{\rtf\ansi\deff0{\fonttbl{\f0 Times New Roman;}{\f1 Arial;}{\f2 Courier;}{\f3 Segoe UI;}{\f4 Times;}{\f5 Helvetica;}{\f6 \u23435?\u20307?;}{\f7 Symbol;}}{\colortbl\red0\green0\blue0;\red255\green255\blue255;\red128\green128\blue128;\red114\green113\blue113;\red24\green24\blue24;\red202\green202\blue203;\red231\green237\blue249;\red64\green64\blue63;\red66\green66\blue66;\red66\green67\blue66;\red63\green63\blue63;\red60\green59\blue59;\red62\green62\blue62;\red61\green61\blue61;\red65\green65\blue65;\red66\green66\blue67;\red67\green67\blue67;\red68\green68\blue68;\red65\green63\blue65;\red208\green208\blue208;\red230\green236\blue248;\red215\green219\blue216;\red203\green219\blue248;\red227\green236\blue251;\red79\green79\blue74;\red75\green75\blue75;\red86\green86\blue86;\red85\green85\blue85;\red87\green87\blue86;\red82\green82\blue82;\red80\green80\blue74;\red87\green88\blue86;\red89\green90\blue89;\red80\green79\blue79;\red88\green89\blue88;\red90\green90\blue89;\red93\green93\blue93;\red94\green94\blue93;\red67\green65\blue65;\red51\green53\blue52;\red92\green92\blue92;\red49\green49\blue48;\red58\green58\blue54;\red229\green236\blue248;\red73\green73\blue73;\red69\green69\blue69;\red70\green70\blue70;\red70\green70\blue69;\red67\green67\blue66;\red71\green70\blue70;\red71\green72\blue72;\red76\green75\blue75;\red201\green200\blue201;\red203\green220\blue248;\red233\green238\blue249;\red243\green218\blue215;\red46\green46\blue46;\red46\green47\blue46;\red53\green53\blue50;\red54\green53\blue50;}\paperw12240\paperh15840\margl0\margr0\margt0\margb0\sectd\sbknone\sected\cols1\colno1\colw12240\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-301\par\pard\plain\li2649\sl-181\f0\fs20\cf0\b0\i0\ul0\strike0 2014\f0\fs20\cf0\b0\i0\ul0\strike0 IEEE\f0\fs20\cf0\b0\i0\ul0\strike0 International\f0\fs20\cf0\b0\i0\ul0\strike0 Conference\f0\fs20\cf0\b0\i0\ul0\strike0 on\f0\fs20\cf0\b0\i0\ul0\strike0 Software\f0\fs20\cf0\b0\i0\ul0\strike0 Testing,\f0\fs20\cf0\b0\i0\ul0\strike0 Verification,\f0\fs20\cf0\b0\i0\ul0\strike0 and\f0\fs20\cf0\b0\i0\ul0\strike0 Validation\par\pard\plain\sl-200\par\pard\plain\sl-328\par\pard\plain\li1306\sl-423\f3\fs44\cf0\b0\i0\ul0\strike0 An\f3\fs44\cf0\b0\i0\ul0\strike0 Empirical\f3\fs44\cf0\b0\i0\ul0\strike0 Analysis\f3\fs44\cf0\b0\i0\ul0\strike0 of\f3\fs44\cf0\b0\i0\ul0\strike0 Test\f3\fs44\cf0\b0\i0\ul0\strike0 Oracle\f3\fs44\cf0\b0\i0\ul0\strike0 Strategies\f3\fs44\cf0\b0\i0\ul0\strike0 for\par\pard\plain\li4198\sl-524\f3\fs44\cf0\b0\i0\ul0\strike0 Model-based\f3\fs44\cf0\b0\i0\ul0\strike0 Testing\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-323\par\pard\plain\li5152\sl-194\f3\fs20\cf0\b0\i0\ul0\strike0 Nan\f3\fs20\cf0\b0\i0\ul0\strike0 Li\f3\fs20\cf0\b0\i0\ul0\strike0 and\f3\fs20\cf0\b0\i0\ul0\strike0 Jeff\f3\fs20\cf0\b0\i0\ul0\strike0 Offutt\par\pard\plain\li5163\sl-250\f3\fs20\cf0\b0\i0\ul0\strike0 Software\f3\fs20\cf0\b0\i0\ul0\strike0 Engineering\par\pard\plain\li4988\sl-250\f3\fs20\cf0\b0\i0\ul0\strike0 George\f3\fs20\cf0\b0\i0\ul0\strike0 Mason\f3\fs20\cf0\b0\i0\ul0\strike0 University\par\pard\plain\li5105\sl-274\f3\fs20\cf0\b0\i\ul0\strike0 \{\f3\fs20\cf0\b0\i0\ul0\strike0 nli1,offutt\f3\fs20\cf0\b0\i\ul0\strike0 \}\f3\fs20\cf0\b0\i0\ul0\strike0 @gmu.edu\par\sect\sected\sbknone\cols3\colno1\colw5990\colsr10\colno2\colw250\colsr10\colno3\colw5980\pard\plain\li1451\sl-392\f3\fs16\cf0\b0\i\ul0\strike0 Abstract\f3\fs16\cf0\b0\i0\ul0\strike0 \u8212?Model-based\f3\fs16\cf0\b0\i0\ul0\strike0 testing\f3\fs16\cf0\b0\i0\ul0\strike0 is\f3\fs16\cf0\b0\i0\ul0\strike0 a\f3\fs16\cf0\b0\i0\ul0\strike0 technique\f3\fs16\cf0\b0\i0\ul0\strike0 to\f3\fs16\cf0\b0\i0\ul0\strike0 design\f3\fs16\cf0\b0\i0\ul0\strike0 ab-\par\pard\plain\li1199\sl-167\f3\fs16\cf0\b0\i0\ul0\strike0 stract\f3\fs16\cf0\b0\i0\ul0\strike0 tests\f3\fs16\cf0\b0\i0\ul0\strike0 from\f3\fs16\cf0\b0\i0\ul0\strike0 models\f3\fs16\cf0\b0\i0\ul0\strike0 that\f3\fs16\cf0\b0\i0\ul0\strike0 partially\f3\fs16\cf0\b0\i0\ul0\strike0 describe\f3\fs16\cf0\b0\i0\ul0\strike0 the\f3\fs16\cf0\b0\i0\ul0\strike0 system\u8217?s\par\pard\plain\li1199\sl-187\f3\fs16\charscalex96\cf0\b0\i0\ul0\strike0 behavior.\f3\fs16\charscalex96\cf0\b0\i0\ul0\strike0 Abstract\f3\fs16\charscalex96\cf0\b0\i0\ul0\strike0 tests\f3\fs16\charscalex96\cf0\b0\i0\ul0\strike0 are\f3\fs16\charscalex96\cf0\b0\i0\ul0\strike0 transformed\f3\fs16\charscalex96\cf0\b0\i0\ul0\strike0 into\f3\fs16\charscalex96\cf0\b0\i0\ul0\strike0 concrete\f3\fs16\charscalex96\cf0\b0\i0\ul0\strike0 tests,\f3\fs16\charscalex96\cf0\b0\i0\ul0\strike0 which\par\pard\plain\li1199\sl-187\f3\fs16\cf0\b0\i0\ul0\strike0 include\f3\fs16\cf0\b0\i0\ul0\strike0 test\f3\fs16\cf0\b0\i0\ul0\strike0 input\f3\fs16\cf0\b0\i0\ul0\strike0 values,\f3\fs16\cf0\b0\i0\ul0\strike0 expected\f3\fs16\cf0\b0\i0\ul0\strike0 outputs,\f3\fs16\cf0\b0\i0\ul0\strike0 and\f3\fs16\cf0\b0\i0\ul0\strike0 test\f3\fs16\cf0\b0\i0\ul0\strike0 oracles.\par\pard\plain\li1199\sl-187\f3\fs16\cf0\b0\i0\ul0\strike0 Although\f3\fs16\cf0\b0\i0\ul0\strike0 test\f3\fs16\cf0\b0\i0\ul0\strike0 oracles\f3\fs16\cf0\b0\i0\ul0\strike0 require\f3\fs16\cf0\b0\i0\ul0\strike0 signi\u64257?cant\f3\fs16\cf0\b0\i0\ul0\strike0 investment\f3\fs16\cf0\b0\i0\ul0\strike0 and\f3\fs16\cf0\b0\i0\ul0\strike0 are\par\pard\plain\li1199\sl-187\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 crucial\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 to\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 the\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 success\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 of\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 the\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 testing,\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 we\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 have\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 few\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 empirical\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 results\par\pard\plain\li1199\sl-187\f3\fs16\cf0\b0\i0\ul0\strike0 about\f3\fs16\cf0\b0\i0\ul0\strike0 how\f3\fs16\cf0\b0\i0\ul0\strike0 to\f3\fs16\cf0\b0\i0\ul0\strike0 write\f3\fs16\cf0\b0\i0\ul0\strike0 them.\f3\fs16\cf0\b0\i0\ul0\strike0 With\f3\fs16\cf0\b0\i0\ul0\strike0 the\f3\fs16\cf0\b0\i0\ul0\strike0 same\f3\fs16\cf0\b0\i0\ul0\strike0 test\f3\fs16\cf0\b0\i0\ul0\strike0 inputs,\f3\fs16\cf0\b0\i0\ul0\strike0 test\f3\fs16\cf0\b0\i0\ul0\strike0 oracles\par\pard\plain\li1199\sl-187\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 that\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 check\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 more\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 of\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 the\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 program\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 state\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 have\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 the\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 potential\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 to\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 reveal\par\pard\plain\li1199\sl-187\f3\fs16\cf0\b0\i0\ul0\strike0 more\f3\fs16\cf0\b0\i0\ul0\strike0 failures,\f3\fs16\cf0\b0\i0\ul0\strike0 but\f3\fs16\cf0\b0\i0\ul0\strike0 may\f3\fs16\cf0\b0\i0\ul0\strike0 also\f3\fs16\cf0\b0\i0\ul0\strike0 cost\f3\fs16\cf0\b0\i0\ul0\strike0 more\f3\fs16\cf0\b0\i0\ul0\strike0 to\f3\fs16\cf0\b0\i0\ul0\strike0 design\f3\fs16\cf0\b0\i0\ul0\strike0 and\f3\fs16\cf0\b0\i0\ul0\strike0 create.\par\pard\plain\li1470\sl-302\f3\fs16\cf0\b0\i0\ul0\strike0 This\f3\fs16\cf0\b0\i0\ul0\strike0 research\f3\fs16\cf0\b0\i0\ul0\strike0 de\u64257?nes\f3\fs16\cf0\b0\i0\ul0\strike0 six\f3\fs16\cf0\b0\i0\ul0\strike0 new\f3\fs16\cf0\b0\i0\ul0\strike0 test\f3\fs16\cf0\b0\i0\ul0\strike0 oracle\f3\fs16\cf0\b0\i0\ul0\strike0 strategies\f3\fs16\cf0\b0\i0\ul0\strike0 that\f3\fs16\cf0\b0\i0\ul0\strike0 check\par\pard\plain\li1199\sl-187\f3\fs16\cf0\b0\i0\ul0\strike0 different\f3\fs16\cf0\b0\i0\ul0\strike0 parts\f3\fs16\cf0\b0\i0\ul0\strike0 of\f3\fs16\cf0\b0\i0\ul0\strike0 the\f3\fs16\cf0\b0\i0\ul0\strike0 program\f3\fs16\cf0\b0\i0\ul0\strike0 state\f3\fs16\cf0\b0\i0\ul0\strike0 different\f3\fs16\cf0\b0\i0\ul0\strike0 numbers\f3\fs16\cf0\b0\i0\ul0\strike0 of\f3\fs16\cf0\b0\i0\ul0\strike0 times.\par\pard\plain\li1199\sl-187\f3\fs16\cf0\b0\i0\ul0\strike0 The\f3\fs16\cf0\b0\i0\ul0\strike0 experiment\f3\fs16\cf0\b0\i0\ul0\strike0 compared\f3\fs16\cf0\b0\i0\ul0\strike0 the\f3\fs16\cf0\b0\i0\ul0\strike0 six\f3\fs16\cf0\b0\i0\ul0\strike0 test\f3\fs16\cf0\b0\i0\ul0\strike0 oracle\f3\fs16\cf0\b0\i0\ul0\strike0 strategies\f3\fs16\cf0\b0\i0\ul0\strike0 with\f3\fs16\cf0\b0\i0\ul0\strike0 two\par\pard\plain\li1199\sl-187\f3\fs16\cf0\b0\i0\ul0\strike0 baseline\f3\fs16\cf0\b0\i0\ul0\strike0 test\f3\fs16\cf0\b0\i0\ul0\strike0 oracle\f3\fs16\cf0\b0\i0\ul0\strike0 strategies.\f3\fs16\cf0\b0\i0\ul0\strike0 The\f3\fs16\cf0\b0\i0\ul0\strike0 null\f3\fs16\cf0\b0\i0\ul0\strike0 test\f3\fs16\cf0\b0\i0\ul0\strike0 oracle\f3\fs16\cf0\b0\i0\ul0\strike0 strategy\f3\fs16\cf0\b0\i0\ul0\strike0 just\par\pard\plain\li1199\sl-187\f3\fs16\cf0\b0\i0\ul0\strike0 checks\f3\fs16\cf0\b0\i0\ul0\strike0 whether\f3\fs16\cf0\b0\i0\ul0\strike0 the\f3\fs16\cf0\b0\i0\ul0\strike0 program\f3\fs16\cf0\b0\i0\ul0\strike0 crashes\f3\fs16\cf0\b0\i0\ul0\strike0 and\f3\fs16\cf0\b0\i0\ul0\strike0 the\f3\fs16\cf0\b0\i0\ul0\strike0 state\f3\fs16\cf0\b0\i0\ul0\strike0 invariant\f3\fs16\cf0\b0\i0\ul0\strike0 test\par\pard\plain\li1199\sl-187\f3\fs16\cf0\b0\i0\ul0\strike0 oracle\f3\fs16\cf0\b0\i0\ul0\strike0 strategy\f3\fs16\cf0\b0\i0\ul0\strike0 checks\f3\fs16\cf0\b0\i0\ul0\strike0 the\f3\fs16\cf0\b0\i0\ul0\strike0 state\f3\fs16\cf0\b0\i0\ul0\strike0 invariants\f3\fs16\cf0\b0\i0\ul0\strike0 in\f3\fs16\cf0\b0\i0\ul0\strike0 the\f3\fs16\cf0\b0\i0\ul0\strike0 model.\par\pard\plain\li1470\sl-302\f3\fs16\cf0\b0\i0\ul0\strike0 The\f3\fs16\cf0\b0\i0\ul0\strike0 paper\f3\fs16\cf0\b0\i0\ul0\strike0 presents\f3\fs16\cf0\b0\i0\ul0\strike0 \u64257?ve\f3\fs16\cf0\b0\i0\ul0\strike0 main\f3\fs16\cf0\b0\i0\ul0\strike0 \u64257?ndings.\f3\fs16\cf0\b0\i0\ul0\strike0 (1)\f3\fs16\cf0\b0\i0\ul0\strike0 Testers\f3\fs16\cf0\b0\i0\ul0\strike0 should\par\pard\plain\li1199\sl-187\f3\fs16\cf0\b0\i0\ul0\strike0 check\f3\fs16\cf0\b0\i0\ul0\strike0 more\f3\fs16\cf0\b0\i0\ul0\strike0 of\f3\fs16\cf0\b0\i0\ul0\strike0 the\f3\fs16\cf0\b0\i0\ul0\strike0 program\f3\fs16\cf0\b0\i0\ul0\strike0 state\f3\fs16\cf0\b0\i0\ul0\strike0 than\f3\fs16\cf0\b0\i0\ul0\strike0 just\f3\fs16\cf0\b0\i0\ul0\strike0 runtime\f3\fs16\cf0\b0\i0\ul0\strike0 exceptions.\par\pard\plain\li1199\sl-187\f3\fs16\cf0\b0\i0\ul0\strike0 (2)\f3\fs16\cf0\b0\i0\ul0\strike0 Test\f3\fs16\cf0\b0\i0\ul0\strike0 oracle\f3\fs16\cf0\b0\i0\ul0\strike0 strategies\f3\fs16\cf0\b0\i0\ul0\strike0 that\f3\fs16\cf0\b0\i0\ul0\strike0 check\f3\fs16\cf0\b0\i0\ul0\strike0 more\f3\fs16\cf0\b0\i0\ul0\strike0 program\f3\fs16\cf0\b0\i0\ul0\strike0 states\f3\fs16\cf0\b0\i0\ul0\strike0 do\par\pard\plain\li1199\sl-187\f3\fs16\cf0\b0\i0\ul0\strike0 not\f3\fs16\cf0\b0\i0\ul0\strike0 always\f3\fs16\cf0\b0\i0\ul0\strike0 reveal\f3\fs16\cf0\b0\i0\ul0\strike0 more\f3\fs16\cf0\b0\i0\ul0\strike0 failures\f3\fs16\cf0\b0\i0\ul0\strike0 than\f3\fs16\cf0\b0\i0\ul0\strike0 strategies\f3\fs16\cf0\b0\i0\ul0\strike0 that\f3\fs16\cf0\b0\i0\ul0\strike0 check\f3\fs16\cf0\b0\i0\ul0\strike0 fewer\par\pard\plain\li1199\sl-187\f3\fs16\cf0\b0\i0\ul0\strike0 states.\f3\fs16\cf0\b0\i0\ul0\strike0 (3)\f3\fs16\cf0\b0\i0\ul0\strike0 Test\f3\fs16\cf0\b0\i0\ul0\strike0 oracle\f3\fs16\cf0\b0\i0\ul0\strike0 strategies\f3\fs16\cf0\b0\i0\ul0\strike0 that\f3\fs16\cf0\b0\i0\ul0\strike0 check\f3\fs16\cf0\b0\i0\ul0\strike0 program\f3\fs16\cf0\b0\i0\ul0\strike0 states\f3\fs16\cf0\b0\i0\ul0\strike0 multi-\par\pard\plain\li1199\sl-187\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 ple\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 times\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 are\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 slightly\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 more\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 effective\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 than\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 strategies\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 that\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 check\f3\fs16\charscalex97\cf0\b0\i0\ul0\strike0 the\par\pard\plain\li1199\sl-187\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 same\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 states\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 just\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 once.\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 (4)\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 Edge-pair\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 coverage\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 did\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 not\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 detect\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 more\par\pard\plain\li1199\sl-187\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 failures\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 than\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 edge\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 coverage\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 with\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 the\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 same\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 test\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 oracle\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 strategy.\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 (5)\par\pard\plain\li1199\sl-187\f3\fs16\cf0\b0\i0\ul0\strike0 If\f3\fs16\cf0\b0\i0\ul0\strike0 state\f3\fs16\cf0\b0\i0\ul0\strike0 machine\f3\fs16\cf0\b0\i0\ul0\strike0 diagrams\f3\fs16\cf0\b0\i0\ul0\strike0 are\f3\fs16\cf0\b0\i0\ul0\strike0 used\f3\fs16\cf0\b0\i0\ul0\strike0 to\f3\fs16\cf0\b0\i0\ul0\strike0 generate\f3\fs16\cf0\b0\i0\ul0\strike0 tests,\f3\fs16\cf0\b0\i0\ul0\strike0 checking\par\pard\plain\li1199\sl-187\f3\fs16\cf0\b0\i0\ul0\strike0 state\f3\fs16\cf0\b0\i0\ul0\strike0 invariants\f3\fs16\cf0\b0\i0\ul0\strike0 is\f3\fs16\cf0\b0\i0\ul0\strike0 a\f3\fs16\cf0\b0\i0\ul0\strike0 reasonably\f3\fs16\cf0\b0\i0\ul0\strike0 effective\f3\fs16\cf0\b0\i0\ul0\strike0 low\f3\fs16\cf0\b0\i0\ul0\strike0 cost\f3\fs16\cf0\b0\i0\ul0\strike0 approach.\f3\fs16\cf0\b0\i0\ul0\strike0 In\par\pard\plain\li1199\sl-187\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 summary,\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 the\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 state\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 invariant\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 test\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 oracle\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 strategy\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 is\f3\fs16\charscalex98\cf0\b0\i0\ul0\strike0 recommended\par\pard\plain\li1199\sl-187\f3\fs16\charscalex89\cf0\b0\i0\ul0\strike0 for\f3\fs16\charscalex89\cf0\b0\i0\ul0\strike0 testers\f3\fs16\charscalex89\cf0\b0\i0\ul0\strike0 who\f3\fs16\charscalex89\cf0\b0\i0\ul0\strike0 do\f3\fs16\charscalex89\cf0\b0\i0\ul0\strike0 not\f3\fs16\charscalex89\cf0\b0\i0\ul0\strike0 have\f3\fs16\charscalex89\cf0\b0\i0\ul0\strike0 enough\f3\fs16\charscalex89\cf0\b0\i0\ul0\strike0 time.\f3\fs16\charscalex89\cf0\b0\i0\ul0\strike0 Otherwise,\f3\fs16\charscalex89\cf0\b0\i0\ul0\strike0 testers\f3\fs16\charscalex89\cf0\b0\i0\ul0\strike0 should\par\pard\plain\li1199\sl-187\f3\fs16\cf0\b0\i0\ul0\strike0 check\f3\fs16\cf0\b0\i0\ul0\strike0 state\f3\fs16\cf0\b0\i0\ul0\strike0 invariants,\f3\fs16\cf0\b0\i0\ul0\strike0 outputs,\f3\fs16\cf0\b0\i0\ul0\strike0 and\f3\fs16\cf0\b0\i0\ul0\strike0 parameter\f3\fs16\cf0\b0\i0\ul0\strike0 objects.\par\pard\plain\sl-286\par\pard\plain\li2792\sl-176\f3\fs18\cf0\b0\i0\ul0\strike0 I.\f3\fs18\cf0\b0\i0\ul0\strike0 I\f3\fs14\cf0\b0\i0\ul0\strike0 NTRODUCTION\par\pard\plain\li1470\sl-321\f3\fs18\cf0\b0\i0\ul0\strike0 A\f3\fs18\cf0\b0\i0\ul0\strike0 primary\f3\fs18\cf0\b0\i0\ul0\strike0 goal\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 software\f3\fs18\cf0\b0\i0\ul0\strike0 testing\f3\fs18\cf0\b0\i0\ul0\strike0 is\f3\fs18\cf0\b0\i0\ul0\strike0 to\f3\fs18\cf0\b0\i0\ul0\strike0 \u64257?nd\f3\fs18\cf0\b0\i0\ul0\strike0 faults\f3\fs18\cf0\b0\i0\ul0\strike0 by\par\pard\plain\li1199\sl-206\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 running\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 tests.\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 Whether\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 tests\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 can\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 \u64257?nd\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 faults\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 depends\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 on\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 two\par\pard\plain\li1199\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 key\f3\fs18\cf0\b0\i0\ul0\strike0 factors:\f3\fs18\cf0\b0\i\ul0\strike0 test\f3\fs18\cf0\b0\i\ul0\strike0 inputs\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i\ul0\strike0 test\f3\fs18\cf0\b0\i\ul0\strike0 oracles\f3\fs18\cf0\b0\i0\ul0\strike0 .\f3\fs18\cf0\b0\i0\ul0\strike0 In\f3\fs18\cf0\b0\i0\ul0\strike0 our\f3\fs18\cf0\b0\i0\ul0\strike0 context,\f3\fs18\cf0\b0\i0\ul0\strike0 test\par\pard\plain\li1199\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 inputs\f3\fs18\cf0\b0\i0\ul0\strike0 consist\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 method\f3\fs18\cf0\b0\i0\ul0\strike0 calls\f3\fs18\cf0\b0\i0\ul0\strike0 to\f3\fs18\cf0\b0\i0\ul0\strike0 a\f3\fs18\cf0\b0\i0\ul0\strike0 system\f3\fs18\cf0\b0\i0\ul0\strike0 under\f3\fs18\cf0\b0\i0\ul0\strike0 test\f3\fs18\cf0\b0\i0\ul0\strike0 (SUT)\par\pard\plain\li1199\sl-206\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 and\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 necessary\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 test\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 values.\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 A\f3\fs18\charscalex89\cf0\b0\i\ul0\strike0 test\f3\fs18\charscalex89\cf0\b0\i\ul0\strike0 oracle\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 determines\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 whether\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 a\par\pard\plain\li1199\sl-206\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 test\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 passes.\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 An\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 example\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 of\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 a\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 test\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 oracle\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 is\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 an\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 assertion\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 in\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 JUnit\par\pard\plain\li1199\sl-206\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 tests.\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 Exhaustively\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 enumerating\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 all\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 test\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 inputs\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 is\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 effective\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 at\par\pard\plain\li1199\sl-206\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 \u64257?nding\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 faults,\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 but\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 is\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 prohibitively\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 expensive.\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 As\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 a\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 compromise,\par\pard\plain\li1199\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 tests\f3\fs18\cf0\b0\i0\ul0\strike0 are\f3\fs18\cf0\b0\i0\ul0\strike0 usually\f3\fs18\cf0\b0\i0\ul0\strike0 created\f3\fs18\cf0\b0\i0\ul0\strike0 to\f3\fs18\cf0\b0\i0\ul0\strike0 satisfy\f3\fs18\cf0\b0\i0\ul0\strike0 a\f3\fs18\cf0\b0\i\ul0\strike0 coverage\f3\fs18\cf0\b0\i\ul0\strike0 criterion\f3\fs18\cf0\b0\i0\ul0\strike0 .\f3\fs18\cf0\b0\i0\ul0\strike0 A\par\pard\plain\li1199\sl-206\f3\fs18\cf0\b0\i\ul0\strike0 coverage\f3\fs18\cf0\b0\i\ul0\strike0 criterion\f3\fs18\cf0\b0\i0\ul0\strike0 is\f3\fs18\cf0\b0\i0\ul0\strike0 a\f3\fs18\cf0\b0\i0\ul0\strike0 rule\f3\fs18\cf0\b0\i0\ul0\strike0 or\f3\fs18\cf0\b0\i0\ul0\strike0 a\f3\fs18\cf0\b0\i0\ul0\strike0 set\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 rules\f3\fs18\cf0\b0\i0\ul0\strike0 that\f3\fs18\cf0\b0\i0\ul0\strike0 are\f3\fs18\cf0\b0\i0\ul0\strike0 applied\par\pard\plain\li1199\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 to\f3\fs18\cf0\b0\i0\ul0\strike0 software\f3\fs18\cf0\b0\i0\ul0\strike0 artifacts\f3\fs18\cf0\b0\i0\ul0\strike0 (source\f3\fs18\cf0\b0\i0\ul0\strike0 code,\f3\fs18\cf0\b0\i0\ul0\strike0 models,\f3\fs18\cf0\b0\i0\ul0\strike0 etc.)\f3\fs18\cf0\b0\i0\ul0\strike0 to\f3\fs18\cf0\b0\i0\ul0\strike0 create\f3\fs18\cf0\b0\i0\ul0\strike0 a\par\pard\plain\li1199\sl-206\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 set\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 of\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 test\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 requirements\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 that\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 have\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 to\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 be\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 covered\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 by\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 tests\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 [1].\par\pard\plain\li1199\sl-206\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 A\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 more\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 effective\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 test\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 coverage\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 criterion\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 often\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 results\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 in\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 more\par\pard\plain\li1199\sl-206\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 test\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 inputs\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 to\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 detect\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 more\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 faults\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 than\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 a\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 weaker\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 criterion.\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 When\par\pard\plain\li1199\sl-206\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 tests\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 are\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 executed,\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 a\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 fault\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 may\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 be\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 triggered\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 to\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 produce\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 an\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 error\par\pard\plain\li1199\sl-206\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 state,\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 which\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 then\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 propagates\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 to\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 be\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 revealed\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 as\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 a\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 failure\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 that\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 can\par\pard\plain\li1199\sl-206\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 be\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 observed\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 by\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 checking\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 program\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 states\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 (outputs\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 and\f3\fs18\charscalex89\cf0\b0\i0\ul0\strike0 internal\par\pard\plain\li1199\sl-206\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 state\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 variables).\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 Testers\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 are\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 likely\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 to\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 observe\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 more\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 failures\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 by\par\pard\plain\li1199\sl-206\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 checking\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 more\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 program\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 states.\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 As\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 suggested\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 by\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 Briand\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 et\f3\fs18\charscalex97\cf0\b0\i0\ul0\strike0 al.\par\pard\plain\sl-200\par\pard\plain\sl-218\par\pard\plain\li1000\sl-145\f0\fs16\cf0\b0\i0\ul0\strike0 978-0-7695-5185-2/14\f0\fs16\cf0\b0\i0\ul0\strike0 $31.00\f0\fs16\cf0\b0\i0\ul0\strike0 \u169?\f0\fs16\cf0\b0\i0\ul0\strike0 2014\f0\fs16\cf0\b0\i0\ul0\strike0 IEEE\par\pard\plain\li1000\sl-200\f0\fs16\cf0\b0\i0\ul0\strike0 DOI\f0\fs16\cf0\b0\i0\ul0\strike0 10.1109/ICST.2014.49\par\pard\column\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-375\par\pard\plain\li0\sl-145\f0\fs16\charscalex32\cf0\b0\i0\ul0\strike0 363\par\pard\plain\li0\sl-376\column\f3\fs18\cf0\b0\i0\ul0\strike0 [3],\f3\fs18\cf0\b0\i0\ul0\strike0 we\f3\fs18\cf0\b0\i0\ul0\strike0 de\u64257?ne\f3\fs18\cf0\b0\i0\ul0\strike0 a\f3\fs18\cf0\b0\i\ul0\strike0 test\f3\fs18\cf0\b0\i\ul0\strike0 oracle\f3\fs18\cf0\b0\i\ul0\strike0 strategy\f3\fs18\cf0\b0\i0\ul0\strike0 (abbreviated\f3\fs18\cf0\b0\i0\ul0\strike0 as\f3\fs18\cf0\b0\i0\ul0\strike0 OS)\f3\fs18\cf0\b0\i0\ul0\strike0 as\f3\fs18\cf0\b0\i0\ul0\strike0 a\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 rule\f3\fs18\cf0\b0\i0\ul0\strike0 or\f3\fs18\cf0\b0\i0\ul0\strike0 a\f3\fs18\cf0\b0\i0\ul0\strike0 set\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 rules\f3\fs18\cf0\b0\i0\ul0\strike0 to\f3\fs18\cf0\b0\i0\ul0\strike0 specify\f3\fs18\cf0\b0\i0\ul0\strike0 which\f3\fs18\cf0\b0\i0\ul0\strike0 program\f3\fs18\cf0\b0\i0\ul0\strike0 states\f3\fs18\cf0\b0\i0\ul0\strike0 to\f3\fs18\cf0\b0\i0\ul0\strike0 check.\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 The\f3\fs18\cf0\b0\i0\ul0\strike0 theory\f3\fs18\cf0\b0\i0\ul0\strike0 is\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 more\f3\fs18\cf0\b0\i0\ul0\strike0 program\f3\fs18\cf0\b0\i0\ul0\strike0 states\f3\fs18\cf0\b0\i0\ul0\strike0 are\f3\fs18\cf0\b0\i0\ul0\strike0 checked,\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 more\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 faults\f3\fs18\cf0\b0\i0\ul0\strike0 an\f3\fs18\cf0\b0\i0\ul0\strike0 OS\f3\fs18\cf0\b0\i0\ul0\strike0 is\f3\fs18\cf0\b0\i0\ul0\strike0 likely\f3\fs18\cf0\b0\i0\ul0\strike0 to\f3\fs18\cf0\b0\i0\ul0\strike0 reveal\f3\fs18\cf0\b0\i0\ul0\strike0 [3],\f3\fs18\cf0\b0\i0\ul0\strike0 [19],\f3\fs18\cf0\b0\i0\ul0\strike0 [22],\f3\fs18\cf0\b0\i0\ul0\strike0 [23].\par\pard\plain\li270\sl-374\f3\fs18\cf0\b0\i0\ul0\strike0 In\f3\fs18\cf0\b0\i0\ul0\strike0 model-based\f3\fs18\cf0\b0\i0\ul0\strike0 testing\f3\fs18\cf0\b0\i0\ul0\strike0 (MBT),\f3\fs18\cf0\b0\i0\ul0\strike0 a\f3\fs18\cf0\b0\i0\ul0\strike0 model\f3\fs18\cf0\b0\i0\ul0\strike0 (for\f3\fs18\cf0\b0\i0\ul0\strike0 example,\f3\fs18\cf0\b0\i0\ul0\strike0 a\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 UML\f3\fs18\cf0\b0\i0\ul0\strike0 state\f3\fs18\cf0\b0\i0\ul0\strike0 machine\f3\fs18\cf0\b0\i0\ul0\strike0 diagram)\f3\fs18\cf0\b0\i0\ul0\strike0 partially\f3\fs18\cf0\b0\i0\ul0\strike0 speci\u64257?es\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 behav-\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 iors\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 a\f3\fs18\cf0\b0\i0\ul0\strike0 system.\f3\fs18\cf0\b0\i0\ul0\strike0 Abstract\f3\fs18\cf0\b0\i0\ul0\strike0 tests\f3\fs18\cf0\b0\i0\ul0\strike0 are\f3\fs18\cf0\b0\i0\ul0\strike0 generated\f3\fs18\cf0\b0\i0\ul0\strike0 to\f3\fs18\cf0\b0\i0\ul0\strike0 cover\f3\fs18\cf0\b0\i0\ul0\strike0 test\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 requirements\f3\fs18\cf0\b0\i0\ul0\strike0 imposed\f3\fs18\cf0\b0\i0\ul0\strike0 by\f3\fs18\cf0\b0\i0\ul0\strike0 a\f3\fs18\cf0\b0\i0\ul0\strike0 coverage\f3\fs18\cf0\b0\i0\ul0\strike0 criterion.\f3\fs18\cf0\b0\i0\ul0\strike0 For\f3\fs18\cf0\b0\i0\ul0\strike0 instance,\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 edge\f3\fs18\cf0\b0\i0\ul0\strike0 coverage\f3\fs18\cf0\b0\i0\ul0\strike0 requires\f3\fs18\cf0\b0\i0\ul0\strike0 all\f3\fs18\cf0\b0\i0\ul0\strike0 transitions\f3\fs18\cf0\b0\i0\ul0\strike0 in\f3\fs18\cf0\b0\i0\ul0\strike0 a\f3\fs18\cf0\b0\i0\ul0\strike0 UML\f3\fs18\cf0\b0\i0\ul0\strike0 state\f3\fs18\cf0\b0\i0\ul0\strike0 machine\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 diagram\f3\fs18\cf0\b0\i0\ul0\strike0 to\f3\fs18\cf0\b0\i0\ul0\strike0 be\f3\fs18\cf0\b0\i0\ul0\strike0 covered.\f3\fs18\cf0\b0\i0\ul0\strike0 Thus,\f3\fs18\cf0\b0\i0\ul0\strike0 an\f3\fs18\cf0\b0\i0\ul0\strike0 abstract\f3\fs18\cf0\b0\i0\ul0\strike0 test\f3\fs18\cf0\b0\i0\ul0\strike0 may\f3\fs18\cf0\b0\i0\ul0\strike0 look\f3\fs18\cf0\b0\i0\ul0\strike0 like:\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 \u8220?transition\f3\fs18\cf0\b0\i0\ul0\strike0 1,\f3\fs18\cf0\b0\i0\ul0\strike0 state\f3\fs18\cf0\b0\i0\ul0\strike0 invariant\f3\fs18\cf0\b0\i0\ul0\strike0 1,\f3\fs18\cf0\b0\i0\ul0\strike0 ...,\f3\fs18\cf0\b0\i0\ul0\strike0 transition\f3\fs18\cf0\b0\i0\ul0\strike0 n,\f3\fs18\cf0\b0\i0\ul0\strike0 state\f3\fs18\cf0\b0\i0\ul0\strike0 invariant\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 n.\u8221?\f3\fs18\cf0\b0\i0\ul0\strike0 These\f3\fs18\cf0\b0\i0\ul0\strike0 abstract\f3\fs18\cf0\b0\i0\ul0\strike0 tests\f3\fs18\cf0\b0\i0\ul0\strike0 need\f3\fs18\cf0\b0\i0\ul0\strike0 to\f3\fs18\cf0\b0\i0\ul0\strike0 be\f3\fs18\cf0\b0\i0\ul0\strike0 converted\f3\fs18\cf0\b0\i0\ul0\strike0 into\f3\fs18\cf0\b0\i0\ul0\strike0 concrete\f3\fs18\cf0\b0\i0\ul0\strike0 tests.\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 Properties\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 models\f3\fs18\cf0\b0\i0\ul0\strike0 such\f3\fs18\cf0\b0\i0\ul0\strike0 as\f3\fs18\cf0\b0\i0\ul0\strike0 state\f3\fs18\cf0\b0\i0\ul0\strike0 invariants\f3\fs18\cf0\b0\i0\ul0\strike0 in\f3\fs18\cf0\b0\i0\ul0\strike0 a\f3\fs18\cf0\b0\i0\ul0\strike0 state\f3\fs18\cf0\b0\i0\ul0\strike0 machine\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 diagram\f3\fs18\cf0\b0\i0\ul0\strike0 can\f3\fs18\cf0\b0\i0\ul0\strike0 be\f3\fs18\cf0\b0\i0\ul0\strike0 used\f3\fs18\cf0\b0\i0\ul0\strike0 for\f3\fs18\cf0\b0\i0\ul0\strike0 OSes.\f3\fs18\cf0\b0\i0\ul0\strike0 If\f3\fs18\cf0\b0\i0\ul0\strike0 test\f3\fs18\cf0\b0\i0\ul0\strike0 oracle\f3\fs18\cf0\b0\i0\ul0\strike0 data,\f3\fs18\cf0\b0\i0\ul0\strike0 including\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 expected\f3\fs18\cf0\b0\i0\ul0\strike0 test\f3\fs18\cf0\b0\i0\ul0\strike0 values,\f3\fs18\cf0\b0\i0\ul0\strike0 is\f3\fs18\cf0\b0\i0\ul0\strike0 very\f3\fs18\cf0\b0\i0\ul0\strike0 well\f3\fs18\cf0\b0\i0\ul0\strike0 speci\u64257?ed\f3\fs18\cf0\b0\i0\ul0\strike0 by\f3\fs18\cf0\b0\i0\ul0\strike0 some\f3\fs18\cf0\b0\i0\ul0\strike0 speci\u64257?-\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 cation\f3\fs18\cf0\b0\i0\ul0\strike0 language\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i0\ul0\strike0 additional\f3\fs18\cf0\b0\i0\ul0\strike0 information\f3\fs18\cf0\b0\i0\ul0\strike0 used\f3\fs18\cf0\b0\i0\ul0\strike0 to\f3\fs18\cf0\b0\i0\ul0\strike0 transform\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 abstract\f3\fs18\cf0\b0\i0\ul0\strike0 test\f3\fs18\cf0\b0\i0\ul0\strike0 oracle\f3\fs18\cf0\b0\i0\ul0\strike0 data\f3\fs18\cf0\b0\i0\ul0\strike0 to\f3\fs18\cf0\b0\i0\ul0\strike0 executable\f3\fs18\cf0\b0\i0\ul0\strike0 code\f3\fs18\cf0\b0\i0\ul0\strike0 has\f3\fs18\cf0\b0\i0\ul0\strike0 been\f3\fs18\cf0\b0\i0\ul0\strike0 provided,\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 concrete\f3\fs18\cf0\b0\i0\ul0\strike0 test\f3\fs18\cf0\b0\i0\ul0\strike0 oracles\f3\fs18\cf0\b0\i0\ul0\strike0 can\f3\fs18\cf0\b0\i0\ul0\strike0 be\f3\fs18\cf0\b0\i0\ul0\strike0 generated\f3\fs18\cf0\b0\i0\ul0\strike0 automatically.\f3\fs18\cf0\b0\i0\ul0\strike0 Such\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 test\f3\fs18\cf0\b0\i0\ul0\strike0 oracles\f3\fs18\cf0\b0\i0\ul0\strike0 are\f3\fs18\cf0\b0\i0\ul0\strike0 called\f3\fs18\cf0\b0\i\ul0\strike0 speci\u64257?ed\f3\fs18\cf0\b0\i\ul0\strike0 test\f3\fs18\cf0\b0\i\ul0\strike0 oracles\f3\fs18\cf0\b0\i0\ul0\strike0 [8]\f3\fs18\cf0\b0\i0\ul0\strike0 because\f3\fs18\cf0\b0\i0\ul0\strike0 the\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 speci\u64257?cation\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 a\f3\fs18\cf0\b0\i0\ul0\strike0 system\f3\fs18\cf0\b0\i0\ul0\strike0 is\f3\fs18\cf0\b0\i0\ul0\strike0 used\f3\fs18\cf0\b0\i0\ul0\strike0 as\f3\fs18\cf0\b0\i0\ul0\strike0 a\f3\fs18\cf0\b0\i0\ul0\strike0 source\f3\fs18\cf0\b0\i0\ul0\strike0 to\f3\fs18\cf0\b0\i0\ul0\strike0 generate\f3\fs18\cf0\b0\i0\ul0\strike0 test\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 oracles,\f3\fs18\cf0\b0\i0\ul0\strike0 including\f3\fs18\cf0\b0\i0\ul0\strike0 expected\f3\fs18\cf0\b0\i0\ul0\strike0 values.\par\pard\plain\li270\sl-374\f3\fs18\cf0\b0\i0\ul0\strike0 As\f3\fs18\cf0\b0\i0\ul0\strike0 pointed\f3\fs18\cf0\b0\i0\ul0\strike0 out\f3\fs18\cf0\b0\i0\ul0\strike0 by\f3\fs18\cf0\b0\i0\ul0\strike0 Harman\f3\fs18\cf0\b0\i0\ul0\strike0 et\f3\fs18\cf0\b0\i0\ul0\strike0 al.\f3\fs18\cf0\b0\i0\ul0\strike0 [8],\f3\fs18\cf0\b0\i0\ul0\strike0 automated\f3\fs18\cf0\b0\i0\ul0\strike0 test\f3\fs18\cf0\b0\i0\ul0\strike0 oracles\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 are\f3\fs18\cf0\b0\i0\ul0\strike0 not\f3\fs18\cf0\b0\i0\ul0\strike0 available\f3\fs18\cf0\b0\i0\ul0\strike0 in\f3\fs18\cf0\b0\i0\ul0\strike0 many\f3\fs18\cf0\b0\i0\ul0\strike0 situations.\f3\fs18\cf0\b0\i0\ul0\strike0 For\f3\fs18\cf0\b0\i0\ul0\strike0 model-based\f3\fs18\cf0\b0\i0\ul0\strike0 testing,\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 transformation\f3\fs18\cf0\b0\i0\ul0\strike0 from\f3\fs18\cf0\b0\i0\ul0\strike0 abstract\f3\fs18\cf0\b0\i0\ul0\strike0 tests\f3\fs18\cf0\b0\i0\ul0\strike0 to\f3\fs18\cf0\b0\i0\ul0\strike0 concrete\f3\fs18\cf0\b0\i0\ul0\strike0 tests\f3\fs18\cf0\b0\i0\ul0\strike0 requires\f3\fs18\cf0\b0\i0\ul0\strike0 that\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 a\f3\fs18\cf0\b0\i0\ul0\strike0 model\f3\fs18\cf0\b0\i0\ul0\strike0 has\f3\fs18\cf0\b0\i0\ul0\strike0 to\f3\fs18\cf0\b0\i0\ul0\strike0 be\f3\fs18\cf0\b0\i0\ul0\strike0 very\f3\fs18\cf0\b0\i0\ul0\strike0 well\f3\fs18\cf0\b0\i0\ul0\strike0 speci\u64257?ed\f3\fs18\cf0\b0\i0\ul0\strike0 using\f3\fs18\cf0\b0\i0\ul0\strike0 additional\f3\fs18\cf0\b0\i0\ul0\strike0 informa-\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 tion.\f3\fs18\cf0\b0\i0\ul0\strike0 The\f3\fs18\cf0\b0\i0\ul0\strike0 information\f3\fs18\cf0\b0\i0\ul0\strike0 may\f3\fs18\cf0\b0\i0\ul0\strike0 include\f3\fs18\cf0\b0\i0\ul0\strike0 speci\u64257?cation\f3\fs18\cf0\b0\i0\ul0\strike0 languages\f3\fs18\cf0\b0\i0\ul0\strike0 such\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 as\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 object\f3\fs18\cf0\b0\i0\ul0\strike0 constraint\f3\fs18\cf0\b0\i0\ul0\strike0 language\f3\fs18\cf0\b0\i0\ul0\strike0 (OCL)\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i0\ul0\strike0 other\f3\fs18\cf0\b0\i0\ul0\strike0 additional\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 diagrams\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i0\ul0\strike0 mapping\f3\fs18\cf0\b0\i0\ul0\strike0 tables\f3\fs18\cf0\b0\i0\ul0\strike0 to\f3\fs18\cf0\b0\i0\ul0\strike0 map\f3\fs18\cf0\b0\i0\ul0\strike0 abstract\f3\fs18\cf0\b0\i0\ul0\strike0 information\f3\fs18\cf0\b0\i0\ul0\strike0 to\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 executable\f3\fs18\cf0\b0\i0\ul0\strike0 code.\f3\fs18\cf0\b0\i0\ul0\strike0 Such\f3\fs18\cf0\b0\i0\ul0\strike0 complicated\f3\fs18\cf0\b0\i0\ul0\strike0 requirements\f3\fs18\cf0\b0\i0\ul0\strike0 are\f3\fs18\cf0\b0\i0\ul0\strike0 usually\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 not\f3\fs18\cf0\b0\i0\ul0\strike0 easy\f3\fs18\cf0\b0\i0\ul0\strike0 to\f3\fs18\cf0\b0\i0\ul0\strike0 realize\f3\fs18\cf0\b0\i0\ul0\strike0 in\f3\fs18\cf0\b0\i0\ul0\strike0 practice.\f3\fs18\cf0\b0\i0\ul0\strike0 Thus,\f3\fs18\cf0\b0\i0\ul0\strike0 most\f3\fs18\cf0\b0\i0\ul0\strike0 practitioners\f3\fs18\cf0\b0\i0\ul0\strike0 cannot\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 use\f3\fs18\cf0\b0\i0\ul0\strike0 automated\f3\fs18\cf0\b0\i0\ul0\strike0 test\f3\fs18\cf0\b0\i0\ul0\strike0 input\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i0\ul0\strike0 oracle\f3\fs18\cf0\b0\i0\ul0\strike0 generation\f3\fs18\cf0\b0\i0\ul0\strike0 [12].\f3\fs18\cf0\b0\i0\ul0\strike0 This\f3\fs18\cf0\b0\i0\ul0\strike0 is\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 particularly\f3\fs18\cf0\b0\i0\ul0\strike0 true\f3\fs18\cf0\b0\i0\ul0\strike0 when\f3\fs18\cf0\b0\i0\ul0\strike0 agile\f3\fs18\cf0\b0\i0\ul0\strike0 processes\f3\fs18\cf0\b0\i0\ul0\strike0 are\f3\fs18\cf0\b0\i0\ul0\strike0 used.\f3\fs18\cf0\b0\i0\ul0\strike0 Therefore,\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 most\f3\fs18\cf0\b0\i0\ul0\strike0 testers\f3\fs18\cf0\b0\i0\ul0\strike0 have\f3\fs18\cf0\b0\i0\ul0\strike0 to\f3\fs18\cf0\b0\i0\ul0\strike0 provide\f3\fs18\cf0\b0\i0\ul0\strike0 expected\f3\fs18\cf0\b0\i0\ul0\strike0 values\f3\fs18\cf0\b0\i0\ul0\strike0 manually\f3\fs18\cf0\b0\i0\ul0\strike0 for\f3\fs18\cf0\b0\i0\ul0\strike0 test\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 oracles.\par\pard\plain\li270\sl-374\f3\fs18\cf0\b0\i0\ul0\strike0 A\f3\fs18\cf0\b0\i0\ul0\strike0 test\f3\fs18\cf0\b0\i0\ul0\strike0 oracle\f3\fs18\cf0\b0\i0\ul0\strike0 must\f3\fs18\cf0\b0\i0\ul0\strike0 address\f3\fs18\cf0\b0\i0\ul0\strike0 observability.\f3\fs18\cf0\b0\i\ul0\strike0 Observability\f3\fs18\cf0\b0\i0\ul0\strike0 is\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 how\f3\fs18\cf0\b0\i0\ul0\strike0 easy\f3\fs18\cf0\b0\i0\ul0\strike0 it\f3\fs18\cf0\b0\i0\ul0\strike0 is\f3\fs18\cf0\b0\i0\ul0\strike0 to\f3\fs18\cf0\b0\i0\ul0\strike0 see\f3\fs18\cf0\b0\i0\ul0\strike0 a\f3\fs18\cf0\b0\i0\ul0\strike0 program\u8217?s\f3\fs18\cf0\b0\i0\ul0\strike0 internal\f3\fs18\cf0\b0\i0\ul0\strike0 state\f3\fs18\cf0\b0\i0\ul0\strike0 variables\f3\fs18\cf0\b0\i0\ul0\strike0 and\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 outputs\f3\fs18\cf0\b0\i0\ul0\strike0 [6].\f3\fs18\cf0\b0\i0\ul0\strike0 If\f3\fs18\cf0\b0\i0\ul0\strike0 a\f3\fs18\cf0\b0\i0\ul0\strike0 test\f3\fs18\cf0\b0\i0\ul0\strike0 oracle\f3\fs18\cf0\b0\i0\ul0\strike0 checks\f3\fs18\cf0\b0\i0\ul0\strike0 more\f3\fs18\cf0\b0\i0\ul0\strike0 program\f3\fs18\cf0\b0\i0\ul0\strike0 states,\f3\fs18\cf0\b0\i0\ul0\strike0 the\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 observability\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 program\f3\fs18\cf0\b0\i0\ul0\strike0 states\f3\fs18\cf0\b0\i0\ul0\strike0 is\f3\fs18\cf0\b0\i0\ul0\strike0 increased,\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i0\ul0\strike0 more\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 faults\f3\fs18\cf0\b0\i0\ul0\strike0 may\f3\fs18\cf0\b0\i0\ul0\strike0 be\f3\fs18\cf0\b0\i0\ul0\strike0 revealed.\f3\fs18\cf0\b0\i0\ul0\strike0 However,\f3\fs18\cf0\b0\i0\ul0\strike0 writing\f3\fs18\cf0\b0\i0\ul0\strike0 test\f3\fs18\cf0\b0\i0\ul0\strike0 oracles\f3\fs18\cf0\b0\i0\ul0\strike0 can\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 be\f3\fs18\cf0\b0\i0\ul0\strike0 costly\f3\fs18\cf0\b0\i0\ul0\strike0 because\f3\fs18\cf0\b0\i0\ul0\strike0 testers\f3\fs18\cf0\b0\i0\ul0\strike0 usually\f3\fs18\cf0\b0\i0\ul0\strike0 provide\f3\fs18\cf0\b0\i0\ul0\strike0 expected\f3\fs18\cf0\b0\i0\ul0\strike0 values\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 manually.\f3\fs18\cf0\b0\i0\ul0\strike0 Model-based\f3\fs18\cf0\b0\i0\ul0\strike0 testing\f3\fs18\cf0\b0\i0\ul0\strike0 can\f3\fs18\cf0\b0\i0\ul0\strike0 use\f3\fs18\cf0\b0\i0\ul0\strike0 state\f3\fs18\cf0\b0\i0\ul0\strike0 invariants\f3\fs18\cf0\b0\i0\ul0\strike0 from\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 state\f3\fs18\cf0\b0\i0\ul0\strike0 machine\f3\fs18\cf0\b0\i0\ul0\strike0 diagrams\f3\fs18\cf0\b0\i0\ul0\strike0 as\f3\fs18\cf0\b0\i0\ul0\strike0 test\f3\fs18\cf0\b0\i0\ul0\strike0 oracles.\f3\fs18\cf0\b0\i0\ul0\strike0 This\f3\fs18\cf0\b0\i0\ul0\strike0 paper\f3\fs18\cf0\b0\i0\ul0\strike0 starts\f3\fs18\cf0\b0\i0\ul0\strike0 with\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 that\f3\fs18\cf0\b0\i0\ul0\strike0 premise\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i0\ul0\strike0 asks\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 following\f3\fs18\cf0\b0\i0\ul0\strike0 questions.\f3\fs18\cf0\b0\i0\ul0\strike0 Is\f3\fs18\cf0\b0\i0\ul0\strike0 checking\f3\fs18\cf0\b0\i0\ul0\strike0 only\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 state\f3\fs18\cf0\b0\i0\ul0\strike0 invariants\f3\fs18\cf0\b0\i0\ul0\strike0 good\f3\fs18\cf0\b0\i0\ul0\strike0 enough?\f3\fs18\cf0\b0\i0\ul0\strike0 Should\f3\fs18\cf0\b0\i0\ul0\strike0 testers\f3\fs18\cf0\b0\i0\ul0\strike0 also\f3\fs18\cf0\b0\i0\ul0\strike0 check\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 class\f3\fs18\cf0\b0\i0\ul0\strike0 variables?\f3\fs18\cf0\b0\i0\ul0\strike0 What\f3\fs18\cf0\b0\i0\ul0\strike0 is\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 cost\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 checking\f3\fs18\cf0\b0\i0\ul0\strike0 more\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 the\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 program\f3\fs18\cf0\b0\i0\ul0\strike0 state?{\shp{\*\shpinst\shpleft700\shptop520\shpright11600\shpbottom1360\shpfhdr0\shpbxpage\shpbypage\shpwr3\shpwrk0\shpfblwtxt1\shpz132\shplid14870{\sp{\sn shapeType}{\sv 1}}{\sp{\sn lTxid}{\sv 19354}}{\sp{\sn fFilled}{\sv 0}}{\sp{\sn fLine}{\sv 0}}{\sp{\sn dxTextLeft}{\sv 0}}{\sp{\sn dyTextTop}{\sv 0}}{\sp{\sn dxTextRight}{\sv 0}}{\sp{\sn dyTextBottom}{\sv 0}}{\sp{\sn fBehindDocument}{\sv 1}}{\shptxt\pard\plain \ql\li0\ri0\widctlpar\sl745\slmult0\pvpara\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0{{\*\shppict{\pict{\*\picprop{\sp{\sn shapeType}{\sv 75}}{\sp{\sn fFlipH}{\sv 0}}{\sp{\sn fFlipV}{\sv 0}}{\sp{\sn pibFlags}{\sv 2}}{\sp{\sn fLine}{\sv 0}}}\picscalex100\picscaley100\piccropl0\piccropr0\piccropt0\piccropb0\picwgoal10840\pichgoal740\jpegblipffd8ffe000104a46494600010100000100010000ffdb00430001010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101ffdb00430101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101ffc0001108003202d303012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00fefe28a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a00ffd9}{\par}\pard \ql \li0\ri0\nowidctlpar\faauto\rin0\lin0\itap0 {\par}}}}}}{\shp{\*\shpinst\shpleft780\shptop14620\shpright4880\shpbottom15560\shpfhdr0\shpbxpage\shpbypage\shpwr3\shpwrk0\shpfblwtxt1\shpz133\shplid14870{\sp{\sn shapeType}{\sv 1}}{\sp{\sn lTxid}{\sv 19354}}{\sp{\sn fFilled}{\sv 0}}{\sp{\sn fLine}{\sv 0}}{\sp{\sn dxTextLeft}{\sv 0}}{\sp{\sn dyTextTop}{\sv 0}}{\sp{\sn dxTextRight}{\sv 0}}{\sp{\sn dyTextBottom}{\sv 0}}{\sp{\sn fBehindDocument}{\sv 1}}{\shptxt\pard\plain \ql\li0\ri0\widctlpar\sl845\slmult0\pvpara\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0{{\*\shppict{\pict{\*\picprop{\sp{\sn shapeType}{\sv 75}}{\sp{\sn fFlipH}{\sv 0}}{\sp{\sn fFlipV}{\sv 0}}{\sp{\sn pibFlags}{\sv 2}}{\sp{\sn fLine}{\sv 0}}}\picscalex100\picscaley100\piccropl0\piccropr0\piccropt0\piccropb0\picwgoal4040\pichgoal840\jpegblipffd8ffe000104a46494600010100000100010000ffdb00430001010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101ffdb00430101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101ffc00011080039010d03012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00fefe28a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a00ffd9}{\par}\pard \ql \li0\ri0\nowidctlpar\faauto\rin0\lin0\itap0 {\par}}}}}}{\shp{\*\shpinst\shpleft5380\shptop14620\shpright7080\shpbottom15160\shpfhdr0\shpbxpage\shpbypage\shpwr3\shpwrk0\shpfblwtxt1\shpz134\shplid14870{\sp{\sn shapeType}{\sv 1}}{\sp{\sn lTxid}{\sv 19354}}{\sp{\sn fFilled}{\sv 0}}{\sp{\sn fLine}{\sv 0}}{\sp{\sn dxTextLeft}{\sv 0}}{\sp{\sn dyTextTop}{\sv 0}}{\sp{\sn dxTextRight}{\sv 0}}{\sp{\sn dyTextBottom}{\sv 0}}{\sp{\sn fBehindDocument}{\sv 1}}{\shptxt\pard\plain \ql\li0\ri0\widctlpar\sl445\slmult0\pvpara\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0{{\*\shppict{\pict{\*\picprop{\sp{\sn shapeType}{\sv 75}}{\sp{\sn fFlipH}{\sv 0}}{\sp{\sn fFlipV}{\sv 0}}{\sp{\sn pibFlags}{\sv 2}}{\sp{\sn fLine}{\sv 0}}}\picscalex100\picscaley100\piccropl0\piccropr0\piccropt0\piccropb0\picwgoal1640\pichgoal440\jpegblipffd8ffe000104a46494600010100000100010000ffdb00430001010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101ffdb00430101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101ffc0001108001e006e03012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00fefe28a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a00ffd9}{\par}\pard \ql \li0\ri0\nowidctlpar\faauto\rin0\lin0\itap0 {\par}}}}}}{\shp{\*\shpinst\shpleft7380\shptop14620\shpright8480\shpbottom15360\shpfhdr0\shpbxpage\shpbypage\shpwr3\shpwrk0\shpfblwtxt1\shpz135\shplid14870{\sp{\sn shapeType}{\sv 1}}{\sp{\sn lTxid}{\sv 19354}}{\sp{\sn fFilled}{\sv 0}}{\sp{\sn fLine}{\sv 0}}{\sp{\sn dxTextLeft}{\sv 0}}{\sp{\sn dyTextTop}{\sv 0}}{\sp{\sn dxTextRight}{\sv 0}}{\sp{\sn dyTextBottom}{\sv 0}}{\sp{\sn fBehindDocument}{\sv 1}}{\shptxt\pard\plain \ql\li0\ri0\widctlpar\sl645\slmult0\pvpara\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0{{\*\shppict{\pict{\*\picprop{\sp{\sn shapeType}{\sv 75}}{\sp{\sn fFlipH}{\sv 0}}{\sp{\sn fFlipV}{\sv 0}}{\sp{\sn pibFlags}{\sv 2}}{\sp{\sn fLine}{\sv 0}}}\picscalex100\picscaley100\piccropl0\piccropr0\piccropt0\piccropb0\picwgoal1040\pichgoal640\jpegblipffd8ffe000104a46494600010100000100010000ffdb00430001010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101ffdb00430101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101ffc0001108002b004503012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00fefe28a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a00ffd9}{\par}\pard \ql \li0\ri0\nowidctlpar\faauto\rin0\lin0\itap0 {\par}}}}}}{\shp{\*\shpinst\shpleft8680\shptop14620\shpright9780\shpbottom15360\shpfhdr0\shpbxpage\shpbypage\shpwr3\shpwrk0\shpfblwtxt1\shpz136\shplid14870{\sp{\sn shapeType}{\sv 1}}{\sp{\sn lTxid}{\sv 19354}}{\sp{\sn fFilled}{\sv 0}}{\sp{\sn fLine}{\sv 0}}{\sp{\sn dxTextLeft}{\sv 0}}{\sp{\sn dyTextTop}{\sv 0}}{\sp{\sn dxTextRight}{\sv 0}}{\sp{\sn dyTextBottom}{\sv 0}}{\sp{\sn fBehindDocument}{\sv 1}}{\shptxt\pard\plain \ql\li0\ri0\widctlpar\sl645\slmult0\pvpara\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0{{\*\shppict{\pict{\*\picprop{\sp{\sn shapeType}{\sv 75}}{\sp{\sn fFlipH}{\sv 0}}{\sp{\sn fFlipV}{\sv 0}}{\sp{\sn pibFlags}{\sv 2}}{\sp{\sn fLine}{\sv 0}}}\picscalex100\picscaley100\piccropl0\piccropr0\piccropt0\piccropb0\picwgoal1040\pichgoal640\jpegblipffd8ffe000104a46494600010100000100010000ffdb00430001010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101ffdb00430101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101ffc0001108002b004603012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00fefe28a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a0028a28a00ffd9}{\par}\pard \ql \li0\ri0\nowidctlpar\faauto\rin0\lin0\itap0 {\par}}}}}}{\shp{\*\shpinst\shpleft9980\shptop14620\shpright11080\shpbottom15360\shpfhdr0\shpbxpage\shpbypage\shpwr3\shpwrk0\shpfblwtxt1\shpz137\shplid14870{\sp{\sn shapeType}{\sv 1}}{\sp{\sn lTxid}{\sv 19354}}{\sp{\sn fFilled}{\sv 0}}{\sp{\sn fLine}{\sv 0}}{\sp{\sn dxTextLeft}{\sv 0}}{\sp{\sn dyTextTop}{\sv 0}}{\sp{\sn dxTextRight}{\sv 0}}{\sp{\sn dyTextBottom}{\sv 0}}{\sp{\sn fBehindDocument}{\sv 1}}{\shptxt\pard\plain \ql\li0\ri0\widctlpar\sl645\slmult0\pvpara\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0{{\*\shppict{\pict{\*\picprop{\sp{\sn shapeType}{\sv 75}}{\sp{\sn fFlipH}{\sv 0}}{\sp{\sn fFlipV}{\sv 0}}{\sp{\sn pibFlags}{\sv 2}}{\sp{\sn fLine}{\sv 0}}}\picscalex100\picscaley100\piccropl0\piccropr0\piccropt0\piccropb0\picwgoal1040\pichgoal640\jpegblipffd8ffe000104a46494600010100000100010000ffdb00430001010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101ffdb00430101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101ffc0001108002b004603012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00fefe28ae4fc49e3bf06f83e4b587c4fe26d1f45b9be8e79acacefaf618efef60b5318bab8b4b00cd79756f69e6c66eee2082486d56446b878d5813b1a36b9a3788f4eb6d63c3fab69bae69378aed69a9e937b6da8e9f722391e190c1796924b6f2f97347243204918c72c6f1bed7465001a94515f8c57ff11be3645e19f8f726ab71f1147c4fd33e087c49d47e144afe38f8e1a16babafdafc11f166a3a38f0e7c27f0ff00822f3e18f8c7501e2cb776b3d63c41ae45e23b5d5fcb1a6e99757ba2e836d7801fb3b457e56dc78fb515f1ff00ecf16f6b278917e1eea7a57c706f11ac3fb43fed657fa3c7e32d33c65fb3b45e117bff001a5d7c348bc55e29d4d341d63c68da37817c6767a2782ee2da5d75adb5498437f2db7ea634f0c4d04524d1c725c318edd1dd55a7916292668e15620c8eb0c52ca5101611c7239015188009a8a28a0028a28a00fc2efda8bc4df10aeb59f8de3c55aaf8dbc25e1bd3be2078020f0ddf7877c337777a4f8cded3e39be85369be32f162e8dabdb690be0ef001d0355f097c3abbb8d2ec75d3ae8f1bae99ab5c7886f1f59c6f8d5f18bf69ef0afc27f8dfab685a8fc43f0c6837bfb43fc02f0ef8e3e31699f0ecf837e28681fb2f788ff68cf86de05f893f1ce0f0541e17b54d2fc436ff00066fbe285bea1f122dfc196177a37867c0d69e35fb059c9e0b86ee3fd84f88ff0000fe1a7c52bb8f51f156836775a828844b3cfa6e87ad59ddfd9a3961b796ff00c3fe29d275ff000c5f5fdac13cd6d63ac5d6892eb5a75a4d359e9fa8dadacf3c3276be0af01785fe1f692746f0be9df62b591e196ea59a79af2f6f66b7b4b6d3ed9eeef2e9e59e44b3d3acecb4cd36d1592c749d26cac748d26d6c74ab1b3b38003f9e4f15fed01f1634cf8d9e2ad1be12fed0df1c7c5a9e15f1e7ec11a1fec1be11bed5f51f11f86ff6a9f84fe3ff008c51681fb5af89fc517fa8786d25f8cf69a2e92df10b41f15fc40d4f54ba6f847e01f01f81be27e9dade92be237f13f8c3c46d3c59fb6e587c28b5f896dfb4d7ed777fe2a87f635f0a7ed14da0dfdd68b268b37c67d1bf6ac6f879a76873e8f07c3ab7bb7f0f45f0b67934cd67c022e96cbc636de578abc756de26f115bc1afc7fd5ce07a0fc851b473c0e7d00a00fe457fe1acbf69aff00840350f177c21fda5ff684f8a3e3a87c2bfb7c6a7fb4ff00866e209bc4fe1ef817e17f83bfb5468fe1bf817e21d020b0f045affc20baca7826cf5cd1b4a4b3d4efb50f1f783a6f15f886fa1d717c2506ada27aefc52f8d3e3af8bffb4837c6af067c4ff18789745f85bfb6dfed4fe12fd92b56b6d6b50d17e19f88353d47fe098df0335ef82de0ad0f516b6b0d1bc59e15f8a5f1f7fe139f0e7859a0bdbbd3be244be27f15687e1cd4357b5d71164fd5efdae7c3d7ff00b28fec89a67863f65ef8a1f0c7f668b2d3be31697abdceabf163e2c787be1e58eb9a1f8ebe266b9f133e2f782fc2bf173e32784fe2f7867c1df103e235ceb3e2b6f0aea9e25f07f8874cd3aeafa5d274683c3a3fb2756d07f2e74fff00828dfc7df175bf87bc5be16f8bdf10fc15e27861ff00827edbfece9fb347c4cd13f67ed5bc5ffb67f87fe35fc6db8f879fb4678d758baf0c7c36b1d63e2043a6e8b6fe259344f197ece9a87c3ff06782bc3de11d1be29ebfa3ff00c23be24b9b4b800c8f81de33fdae7e2be95fb2a68b71fb59fc4397c1bf1a7f684fd9c3c2df1621f865f163c61e3ef8cbe01d4aff00f640fdb3bc5dfb43689f127c57e35fd9d7e1527c168bc7be38f05fc1b925f83da4e977fa87c0bf19e97ac1f0aeb1e0d1e20f065bdb7f516a022aa0270a028dcc598803032cc4b31e3924924f24935fccac3fb7bfed451fecc9f04be2d7803e3e5c7c5cfdaf7e257c69d7f4bf8dbfb1bcba17c18bdb7f81de27d33f674fdb9bc73a07ecdf0f847c2bf0fb49f8b9e0d8753f8a1f087c0be11bbb9f1f78b35bf1ceb727c3c86ef46d7ec23f13f89ffe121f2bf01fc74fda13e2ef8f3fe09f3e3af8dbfb707c3ed6be1537ed89f06af61f12fc38f8b3fb3f78c3c4fe07f1d78eff0060efdb5e6f19f83be35cda77ecd7f0cfc13e01b1f12f8f342f04785fe1a7c39f1368baa78db43d6be20f8ebc3775ac5d78b74df851acf85803fac0a2bf1f3fe09dff00b497ed35f1efe347c51f86bf16f5fb9b9d3bf632f03ea5fb3e7c6ed467f0b785b474f8c1fb52afc6ef885a5d97c46866d2345b3fec88c7ecf7f0cbe1a7c538b42f0cff00c235e179adff0069f85a6f0c37f646811e825007ec1d1451400514514011cb145346f14d1c7344ea55e3951648dd4f5574705594f704107b8a0c30b3c72345199220c22731a978c3801c46c46e40e1543052030001ce0549450030471a962a8aa5cee721402edb42ee6c01b88555505b242a81d00a69b780a95304254c8262a6342a665904ab290570645955640f8dc2450e0ee00d4b4500795fc2bf839e0df83f178ecf8546b575a9fc4df88be20f8a9e3cf1078935cd47c43af7893c63e20b5d27483777ba8ea334af1d8e85e16f0ef85fc15e17d26d12db4df0ff0083bc2be1ed074fb68ad74d8f715ea945007fffd9}{\par}\pard \ql \li0\ri0\nowidctlpar\faauto\rin0\lin0\itap0 {\par}}}}}}\sect\sectd\sbkpage\pgwsxn12240\pghsxn15840\sected\cols2\colno1\colw6250\colsr10\colno2\colw5980\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-245\par\pard\plain\li1464\sl-176\f3\fs18\cf0\b0\i0\ul0\strike0 We\f3\fs18\cf0\b0\i0\ul0\strike0 previously\f3\fs18\cf0\b0\i0\ul0\strike0 developed\f3\fs18\cf0\b0\i0\ul0\strike0 a\f3\fs18\cf0\b0\i0\ul0\strike0 test\f3\fs18\cf0\b0\i0\ul0\strike0 automation\f3\fs18\cf0\b0\i0\ul0\strike0 framework\f3\fs18\cf0\b0\i0\ul0\strike0 to\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 transform\f3\fs18\cf0\b0\i0\ul0\strike0 abstract\f3\fs18\cf0\b0\i0\ul0\strike0 tests\f3\fs18\cf0\b0\i0\ul0\strike0 to\f3\fs18\cf0\b0\i0\ul0\strike0 concrete\f3\fs18\cf0\b0\i0\ul0\strike0 tests\f3\fs18\cf0\b0\i0\ul0\strike0 [9],\f3\fs18\cf0\b0\i0\ul0\strike0 [10],\f3\fs18\cf0\b0\i0\ul0\strike0 [12].\f3\fs18\cf0\b0\i0\ul0\strike0 This\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 paper\f3\fs18\cf0\b0\i0\ul0\strike0 extends\f3\fs18\cf0\b0\i0\ul0\strike0 that\f3\fs18\cf0\b0\i0\ul0\strike0 work\f3\fs18\cf0\b0\i0\ul0\strike0 by\f3\fs18\cf0\b0\i0\ul0\strike0 studying\f3\fs18\cf0\b0\i0\ul0\strike0 OSes\f3\fs18\cf0\b0\i0\ul0\strike0 for\f3\fs18\cf0\b0\i0\ul0\strike0 system-level\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 tests\f3\fs18\cf0\b0\i0\ul0\strike0 in\f3\fs18\cf0\b0\i0\ul0\strike0 model-based\f3\fs18\cf0\b0\i0\ul0\strike0 testing.\f3\fs18\cf0\b0\i0\ul0\strike0 This\f3\fs18\cf0\b0\i0\ul0\strike0 paper\f3\fs18\cf0\b0\i0\ul0\strike0 proposes\f3\fs18\cf0\b0\i0\ul0\strike0 six\f3\fs18\cf0\b0\i0\ul0\strike0 novel\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 OSes.\f3\fs18\cf0\b0\i0\ul0\strike0 Each\f3\fs18\cf0\b0\i0\ul0\strike0 OS\f3\fs18\cf0\b0\i0\ul0\strike0 checks\f3\fs18\cf0\b0\i0\ul0\strike0 different\f3\fs18\cf0\b0\i0\ul0\strike0 outputs\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i0\ul0\strike0 internal\f3\fs18\cf0\b0\i0\ul0\strike0 program\par\pard\plain\li1193\sl-206\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 states\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 such\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 as\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 class\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 variables\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 after\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 each\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 transition\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 or\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 at\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 the\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 end\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 a\f3\fs18\cf0\b0\i0\ul0\strike0 test.\f3\fs18\cf0\b0\i0\ul0\strike0 The\f3\fs18\cf0\b0\i0\ul0\strike0 new\f3\fs18\cf0\b0\i0\ul0\strike0 OSes\f3\fs18\cf0\b0\i0\ul0\strike0 are\f3\fs18\cf0\b0\i0\ul0\strike0 de\u64257?ned\f3\fs18\cf0\b0\i0\ul0\strike0 in\f3\fs18\cf0\b0\i0\ul0\strike0 section\f3\fs18\cf0\b0\i0\ul0\strike0 III.\par\pard\plain\li1464\sl-321\f3\fs18\cf0\b0\i0\ul0\strike0 We\f3\fs18\cf0\b0\i0\ul0\strike0 evaluated\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 effectiveness\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i0\ul0\strike0 cost\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 new\f3\fs18\cf0\b0\i0\ul0\strike0 OSes\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 based\f3\fs18\cf0\b0\i0\ul0\strike0 on\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 same\f3\fs18\cf0\b0\i0\ul0\strike0 test\f3\fs18\cf0\b0\i0\ul0\strike0 inputs.\f3\fs18\cf0\b0\i0\ul0\strike0 16\f3\fs18\cf0\b0\i0\ul0\strike0 open\f3\fs18\cf0\b0\i0\ul0\strike0 source\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i0\ul0\strike0 example\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 programs,\f3\fs18\cf0\b0\i0\ul0\strike0 with\f3\fs18\cf0\b0\i0\ul0\strike0 UML\f3\fs18\cf0\b0\i0\ul0\strike0 state\f3\fs18\cf0\b0\i0\ul0\strike0 machine\f3\fs18\cf0\b0\i0\ul0\strike0 diagrams,\f3\fs18\cf0\b0\i0\ul0\strike0 were\f3\fs18\cf0\b0\i0\ul0\strike0 used.\f3\fs18\cf0\b0\i0\ul0\strike0 Test\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 inputs\f3\fs18\cf0\b0\i0\ul0\strike0 were\f3\fs18\cf0\b0\i0\ul0\strike0 generated\f3\fs18\cf0\b0\i0\ul0\strike0 to\f3\fs18\cf0\b0\i0\ul0\strike0 satisfy\f3\fs18\cf0\b0\i0\ul0\strike0 edge\f3\fs18\cf0\b0\i0\ul0\strike0 coverage\f3\fs18\cf0\b0\i0\ul0\strike0 (EC),\f3\fs18\cf0\b0\i0\ul0\strike0 which\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 covers\f3\fs18\cf0\b0\i0\ul0\strike0 all\f3\fs18\cf0\b0\i0\ul0\strike0 transitions,\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i0\ul0\strike0 edge-pair\f3\fs18\cf0\b0\i0\ul0\strike0 coverage\f3\fs18\cf0\b0\i0\ul0\strike0 (EPC),\f3\fs18\cf0\b0\i0\ul0\strike0 which\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 covers\f3\fs18\cf0\b0\i0\ul0\strike0 all\f3\fs18\cf0\b0\i0\ul0\strike0 pairs\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 transition\f3\fs18\cf0\b0\i0\ul0\strike0 [1].\f3\fs18\cf0\b0\i0\ul0\strike0 EC\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i0\ul0\strike0 EPC\f3\fs18\cf0\b0\i0\ul0\strike0 differ\f3\fs18\cf0\b0\i0\ul0\strike0 when\f3\fs18\cf0\b0\i0\ul0\strike0 at\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 least\f3\fs18\cf0\b0\i0\ul0\strike0 one\f3\fs18\cf0\b0\i0\ul0\strike0 node\f3\fs18\cf0\b0\i0\ul0\strike0 as\f3\fs18\cf0\b0\i0\ul0\strike0 indegree\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i0\ul0\strike0 outdegree\f3\fs18\cf0\b0\i0\ul0\strike0 greater\f3\fs18\cf0\b0\i0\ul0\strike0 than\f3\fs18\cf0\b0\i0\ul0\strike0 one.\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 Then\f3\fs18\cf0\b0\i0\ul0\strike0 by\f3\fs18\cf0\b0\i0\ul0\strike0 generating\f3\fs18\cf0\b0\i0\ul0\strike0 test\f3\fs18\cf0\b0\i0\ul0\strike0 oracle\f3\fs18\cf0\b0\i0\ul0\strike0 data\f3\fs18\cf0\b0\i0\ul0\strike0 for\f3\fs18\cf0\b0\i0\ul0\strike0 all\f3\fs18\cf0\b0\i0\ul0\strike0 OSes,\f3\fs18\cf0\b0\i0\ul0\strike0 we\f3\fs18\cf0\b0\i0\ul0\strike0 designed\par\pard\plain\li1193\sl-206\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 16\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 sets\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 of\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 tests\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 for\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 each\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 program\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 (2\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 coverage\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 criteria\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 *\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 8\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 OSes).\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 Then\f3\fs18\cf0\b0\i0\ul0\strike0 we\f3\fs18\cf0\b0\i0\ul0\strike0 ran\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 tests\f3\fs18\cf0\b0\i0\ul0\strike0 against\f3\fs18\cf0\b0\i0\ul0\strike0 faulty\f3\fs18\cf0\b0\i0\ul0\strike0 versions\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 programs.\par\pard\plain\li1464\sl-321\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 This\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 research\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 had\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 \u64257?ve\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 conclusions\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 for\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 using\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 OSes\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 in\f3\fs18\charscalex99\cf0\b0\i0\ul0\strike0 model-\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 based\f3\fs18\cf0\b0\i0\ul0\strike0 testing.\f3\fs18\cf0\b0\i0\ul0\strike0 First,\f3\fs18\cf0\b0\i0\ul0\strike0 just\f3\fs18\cf0\b0\i0\ul0\strike0 checking\f3\fs18\cf0\b0\i0\ul0\strike0 runtime\f3\fs18\cf0\b0\i0\ul0\strike0 exceptions\f3\fs18\cf0\b0\i0\ul0\strike0 misses\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 many\f3\fs18\cf0\b0\i0\ul0\strike0 faults\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i0\ul0\strike0 wastes\f3\fs18\cf0\b0\i0\ul0\strike0 much\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 testing\f3\fs18\cf0\b0\i0\ul0\strike0 effort.\f3\fs18\cf0\b0\i0\ul0\strike0 Second,\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 OSes\f3\fs18\cf0\b0\i0\ul0\strike0 that\f3\fs18\cf0\b0\i0\ul0\strike0 check\f3\fs18\cf0\b0\i0\ul0\strike0 more\f3\fs18\cf0\b0\i0\ul0\strike0 program\f3\fs18\cf0\b0\i0\ul0\strike0 states\f3\fs18\cf0\b0\i0\ul0\strike0 were\f3\fs18\cf0\b0\i0\ul0\strike0 not\f3\fs18\cf0\b0\i0\ul0\strike0 always\f3\fs18\cf0\b0\i0\ul0\strike0 more\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 effective\f3\fs18\cf0\b0\i0\ul0\strike0 at\f3\fs18\cf0\b0\i0\ul0\strike0 \u64257?nding\f3\fs18\cf0\b0\i0\ul0\strike0 faults\f3\fs18\cf0\b0\i0\ul0\strike0 than\f3\fs18\cf0\b0\i0\ul0\strike0 OSes\f3\fs18\cf0\b0\i0\ul0\strike0 that\f3\fs18\cf0\b0\i0\ul0\strike0 check\f3\fs18\cf0\b0\i0\ul0\strike0 fewer\f3\fs18\cf0\b0\i0\ul0\strike0 program\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 states.\f3\fs18\cf0\b0\i0\ul0\strike0 Third,\f3\fs18\cf0\b0\i0\ul0\strike0 OSes\f3\fs18\cf0\b0\i0\ul0\strike0 that\f3\fs18\cf0\b0\i0\ul0\strike0 check\f3\fs18\cf0\b0\i0\ul0\strike0 program\f3\fs18\cf0\b0\i0\ul0\strike0 states\f3\fs18\cf0\b0\i0\ul0\strike0 multiple\f3\fs18\cf0\b0\i0\ul0\strike0 times\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 were\f3\fs18\cf0\b0\i0\ul0\strike0 only\f3\fs18\cf0\b0\i0\ul0\strike0 slightly\f3\fs18\cf0\b0\i0\ul0\strike0 more\f3\fs18\cf0\b0\i0\ul0\strike0 effective\f3\fs18\cf0\b0\i0\ul0\strike0 than\f3\fs18\cf0\b0\i0\ul0\strike0 OSes\f3\fs18\cf0\b0\i0\ul0\strike0 that\f3\fs18\cf0\b0\i0\ul0\strike0 check\f3\fs18\cf0\b0\i0\ul0\strike0 the\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 same\f3\fs18\cf0\b0\i0\ul0\strike0 program\f3\fs18\cf0\b0\i0\ul0\strike0 states\f3\fs18\cf0\b0\i0\ul0\strike0 once.\f3\fs18\cf0\b0\i0\ul0\strike0 Fourth,\f3\fs18\cf0\b0\i0\ul0\strike0 with\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 same\f3\fs18\cf0\b0\i0\ul0\strike0 program\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 states,\f3\fs18\cf0\b0\i0\ul0\strike0 a\f3\fs18\cf0\b0\i0\ul0\strike0 test\f3\fs18\cf0\b0\i0\ul0\strike0 set\f3\fs18\cf0\b0\i0\ul0\strike0 that\f3\fs18\cf0\b0\i0\ul0\strike0 satis\u64257?es\f3\fs18\cf0\b0\i0\ul0\strike0 a\f3\fs18\cf0\b0\i0\ul0\strike0 stronger\f3\fs18\cf0\b0\i0\ul0\strike0 coverage\f3\fs18\cf0\b0\i0\ul0\strike0 criterion\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 was\f3\fs18\cf0\b0\i0\ul0\strike0 not\f3\fs18\cf0\b0\i0\ul0\strike0 more\f3\fs18\cf0\b0\i0\ul0\strike0 effective\f3\fs18\cf0\b0\i0\ul0\strike0 at\f3\fs18\cf0\b0\i0\ul0\strike0 \u64257?nding\f3\fs18\cf0\b0\i0\ul0\strike0 faults\f3\fs18\cf0\b0\i0\ul0\strike0 than\f3\fs18\cf0\b0\i0\ul0\strike0 tests\f3\fs18\cf0\b0\i0\ul0\strike0 from\f3\fs18\cf0\b0\i0\ul0\strike0 a\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 weaker\f3\fs18\cf0\b0\i0\ul0\strike0 coverage\f3\fs18\cf0\b0\i0\ul0\strike0 criterion.\f3\fs18\cf0\b0\i0\ul0\strike0 Fifth,\f3\fs18\cf0\b0\i0\ul0\strike0 if\f3\fs18\cf0\b0\i0\ul0\strike0 state\f3\fs18\cf0\b0\i0\ul0\strike0 machine\f3\fs18\cf0\b0\i0\ul0\strike0 diagrams\f3\fs18\cf0\b0\i0\ul0\strike0 are\par\pard\plain\li1193\sl-206\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 used\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 to\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 generate\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 tests,\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 checking\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 state\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 invariants\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 is\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 a\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 reasonably\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 effective\f3\fs18\cf0\b0\i0\ul0\strike0 low\f3\fs18\cf0\b0\i0\ul0\strike0 cost\f3\fs18\cf0\b0\i0\ul0\strike0 approach.\f3\fs18\cf0\b0\i0\ul0\strike0 To\f3\fs18\cf0\b0\i0\ul0\strike0 achieve\f3\fs18\cf0\b0\i0\ul0\strike0 higher\f3\fs18\cf0\b0\i0\ul0\strike0 effectiveness,\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 testers\f3\fs18\cf0\b0\i0\ul0\strike0 can\f3\fs18\cf0\b0\i0\ul0\strike0 check\f3\fs18\cf0\b0\i0\ul0\strike0 outputs\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i0\ul0\strike0 parameter\f3\fs18\cf0\b0\i0\ul0\strike0 objects.\par\pard\plain\li1464\sl-321\f3\fs18\cf0\b0\i0\ul0\strike0 The\f3\fs18\cf0\b0\i0\ul0\strike0 contents\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 paper\f3\fs18\cf0\b0\i0\ul0\strike0 are\f3\fs18\cf0\b0\i0\ul0\strike0 as\f3\fs18\cf0\b0\i0\ul0\strike0 follows.\f3\fs18\cf0\b0\i0\ul0\strike0 Section\f3\fs18\cf0\b0\i0\ul0\strike0 II\par\pard\plain\li1193\sl-206\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 introduces\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 the\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 background\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 of\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 test\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 oracles\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 and\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 discusses\f3\fs18\charscalex98\cf0\b0\i0\ul0\strike0 related\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 work.\f3\fs18\cf0\b0\i0\ul0\strike0 Section\f3\fs18\cf0\b0\i0\ul0\strike0 III\f3\fs18\cf0\b0\i0\ul0\strike0 presents\f3\fs18\cf0\b0\i0\ul0\strike0 all\f3\fs18\cf0\b0\i0\ul0\strike0 eight\f3\fs18\cf0\b0\i0\ul0\strike0 OSes\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i0\ul0\strike0 how\f3\fs18\cf0\b0\i0\ul0\strike0 tests\f3\fs18\cf0\b0\i0\ul0\strike0 were\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 created.\f3\fs18\cf0\b0\i0\ul0\strike0 Section\f3\fs18\cf0\b0\i0\ul0\strike0 IV\f3\fs18\cf0\b0\i0\ul0\strike0 shows\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 experimental\f3\fs18\cf0\b0\i0\ul0\strike0 design,\f3\fs18\cf0\b0\i0\ul0\strike0 subjects,\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 procedure,\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i0\ul0\strike0 results\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i0\ul0\strike0 also\f3\fs18\cf0\b0\i0\ul0\strike0 has\f3\fs18\cf0\b0\i0\ul0\strike0 a\f3\fs18\cf0\b0\i0\ul0\strike0 discussion\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 results\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i0\ul0\strike0 possible\f3\fs18\cf0\b0\i0\ul0\strike0 threats\f3\fs18\cf0\b0\i0\ul0\strike0 to\f3\fs18\cf0\b0\i0\ul0\strike0 validity.\f3\fs18\cf0\b0\i0\ul0\strike0 Finally,\f3\fs18\cf0\b0\i0\ul0\strike0 section\f3\fs18\cf0\b0\i0\ul0\strike0 V\f3\fs18\cf0\b0\i0\ul0\strike0 presents\par\pard\plain\li1193\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 conclusions\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i0\ul0\strike0 discusses\f3\fs18\cf0\b0\i0\ul0\strike0 future\f3\fs18\cf0\b0\i0\ul0\strike0 work.\par\pard\column\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-200\par\pard\plain\sl-245\par\pard\plain\li0\sl-176\f3\fs18\cf0\b0\i0\ul0\strike0 precise\f3\fs18\cf0\b0\i0\ul0\strike0 OS.\f3\fs18\cf0\b0\i0\ul0\strike0 Assertions\f3\fs18\cf0\b0\i0\ul0\strike0 usually\f3\fs18\cf0\b0\i0\ul0\strike0 are\f3\fs18\cf0\b0\i0\ul0\strike0 written\f3\fs18\cf0\b0\i0\ul0\strike0 by\f3\fs18\cf0\b0\i0\ul0\strike0 hand,\f3\fs18\cf0\b0\i0\ul0\strike0 each\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 assertion\f3\fs18\cf0\b0\i0\ul0\strike0 requires\f3\fs18\cf0\b0\i0\ul0\strike0 expected\f3\fs18\cf0\b0\i0\ul0\strike0 results,\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i0\ul0\strike0 adds\f3\fs18\cf0\b0\i0\ul0\strike0 to\f3\fs18\cf0\b0\i0\ul0\strike0 execution\f3\fs18\cf0\b0\i0\ul0\strike0 time.\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 Keep\f3\fs18\cf0\b0\i0\ul0\strike0 in\f3\fs18\cf0\b0\i0\ul0\strike0 mind\f3\fs18\cf0\b0\i0\ul0\strike0 that\f3\fs18\cf0\b0\i0\ul0\strike0 automated\f3\fs18\cf0\b0\i0\ul0\strike0 test\f3\fs18\cf0\b0\i0\ul0\strike0 oracle\f3\fs18\cf0\b0\i0\ul0\strike0 generation\f3\fs18\cf0\b0\i0\ul0\strike0 is\f3\fs18\cf0\b0\i0\ul0\strike0 often\f3\fs18\cf0\b0\i0\ul0\strike0 not\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 available\f3\fs18\cf0\b0\i0\ul0\strike0 for\f3\fs18\cf0\b0\i0\ul0\strike0 many\f3\fs18\cf0\b0\i0\ul0\strike0 situations\f3\fs18\cf0\b0\i0\ul0\strike0 in\f3\fs18\cf0\b0\i0\ul0\strike0 industry.\par\pard\plain\li270\sl-353\f3\fs18\cf0\b0\i0\ul0\strike0 The\f3\fs18\cf0\b0\i0\ul0\strike0 frequency\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 checking\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 program\f3\fs18\cf0\b0\i0\ul0\strike0 state\f3\fs18\cf0\b0\i0\ul0\strike0 is\f3\fs18\cf0\b0\i0\ul0\strike0 a\f3\fs18\cf0\b0\i0\ul0\strike0 factor\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 when\f3\fs18\cf0\b0\i0\ul0\strike0 considering\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 cost-effectiveness\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 an\f3\fs18\cf0\b0\i0\ul0\strike0 OS.\f3\fs18\cf0\b0\i0\ul0\strike0 Given\f3\fs18\cf0\b0\i0\ul0\strike0 two\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 OSes\f3\fs18\cf0\b0\i0\ul0\strike0 that\f3\fs18\cf0\b0\i0\ul0\strike0 check\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 same\f3\fs18\cf0\b0\i0\ul0\strike0 internal\f3\fs18\cf0\b0\i0\ul0\strike0 state\f3\fs18\cf0\b0\i0\ul0\strike0 variables\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i0\ul0\strike0 outputs,\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 if\f3\fs18\cf0\b0\i0\ul0\strike0 they\f3\fs18\cf0\b0\i0\ul0\strike0 \u64257?nd\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 same\f3\fs18\cf0\b0\i0\ul0\strike0 faults,\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 one\f3\fs18\cf0\b0\i0\ul0\strike0 that\f3\fs18\cf0\b0\i0\ul0\strike0 checks\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 states\f3\fs18\cf0\b0\i0\ul0\strike0 less\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 frequently\f3\fs18\cf0\b0\i0\ul0\strike0 will\f3\fs18\cf0\b0\i0\ul0\strike0 be\f3\fs18\cf0\b0\i0\ul0\strike0 more\f3\fs18\cf0\b0\i0\ul0\strike0 cost-effective.\par\pard\plain\li270\sl-353\f3\fs18\cf0\b0\i0\ul0\strike0 To\f3\fs18\cf0\b0\i0\ul0\strike0 our\f3\fs18\cf0\b0\i0\ul0\strike0 knowledge,\f3\fs18\cf0\b0\i0\ul0\strike0 only\f3\fs18\cf0\b0\i0\ul0\strike0 a\f3\fs18\cf0\b0\i0\ul0\strike0 few\f3\fs18\cf0\b0\i0\ul0\strike0 papers\f3\fs18\cf0\b0\i0\ul0\strike0 have\f3\fs18\cf0\b0\i0\ul0\strike0 studied\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 test\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 oracle\f3\fs18\cf0\b0\i0\ul0\strike0 problem\f3\fs18\cf0\b0\i0\ul0\strike0 empirically.\f3\fs18\cf0\b0\i0\ul0\strike0 Briand\f3\fs18\cf0\b0\i0\ul0\strike0 et\f3\fs18\cf0\b0\i0\ul0\strike0 al.\f3\fs18\cf0\b0\i0\ul0\strike0 [3]\f3\fs18\cf0\b0\i0\ul0\strike0 compared\f3\fs18\cf0\b0\i0\ul0\strike0 the\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i\ul0\strike0 very\f3\fs18\cf0\b0\i\ul0\strike0 precise\f3\fs18\cf0\b0\i\ul0\strike0 OS\f3\fs18\cf0\b0\i0\ul0\strike0 with\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i\ul0\strike0 state\f3\fs18\cf0\b0\i\ul0\strike0 invariant\f3\fs18\cf0\b0\i\ul0\strike0 OS\f3\fs18\cf0\b0\i0\ul0\strike0 (SIOS)\f3\fs18\cf0\b0\i0\ul0\strike0 based\f3\fs18\cf0\b0\i0\ul0\strike0 on\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 statecharts\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 three\f3\fs18\cf0\b0\i0\ul0\strike0 classes\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 less\f3\fs18\cf0\b0\i0\ul0\strike0 than\f3\fs18\cf0\b0\i0\ul0\strike0 500\f3\fs18\cf0\b0\i0\ul0\strike0 lines\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 code\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 apiece.\f3\fs18\cf0\b0\i0\ul0\strike0 The\f3\fs18\cf0\b0\i0\ul0\strike0 very\f3\fs18\cf0\b0\i0\ul0\strike0 precise\f3\fs18\cf0\b0\i0\ul0\strike0 OS\f3\fs18\cf0\b0\i0\ul0\strike0 checks\f3\fs18\cf0\b0\i0\ul0\strike0 all\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 class\f3\fs18\cf0\b0\i0\ul0\strike0 attributes\f3\fs18\cf0\b0\i0\ul0\strike0 and\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 outputs\f3\fs18\cf0\b0\i0\ul0\strike0 after\f3\fs18\cf0\b0\i0\ul0\strike0 each\f3\fs18\cf0\b0\i0\ul0\strike0 operation\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i0\ul0\strike0 is\f3\fs18\cf0\b0\i0\ul0\strike0 considered\f3\fs18\cf0\b0\i0\ul0\strike0 to\f3\fs18\cf0\b0\i0\ul0\strike0 be\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 most\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 accurate\f3\fs18\cf0\b0\i0\ul0\strike0 veri\u64257?cation\f3\fs18\cf0\b0\i0\ul0\strike0 possible.\f3\fs18\cf0\b0\i0\ul0\strike0 In\f3\fs18\cf0\b0\i0\ul0\strike0 contrast,\f3\fs18\cf0\b0\i0\ul0\strike0 SIOS\f3\fs18\cf0\b0\i0\ul0\strike0 only\f3\fs18\cf0\b0\i0\ul0\strike0 checks\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 invariants\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 states\f3\fs18\cf0\b0\i0\ul0\strike0 reached\f3\fs18\cf0\b0\i0\ul0\strike0 after\f3\fs18\cf0\b0\i0\ul0\strike0 each\f3\fs18\cf0\b0\i0\ul0\strike0 transition.\f3\fs18\cf0\b0\i0\ul0\strike0 They\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 found\f3\fs18\cf0\b0\i0\ul0\strike0 that\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 very\f3\fs18\cf0\b0\i0\ul0\strike0 precise\f3\fs18\cf0\b0\i0\ul0\strike0 OS\f3\fs18\cf0\b0\i0\ul0\strike0 is\f3\fs18\cf0\b0\i0\ul0\strike0 more\f3\fs18\cf0\b0\i0\ul0\strike0 effective\f3\fs18\cf0\b0\i0\ul0\strike0 at\f3\fs18\cf0\b0\i0\ul0\strike0 \u64257?nding\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 faults\f3\fs18\cf0\b0\i0\ul0\strike0 than\f3\fs18\cf0\b0\i0\ul0\strike0 SIOS.\f3\fs18\cf0\b0\i0\ul0\strike0 They\f3\fs18\cf0\b0\i0\ul0\strike0 also\f3\fs18\cf0\b0\i0\ul0\strike0 found\f3\fs18\cf0\b0\i0\ul0\strike0 that\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 cost\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 very\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 precise\f3\fs18\cf0\b0\i0\ul0\strike0 OS\f3\fs18\cf0\b0\i0\ul0\strike0 is\f3\fs18\cf0\b0\i0\ul0\strike0 higher\f3\fs18\cf0\b0\i0\ul0\strike0 than\f3\fs18\cf0\b0\i0\ul0\strike0 SIOS\f3\fs18\cf0\b0\i0\ul0\strike0 in\f3\fs18\cf0\b0\i0\ul0\strike0 terms\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 number\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 test\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 cases,\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 CPU\f3\fs18\cf0\b0\i0\ul0\strike0 execution\f3\fs18\cf0\b0\i0\ul0\strike0 time,\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 lines\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 code.\par\pard\plain\li270\sl-353\f3\fs18\cf0\b0\i0\ul0\strike0 Xie\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i0\ul0\strike0 Memon\f3\fs18\cf0\b0\i0\ul0\strike0 [23]\f3\fs18\cf0\b0\i0\ul0\strike0 considered\f3\fs18\cf0\b0\i0\ul0\strike0 what\f3\fs18\cf0\b0\i0\ul0\strike0 to\f3\fs18\cf0\b0\i0\ul0\strike0 evaluate\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i0\ul0\strike0 how\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 often\f3\fs18\cf0\b0\i0\ul0\strike0 to\f3\fs18\cf0\b0\i0\ul0\strike0 check\f3\fs18\cf0\b0\i0\ul0\strike0 program\f3\fs18\cf0\b0\i0\ul0\strike0 states\f3\fs18\cf0\b0\i0\ul0\strike0 from\f3\fs18\cf0\b0\i0\ul0\strike0 GUIs.\f3\fs18\cf0\b0\i0\ul0\strike0 They\f3\fs18\cf0\b0\i0\ul0\strike0 found\f3\fs18\cf0\b0\i0\ul0\strike0 that\f3\fs18\cf0\b0\i0\ul0\strike0 the\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 variations\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 two\f3\fs18\cf0\b0\i0\ul0\strike0 factors\f3\fs18\cf0\b0\i0\ul0\strike0 affect\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 fault-detection\f3\fs18\cf0\b0\i0\ul0\strike0 ability\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i0\ul0\strike0 cost\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 test\f3\fs18\cf0\b0\i0\ul0\strike0 cases.\f3\fs18\cf0\b0\i0\ul0\strike0 They\f3\fs18\cf0\b0\i0\ul0\strike0 proposed\f3\fs18\cf0\b0\i0\ul0\strike0 six\f3\fs18\cf0\b0\i0\ul0\strike0 OSes\f3\fs18\cf0\b0\i0\ul0\strike0 that\f3\fs18\cf0\b0\i0\ul0\strike0 check\f3\fs18\cf0\b0\i0\ul0\strike0 a\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 widget,\f3\fs18\cf0\b0\i0\ul0\strike0 a\f3\fs18\cf0\b0\i0\ul0\strike0 window,\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i0\ul0\strike0 all\f3\fs18\cf0\b0\i0\ul0\strike0 windows\f3\fs18\cf0\b0\i0\ul0\strike0 after\f3\fs18\cf0\b0\i0\ul0\strike0 every\f3\fs18\cf0\b0\i0\ul0\strike0 event\f3\fs18\cf0\b0\i0\ul0\strike0 and\f3\fs18\cf0\b0\i0\ul0\strike0 after\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 the\f3\fs18\cf0\b0\i0\ul0\strike0 last\f3\fs18\cf0\b0\i0\ul0\strike0 event\f3\fs18\cf0\b0\i0\ul0\strike0 of\f3\fs18\cf0\b0\i0\ul0\strike0 a\f3\fs18\cf0\b0\i0\ul0\strike0 test.\f3\fs18\cf0\b0\i0\ul0\strike0 They\f3\fs18\cf0\b0\i0\ul0\strike0 concluded\f3\fs18\cf0\b0\i0\ul0\strike0 that\f3\fs18\cf0\b0\i0\ul0\strike0 \u8220?weak\u8221?\f3\fs18\cf0\b0\i0\ul0\strike0 OSes\par\pard\plain\li0\sl-206\f3\fs18\cf0\b0\i0\ul0\strike0 detect\f3\fs18\cf0\b0\i0\ul0\strike0 fewer\f3\fs18\cf0\b0\i0\ul0\strike0 faults\f3\fs18\cf0\b0