowing unit 23 adds up the number of times each execution function is called from the execution sequence table 27 in FIG. 12B, and updates the execution number table 28 in FIG. The function executed in the state 2 is a function associated with “start” and “product selection” recorded in the execution sequence table 27 in FIG. In the execution count table 28 of FIG. 12C, “start” and “product selection” are each executed once, so “1” is recorded in “execution count”.

  In step S <b> 22, the executable function narrowing unit 23 selects one function (option) that can be executed in the current state from the execution option table 26. In this example, since there are “input completed” and “product selection” in the execution option table 26 as options corresponding to the state 2, a row having “state 2” and “product selection” is selected.

In step S23, the number of executions of the function is acquired from the number-of-executions table 28 using the row option selected in step S22 as a key.
In step S24, it is determined whether the number of executions of the function selected by the executable function narrowing unit 23 in step S22 is equal to or greater than a preset designated number (execution number upper limit). In this example, since the execution count “1” of the product selection function has reached the execution count upper limit “1”, the process proceeds to step S25, and if not, the process proceeds to step S27.

In step S <b> 25, the executable function narrowing unit 23 records the current state and the option “product selection” in the execution inhibition function table 29.
In step S26, the executable function narrowing unit 23 deletes the line selected in step S22 from the execution option table 26.

As a result of the processing in steps S25 and S26, the execution suppression function table 29 and the execution option table 26 are in a state as shown in E and F of FIG.
In step S <b> 27, it is determined whether the executable function narrowing unit 23 has processed all the rows corresponding to the current state of the execution option table 26. In this example, since “status 2” and “input completion” remain in the execution option table 26, the process proceeds to step S22.

  After shifting to step S22, the processing of steps S22 to S27 is performed in the same manner as described above for “state 2” and “input completed” in the execution option table 26. If processing is performed for all the rows in the execution option table 26 in step S27, the executable function narrowing-down processing is terminated, and the process proceeds to step S33 in FIG.

  In step S33, the executable function narrowing unit 23 determines whether there is a line corresponding to the current state in the execution inhibition function table 29. If there is a line corresponding to the current state, the process proceeds to step S34. The process proceeds to S6. In this example, as shown in E of FIG. 12, the current execution inhibition function table 29 includes a line having “state 2” and “input completed” corresponding to the current state 2 and “state 2”. "There is a line having" product selection ", the process proceeds to step S34.

  In step S <b> 34, the executable function narrowing unit 23 selects one row corresponding to the current state from the execution option table 26. In this example, as shown in F of FIG. 12, “state 2” and “input completed” corresponding to the current state 2 are selected from the current execution option table 26.

  In step S35, it is determined whether or not the executable function narrowing unit 23 has the line option selected in step S34 and the line corresponding to the current state in the execution suppression function table 29. If there is, the process proceeds to step S36. If not, the process proceeds to step S37. In this example, as shown in F of FIG. 12, the current execution option table 26 has “state 2” and “input completion” corresponding to the current state 2 in the current execution suppression function table 29. Therefore, the process proceeds to step S36.

  In step S36, the executable function narrowing unit 23 deletes the corresponding row of the execution suppression function table 29. In this example, the line having “status 2” and “input completed” is deleted from the execution suppression function table 29 shown in E of FIG. As a result, the execution suppression function table 29 is updated as shown in FIG.

  In step S37, the row of the execution option table 26 selected by the executable function narrowing unit 23 is deleted. In other words, since it is not suppressed, it can be determined that it has already been executed from this state, and therefore, the row having “state 2” and “input completed” is deleted from the execution option table 26.

  In step S38, it is determined whether the executable function narrowing unit 23 has processed all the rows in the execution option table 26. If the processing is completed for all the rows, the process proceeds to step S6 in FIG. If the line remains, the process proceeds to step S34.

By executing the executable function narrowing-down process as described above, it is possible to prevent the same function from being called more than a preset number in the execution sequence of the function being checked. In addition, by executing executable function narrowing processing and execution suppression re-evaluation, it is possible to eliminate differences in search results due to differences in the function selection order by re-evaluating whether the suppressed function should be executed when the completed state is reached. The search range of model checking can be suppressed without excessively suppressing the execution of functions.
Therefore, program model checking for a large-scale program can be performed in a realistic time.

(Example 2)
In the second embodiment, when the executable function narrowing process is performed, the upper limit value of the number of executions is set for each function. For each function, the execution number upper limit value is recorded in advance in the recording execution number upper limit table, and it is determined for each function in advance whether execution of an executable function in the current state is to be suppressed based on the execution number upper limit value.

  FIG. 14 is a diagram illustrating the configuration of the program model checking apparatus 40 according to the second embodiment. In the second embodiment, the recording unit 24 of the program model checking device 40 has the execution number upper limit table 41, and the executable function narrowing unit 23 acquires the execution number upper limit value, so that the number of executions for each function is optimized. Set as follows.

  The execution number upper limit table 41 has a “function” that records a function name corresponding to a function executed in the program model check, and an “execution number upper limit” that sets an upper limit value for the number of executions for each function. Note that the user inputs the upper limit value in the “execution count upper limit”.

FIG. 15A is a flowchart showing the operation of the second embodiment. In steps S21 to S23, processing is performed in the same manner as in the first embodiment.
In step S41, the executable function narrowing unit 23 acquires the upper limit of the function selected in step S22 from the execution frequency upper limit table 41. For example, as shown in FIG. 15B, in the execution count upper limit table 41, “start” “input completion”... “End” as “function”, “start” “input completion” as “execution count upper limit”. It is assumed that “1”, “3”... “1” corresponding to “End” is recorded. If the number of executions of “input completion” has been acquired in step S 23, the executable function narrowing unit 23 acquires the execution number upper limit value corresponding to “input completion” in the execution number upper limit table 41.

  In step S24, the execution count acquired in step S41 is compared with the execution count upper limit value to determine whether the execution count is equal to or greater than the execution count upper limit value. If the number of executions is greater than or equal to the upper limit of execution times, the process proceeds to step S25, and if smaller than the upper limit of execution times, the process proceeds to step S27. Note that “unlimited” shown in FIG. 15B means that there is no upper limit value, and the process always moves to step S25, and is executed any number of times when a purchase function is designated.

After step S25, processing is performed in the same manner as in the first embodiment.
As described above, the function execution inhibition can be controlled by setting the upper limit number of executions for each function, so that the operation of the target function can be examined in detail.

(Example 3)
In the third embodiment, after the program model check is completed, when there are functions inhibited in m or more places in the execution inhibition function table 29, the execution number upper limit value of the corresponding function in the execution number upper limit table 41 is increased. The program model check is executed again. Note that m is an integer of 1 or more.

  FIG. 16 is a diagram illustrating a configuration of the program model checking apparatus 50 according to the third embodiment. The program model checking apparatus 50 according to the third embodiment further includes a model checking re-execution unit 51 that controls the execution number upper limit table 41 of the recording unit 24 and instructs the execution of the program model checking again in addition to the functions of the second embodiment. .

  The model checking re-execution unit 51 sets the execution number upper limit value of the corresponding function in the execution number upper limit table 41 to a preset value when there are functions inhibited in m or more states in the execution inhibition function table 29. Update. The model checking re-execution unit 51 notifies the program execution unit 22 of an instruction to execute the program model checking again using the updated execution count upper limit table 41.

FIG. 17 is a flowchart showing the operation of the third embodiment (model check re-execution process).
In step S51, the model checking re-execution unit 51 detects that the first program model checking has been completed.

  In step S52, the model checking re-execution unit 51 performs aggregation for each function that is inhibited based on the “suppression function” in the execution inhibition function table 29, and inhibits the result of aggregation in a state of m locations or more from a preset value. Detect the function that is being used.

In step S53, the model checking re-execution unit 51 changes the execution frequency upper limit value of the corresponding function in the execution frequency upper limit table 41.
Operations in steps S52 and S53 will be described with reference to FIGS.

  For example, when the first program model check is performed, the state transition as shown in FIG. 18A is performed, and the recorded content of the execution suppression function table 29 at the time when the first program model check is completed is shown in FIG. Suppose that it comes to be shown by B. Further, it is assumed that the execution number upper limit table 41 when the result of the execution suppression function table 29 of B of FIG. 18 is obtained has the setting shown in C of FIG. Note that “a”, “b”, and “c” shown in A, B, and C of FIG. 18 indicate functions.

  In B of FIG. 18, the model check re-execution unit 51 has the function a suppressed in “state 2” and “state 5” based on the a function recorded in the “suppression function” of the execution suppression function table 29. Is detected. The model checking re-execution unit 51 records “2” in association with the a function because the a function is suppressed in two states.

Next, the model checking re-execution unit 51 adds “1”, which is a value to be added to a preset execution count upper limit value, and “2”, by adding “1” to the execution count upper limit value corresponding to the a function. Is calculated. Then, as shown in FIG. 19C, the execution number upper limit value corresponding to the a function of the execution number upper limit table 41 is changed from “1” to “2”.
In this example, the value added to the upper limit of the number of executions is set to “1”, but the value is not limited and may be set by the user.

  In step S <b> 53, the model checking re-execution unit 51 detects that the change of the execution number upper limit value in the execution number upper limit table 41 has been completed, and notifies an instruction to execute the second program model checking.

The program model checking device 50 performs program model checking. As a result, as shown in FIG. 19A, the state 2 and the state 5 are shifted to the state 3, the state 3 is shifted to the state 4 (execution of the d function), and the state 4 is terminated (the e function is executed). Program model checking can be performed on new state transitions.
In step S54, the program model checking apparatus 50 completes the second program model checking.

  As described above, the upper limit of the number of executions in the execution number upper limit table 41 is performed based on the total result for each inhibition function in the execution inhibition function table 29, so that the first time (A and B in FIG. 18) and the second time (FIG. As shown in 19 A and B), it is possible to avoid the phenomenon that the function to be inspected is not executed due to the setting of the upper limit of the number of executions. Therefore, it is possible to safely limit the number of executions. In addition, the execution up to the limited number of executions is guaranteed in all execution series.

(Configuration when this embodiment is realized as a computer program)
FIG. 20 is a diagram illustrating an example of a hardware configuration of a computer that can implement the apparatus according to the embodiment.
The computer hardware 90 includes a CPU 91, a recording unit 92 (24) (ROM, RAM, hard disk drive, etc.), a recording medium reader 93, an input / output interface 94 (input / output I / F), and a communication interface 95 (communication I / F). F). Further, each of the components is connected by a bus 96.

  The CPU 91 stores a program execution process for executing the above-described program model check stored in the recording unit 92, a program control process, an executable function narrowing process, an execution suppression re-evaluation process, and a model check re-execution process (FIG. 4). , 8, 10, 12, 15, 17).

The recording unit 92 records programs and data executed by the CPU 91. It is also used as a work area.
The recording medium reading device 93 controls reading / writing of data with respect to the recording medium 93 a according to the control of the CPU 91. And the data written by control of the recording medium 93a and the recording medium reader 93 are memorize | stored, or the data memorize | stored in the recording medium 93a are read. The detachable recording medium 93a includes a magnetic recording device, an optical disk, a magneto-optical recording medium, a semiconductor memory, and the like as a computer-readable recording medium. The magnetic recording device includes a hard disk device (HDD). Examples of the optical disc include a DVD (Digital Versatile Disc), a DVD-RAM (Random Access Memory), a CD-ROM (Compact Disc Read Only Memory), and a CD-R (Recordable) / RW (ReWritable). Magneto-optical recording media include MO (Magneto-Optical disk).

  An input / output device 94 a (mouse, keyboard, display, etc.) is connected to the input / output interface 94, receives information input by the user, and transmits it to the CPU 91 via the bus 96. Further, operation information and the like are displayed on the screen of the display according to a command from the CPU 91.

  The communication interface 95 is an interface for LAN connection, Internet connection, or wireless connection with another computer as necessary. It is also connected to other devices and controls data input / output from external devices.

  By using one or more computers having such a hardware configuration, the various processing functions described above (the processing described in the embodiments (such as flowcharts)) are realized. In that case, a program describing the processing contents of the functions that the system should have is provided. By executing the program on a computer, the above processing functions are realized on the computer. The program describing the processing contents can be recorded in a computer-readable recording medium 93a.

  When distributing the program, for example, a portable recording medium such as a DVD or a CD-ROM in which the program is recorded is sold. It is also possible to store the program in a storage device of a server computer and transfer the program from the server computer to another computer via a network.

  The computer that executes the program stores, for example, the program recorded on the portable recording medium or the program transferred from the server computer in its own storage device. Then, the computer reads the program from its own storage device and executes processing according to the program. The computer can also read the program directly from the portable recording medium and execute processing according to the program. Further, each time the program is transferred from the server computer, the computer can sequentially execute processing according to the received program.

  The present invention is not limited to the above-described embodiment, and various improvements and modifications can be made without departing from the gist of the present invention.

1 driver,
2 Program to be inspected,
3 Database stub,
4 Network stub,
5 Program model checking device,
6 Input data,
7 properties
21 Program control unit,
22 program execution unit,
23 Executable function narrowing down part,
24 recording section,
25 State transition graph management table,
26 execution option table,
27 execution sequence table,
28 Execution count table,
29 Execution suppression function table,
40 Program model checking device,
41 Execution count upper limit table,
50 program model checking device,
51 Model inspection re-execution unit,
90 hardware,
91 CPU,
92 recording section,
93 recording medium reader,
93a recording medium,
94 I / O interface,
94a I / O device,
95 communication interface,
96 buses,

Claims (3)

A program model in which a program model checking device executes a function that can be executed from each state in a test target program having a plurality of function execution sequences and whose execution count within the function execution sequence is less than the upper limit of execution counts. An inspection method,
The program model checking device is
When the number of executions of a function that can be executed from the current state is equal to or greater than the upper limit value of the number of executions, the execution of the function is suppressed and the inspection of the function execution sequence is terminated, and the function is brought into the current state. A step of recording in the execution suppression function table in which the functions to suppress execution in association are defined;
In another function execution sequence, when a transition to the current state has already been made, whether or not there is a combination of the current state and a function executable from the current state in the execution suppression function table A determination step for determining;
Executing the function only when there is the combination in the determining step;
A program model checking method comprising:   The step of increasing the upper limit value of the number of executions of the function is further executed when a function associated with a predetermined number or more states is detected in the execution suppression function table. 2. The program model checking method according to 1. A program model checking program that executes a function that can be executed from each state in a test target program having a plurality of function execution series, and that has an execution count within the function execution series that is less than the upper limit of execution counts.
On the computer,
When the number of executions of a function that can be executed from the current state is equal to or greater than the upper limit value of the number of executions, the execution of the function is suppressed and the inspection of the function execution sequence is terminated, and the function is brought into the current state. Processing to record in the execution suppression function table that defines the functions to suppress execution in association with each other;
In another function execution sequence, when a transition to the current state has already been made, whether or not there is a combination of the current state and a function executable from the current state in the execution suppression function table A determination process for determining;
A process of executing the function only when there is the combination in the determination process;
A program model checking program characterized in that

Images