Formal Methods and Conformance Testing or

In this paper, we will show the correlation between the notion of implementation relations known from formal methods and ideas of conformance testing. We will show that the implementation relations realized through the practical testing of systems come from a family of parameterized implementation relations. We will also show that for glass box testing, implementation relations parameterized by test purposes converge to the mayy testing preorder of DeNicola and Hennessy 7], while for black box testing, implementation relations parameterized by test cases converge to a mayytesting preorder of the behavior visible at the interface to the environment. 1 Motivation When developing concurrent systems with formal methods, the notion of correctness of an implementation with respect to a speciication plays a major role. Many of such implementation relations can be found in literature, e. g., bisimulation equivalence 6], failure equivalence and preorder 4], testing equivalence and preorder 7], as well as many others 11]. To ensure properties of implementations, given implementation relations between a speci-cation and its implementation have to be checked. For implementations for which a formal model exists this can be done by tools like the Concurrency Workbench 2]. Yet, most implementations , especially those in the eld of telecommunication systems, are black boxes only the behavior visible to the environment can be modeled. Hence the implementation relation between speciication and implementation can only be connrmed by means of testing the implementation. But the testing of systems has to be done in nite time. Therefore often the tests done on the implementation cannot be exhaustive. So, what are the relations for which tests can be performed? The work found for example in 1] or 9] strives for nding tests that exactly discriminate between correct and erroneous implementations based on a given implementation relation. Yet in practical testing, test cases are formulated to validate the presence of some speciic properties in implementations, the soocalled test purposes. This clearly does not root out