(Test adequacy criteria for UML design models) - Computer Science

33 Pages·2003·0.49 MB·English

SOFTWARETESTING,VERIFICATIONANDRELIABILITY
Softw.Test.Verif.Reliab.2003;13:95(cid:150)127 (DOI:10.1002/stvr.270)
Test adequacy criteria for UML
design models
AnnelieseAndrews,RobertFrance,SudiptoGhosh(cid:1),(cid:134)
andGeraldCraig
ComputerScienceDepartment,ColoradoStateUniversity,
FortCollins,CO80523,U.S.A.
SUMMARY
Systematicdesigntesting,inwhichexecutablemodelsofbehavioursaretestedusinginputsthatexercise
scenarios,canhelpreveal(cid:223)awsindesignsbeforetheyareimplementedincode.Inthispaperatechnique
fortestingexecutableformsofUML(Uni(cid:222)edModellingLanguage)modelsisdescribedandtestadequacy
criteriabasedonUMLmodelelementsareproposed.Thecriteriacanbeusedtode(cid:222)netestobjectivesfor
UMLdesigns.TheUMLdesigntestcriteriaarebasedonthesamepremiseunderlyingcodetestcriteria:
coverageofrelevantbuildingblocksofmodelsishighlylikelytouncoverfaults.Thetestadequacycriteria
proposedinthispaperarebasedonbuildingblocksforUMLclassandinteractiondiagrams.Classdiagram
criteriaareusedtodeterminetheobjectcon(cid:222)gurationsonwhichtestsarerun,whileinteractiondiagram
criteria areusedtodeterminethesequencesofmessages thatshouldbetested.Copyright(cid:2)c 2003 John
Wiley&Sons,Ltd.
KEYWORDS: design reviews; software testing; test adequacy criteria; UML; class diagram; collaboration
diagram;categorypartitioning
1. INTRODUCTION
TheUni(cid:30)edModellingLanguage(UML)[1]isanObjectManagementGroup(OMG)object-oriented
(OO)modellinglanguagestandardthatisgainingwidespreaduseinthesoftwaredevelopmentindustry.
Modellingalarge,complexsystem(e.g.,atelecommunicationsystem)canresultinasystemmodel
thatconsistsofavarietyofdiagramspresentingdifferentviewsofthemodel.Designreviewsinwhich
thereviewerstraceandrelateconceptsacrossthediagramscanbetediousbecauseoftheamountof
informationreviewersneedtotrack.TheuseofUMLmodelsthathaveinformalsemanticscanalso
makeitdif(cid:30)culttouncoverdesignfaultsinUMLmodels.
(cid:1)Correspondenceto:DrSudiptoGhosh,ComputerScienceDepartment,ColoradoStateUniversity,FortCollins,CO80523,
U.S.A.
(cid:134)E-mail:[email protected]
Contract/grantsponsor:NationalScienceFoundationAward;contract/grantnumber:#CCR-0203285
Received8April2002
Copyright(cid:2)c 2003JohnWiley&Sons,Ltd. Accepted13March2003
96 A.ANDREWSETAL.
Staticanddynamicanalysistoolsthatutilizewell-de(cid:30)nedsemanticsforUMLmodelscanenhance
areviewer(cid:146)sabilitytouncoverfaultsinthemodels.Rigorousstaticanalysistoolsthatcansigni(cid:30)cantly
enhancedesignreviewsincludestateexplorationtools(e.g.,modelcheckers[2(cid:150)4]),ObjectConstraint
Language (OCL) [5] type-checking tools, and tools that utilize well-de(cid:30)ned semantic relationships
across the views of a UML model (e.g., Rational Rose) to check consistency of informationacross
theviews.SemanticsthatsupportthecreationofexecutableUMLmodelspavethewayfordynamic
analysesofmodels.DynamicanalysisofUMLmodelsisconcernedwithtestingmodelledbehaviours
by executingmodels using appropriateforms of test inputs. In this paper,a techniquethat supports
testingofexecutableformsofUMLmodelsispresented.
SystematictestingtechniquesforUMLdesignsneedtoaddressatleastthefollowingconcerns:
(cid:128) Developmentof a semanticsthat supportscreationof executablemodels. A systematic model
testing technique requires a semantics that supports execution of the models. Currently, the
semanticsoftheUMLisinformallydescribedintheOMGstandarddocument[1].Executable
forms of the UML are beginningto emerge (e.g., see work on Executable UML [6], and the
UML Virtual Machine [7]). These works indicate that one can associate formal semantics to
UMLbehaviouralelementsthatsupporttheexecutionofUMLmodels.
(cid:128) Developmentofcriteriathatdeterminetheadequacyoftests.Theeffectivenessofatestisbased
onhowwellthetestscoverandexercisethemodelledbehaviours.Incodetesting,criteriabased
oncoverageofthebuildingblocksofprogramscanbeusedtodeterminetheadequacyoftests.
SimilarcriteriaforUMLmodelscanbeusedtoguidetheselectionoftestcases.
InthispaperasystematictechniquefortestingexecutableformsofUMLdesignmodelsisdescribed.
ThetechniqueutilizestestcriteriaexpressedintermsofUMLmodelelementcoverage.Theremainder
ofthepaperis organizedas follows.Theconceptsunderlyingthetestingtechnique,theelementsof
the executableformsof UML modelsand related work on UML testing are presentedin Section 2.
In Section 3, an overviewof the techniquefor testing UML designs is given.Test criteria based on
elementsinUMLmodelsaredescribedinSection4.Asystematictestingapproachusingtheproposed
criteriaisdescribedinSection5.AnexampleillustratingthecreationoftestcasesisgiveninSection6.
A preliminary evaluation of the criteria in terms of the types of faults they target is described in
Section 7. Conclusions and directions for future work are presented in Section 8. For readers less
familiarwithUMLterminology,de(cid:30)nitionsofcommonUMLtermsbasedonthemostrecentstandard
de(cid:30)nition[8]arequotedinAppendixA.
2. BACKGROUND
Testingexecutableformsofmodelsisanalogoustoprogramtesting.Ingeneral,testinganexecutable
softwareartifact(programorexecutabledesignmodel)involves(1)thecreationoftestcases,(2)the
executionoftheartifactusingthetestcases,and(3)theanalysisoftestresultstodeterminecorrectness
ofthetestedbehaviour.Inthissection,thebasictestingconceptsthatunderlythiswork,andtheUML
elementsusedtobuildtestableUMLdesignsaredescribed.Thesectionconcludeswithanoverview
ofrelatedworkonUMLtesting.
Copyright(cid:2)c 2003JohnWiley&Sons,Ltd. Softw.Test.Verif.Reliab.2003;13:95(cid:150)127
TESTADEQUACYCRITERIAFORUMLDESIGNMODELS 97
2.1. Softwaretestingconcepts
Atestcaseisasequenceofinputsthatdeterminesthebehavioursthatwillbetested(e.g.,asequence
of program input data or a sequence of events for a state machine design model), along with the
expectedbehaviour.Atestcaseissuccessfuliftheobservedbehaviourmatchestheexpectedbehaviour;
otherwise, the test fails. Success can be determined with the help of an oracle that compares the
observed behaviour with the expected (correct) behaviour. A test set is a set of one or more test
cases.
Atestadequacycriterionisapredicatethatde(cid:30)nespropertiesthatmustbecoveredifthetestistobe
consideredadequatewithrespecttothecriterion[9].Teststhatareadequatewithrespecttoacriterion
cover all the elements in the domain determined by the criterion. Test criteria help in de(cid:30)ning test
objectivesorgoalsthataretobeachievedwhileperformingsoftwaretesting.Costconsiderationsand
availableresourcesoftendeterminetheselectionofonecriterionoveranother.Testcriteriacanalsobe
usedtodeterminewhentestingshouldstop:testingcanstopwhenteststhatsatisfyallthecriteriahave
beencarriedoutsuccessfully.
Theapproachtode(cid:30)ningtestcriteriaforUMLmodelsisbasedonthecategory-partitiontesting[10]
approachdevelopedforcode.Thecategorypartitioningapproachutilizesaprogram(cid:146)sspeci(cid:30)cationto
(1)identifyseparatelytestablefunctionalunits,(2)categorizetheinputsforeachfunctionalunit,and
(3)partitiontheinputcategoriesintoequivalenceclasses.OffuttandIrvine[11]showthatthecategory
partitioning technique is effective at detecting faults that involve implicit functions, inheritance,
initialization and encapsulation when applied to OO software. In this work, a variant of category-
partitioningisusedtocategorizeandpartitionobjectcon(cid:30)gurationsspeci(cid:30)edbyUMLclassdiagrams.
Design-leveltestcriteriadeterminethecon(cid:30)gurationsthatmustbecoveredinanadequatedesign-level
test.
TheapproachalsousesavariantofthemethodsequenceorientedapproachesdescribedintheOO
code testing literature. Class testing techniques [12] provide for executing sequences of methods,
and for varying the order of methods in the sequences. At the end of a sequence, the tester or the
test environment veri(cid:30)es whether the resulting states of the objects involved are correct [13(cid:150)15].
These method sequence oriented approaches are useful to consider adapting for those parts of the
UMLdescriptionsthatdeal withsequencesofobjectstates. Thecombiningofcategorypartitioning
withthemethodsequenceorientedtechniqueresultsinanapproachthatinvolvesmorethanjustuseof
graph-basedcriteria.
2.2. UMLmodellingconcepts
The UML model testing approach described in this paper utilizes requirements and design models.
A UML RequirementsModel is usedto developthe oraclesfor designmodeltests. A requirements
model consists of a conceptual model (i.e. a requirements class diagram) and a set of use cases.
Aconceptualmodeldepictstheproblemconceptsandtheirrelationshipstoeachother.Eachusecase
speci(cid:30)esarequiredbehaviourintermsofapre-conditionthatstateswhatmustbetruebeforeexecution
ifthebehaviouristohavetheeffectspeci(cid:30)edinthepost-condition.Thepre-andpost-conditionina
usecasearede(cid:30)nedintermsofconceptsde(cid:30)nedintheconceptualmodeloftheRequirementsModel.
The design model consists of (1) a design class diagram (DCD) that speci(cid:30)es the valid object
structures(con(cid:30)gurations)thatcanexistinanexecutingsystem,(2)anactivitydiagramforeachclass
Copyright(cid:2)c 2003JohnWiley&Sons,Ltd. Softw.Test.Verif.Reliab.2003;13:95(cid:150)127
98 A.ANDREWSETAL.
CM-Book
title
author
bookType
1
describes
*
CM-Library Member 0..1 * CM-Copy
copyID
borrID
status
borrower loan copy
Borrows
dueDate
borrowDate
Figure1.Conceptualmodelforasimplelibrarysystem.
that describes the behaviour of class objects, and (3) interaction diagrams that model how objects
collaborateinordertoaccomplishrequiredbehaviours.
2.2.1. Requirementsmodelartifacts
The conceptual model used in this approach consists of (1) classes that represent problem
concepts, (2) associations that model semantic relationships between problem concepts, and
(3) specialization relationships between problem concepts. Class properties are represented by
attributes and associations. Conceptual model classes do not have operations. An example of a
conceptualmodelforasimplelibrarysystemisshowninFigure1.Alibrarymember(instanceofCM-
LibraryMember)canhavezeroormorecopies(instancesofCM-Copy)checkedoutatanytime,while
acopycanbecheckedoutbyatmostonelibrarymember.Theborrowrelationshipbetweenalibrary
memberandacopyisassociatedwithinformationabouttheduedateandborrowdate.Eachcopymust
beassociatedwithabook(instanceofCM-Book)thatcontainsinformationaboutthebook(cid:146)sauthor,
title,andalsoindicatesthebooktype(forthissimpleexample,abookcaneitherbeageneralbookthat
canbecheckedoutorareferencebookthatcannotbecheckedout).
Use cases specify required behaviours. Figure 2 contains two use cases for the library system,
one specifying the behaviour of a successful copy checkout, the other specifying the behaviour of
anunsuccessfulcheckout.
Copyright(cid:2)c 2003JohnWiley&Sons,Ltd. Softw.Test.Verif.Reliab.2003;13:95(cid:150)127
TESTADEQUACYCRITERIAFORUMLDESIGNMODELS 99
«requirement» «requirement»
USE CASE: Successful Check out Copy USE CASE: Unsuccessful Check out Copy
OVERVIEW: This Use Case specifies the behavior of a OVERVIEW: This Use Case specifies the
successful copy check out. behavior of an unsuccessful copy check out.
INPUTS: BORROWERID bid; COPYID cid; DATE currdate INPUTS: BORROWERID bid; COPYID cid; DATE currdate
OCL Definitions (these definitions are used in the pre- and post- OCL Definitions (these definitions are used in the pre- and post-
condition sections of the Use Case): condition sections of the Use Case):
{let loancopy:Copy = copy->select(copyID=cid) {let loancopy:Copy = copy->select(copyID=cid)
let borrower:Library Member = let borrower:Library Member =
library Member->select(borrID=bid)} library Member->select(borrID=bid)}
PRECONDITION: PRECONDITION:
Overview: cid must identify an available copy Overview: cid does not exist, or has been checked or is a copy
of a general book (i.e., a book whose copies can be checked out) of a reference book, or bid does not identify a valid library member.
and bid must identify a library member.
OCL constraint:
OCL constraint: { loancopy->isEmpty() or borrower->isEmpty() or
{ loancopy->notEmpty() and borrower->notEmpty and ( loancopy->notEmpty() and (loancopy.status="checkedout" or
loancopy.status="available" and loancopy.book.bookType="reference")) }
loancopy.book.bookType="general" }
POSTCONDITION:
POSTCONDITION: Overview: The library system is unchanged.
Overview: a link is created between the copy and the library member
the due date is set (14 days from current date) and the borrow date OCL constraint:
is set to the current date. { library member=library Member@pre and copy=copy@pre and
book=book@pre and
OCL constraint: copy.book=copy.book@pre and book.copy=book.copy@pre and
{ borrower.borrows->including(b) and b.IclIsNew() and library Member.copy=library Member.copy@pre and
b.dueDate=currdate+14 and b.borrDate=currdate and copy.library Member=copy.library Member@pre }
loancopy.status="checkedout"}
Figure2.Usecasesforcheckingoutacopy.
2.2.2. Designmodelartifacts
A system is modelled as a collection of state machines that communicate asynchronously.
Three diagrams are used to describe different views of a system model: a DCD depicts the design
classes andtheirrelationships,an activitydiagram(cid:135) describesthe behaviourofclass objects,andan
interactiondiagramdescribestheintra-objectcommunications.AdesignmodelconsistsofaDCD,an
activitydiagramforeachclass intheDCD, anda setofinteractiondiagramsthatpresenttheobject
interactionviewofthesystem.
AnexampleofaDCDthatshowspartofadesignforthesimplelibrarysystemisshowninFigure3.
The class Library Member is intended to realize the CM-Library Member concept (see Figure 1),
Copyis intendedtorealizetheCM-Copyconcept,whiletheclassBorrows isintendedtorealizethe
conceptualmodelassociationclass Borrows.Theotherclasses intheDCDrepresentdesignobjects,
thatis,objectsintroducedtosupportaparticularimplementationofthesystem.Inthiscase,aSystem
(cid:135)Anactivitydiagramisastatemachineinwhichactionstakeplaceinthestates.
Copyright(cid:2)c 2003JohnWiley&Sons,Ltd. Softw.Test.Verif.Reliab.2003;13:95(cid:150)127
100 A.ANDREWSETAL.
System Controller Book
-title : String
+checkout(in copyid : String, in borrid : String, in currdate : Date) -author : String
+createException(in errcode : Integer) 1 * -bookType : String
+borrowCheck() +getBookType() : String
1 1 1
1 1 describes
Member Manager Copy Manager
c-manages
+findMember(in borrid : String) : Library Member +findCopy(in copyid : String) : Copy
1 1 1
+borrowCheck(in copyid : String, in borrid : String) +validateCopy(in copyid : String)
1
m-manages
* *
* Copy
-copyID : String
Library Member borrower loan record Borrows loan record loan copy -status
-borrid : String -dueDate : Date +getStatus() : String
-borrowDate : Date +getBookType() : String
+borrowUpdate(in borrinfo : Borrows) 1 * 0..1 1 +checkoutCopy() : Boolean
+validateCopy()
+copyUpdate(in borrinfo : Borrows)
Figure3.PartialDCDforthelibrarysystem.
Controllerobjectacceptsrequestsforlibraryservicesanddirectsthemtoappropriatemanagerobjects
for handling.The two managerclasses shownin Figure3 are Member Manager (performsmember
managementfunctionssuchascheckingoutacopyforamember)andCopyManager(performscopy
managementfunctionssuchascheckingtheavailabilityofacopy).
EachclassinaDCDisassociatedwithanactivitydiagramthatdescribesthebehaviourofobjects
intheclass.PartialactivitydiagramsfortheSystemControllerandtheMemberManagerclassesare
showninFigures4and5,respectively.
An activity diagram consists of states and transitions. The following are the types of states and
transitionsthatcanbefoundintheactivitydiagramsusedintheproposedtestingapproach.
(cid:128) Actionstates:astateinwhichactionsareperformediscalledanactionstate.Actionstatesare
associatedwithonlyoneactionintheactivitydiagramsusedinthiswork.Anactioninanaction
statecanbeoneofthefollowing:
— Anassignmentoftheformelement:=expression,whereelementcanbealocalvariable,
oranattribute,andexpressioncanbeavalueoracalltoavalue-returningprocedureora
constructor(valuereturnedisareferencetothenewobject).Forexample,inFigure4the
actionstatewiththeaction
borrinfo:=create::Borrows(currdate+14,currdate)
Copyright(cid:2)c 2003JohnWiley&Sons,Ltd. Softw.Test.Verif.Reliab.2003;13:95(cid:150)127
TESTADEQUACYCRITERIAFORUMLDESIGNMODELS 101
Active
checkout(copyid,borrid,currdate)
returnCopy(copyid)
send members.borrowCheck(copyid, borrid)
Wait
reference nocopy nomember notAvailable isvalid(loancopy,member)
send client.exception(" Not Available")
send client.exception("No Copy")
send client.exception("Reference Copy") send client.exception("Not a Member") borrinfo:=create::Borrows(currdate+14,currdate)
send member.borrowUpdate(borrinfo)
send loancopy.copyUpdate(borrinfo)
Figure4.Partialactivitydiagramforthesystemcontroller.
assignsanewlycreatedBorrowsobjecttothevariableborrinfo.Localvariablesaresimply
variablesusedtostoreinformationtemporarilyduringtheactivity.Theyarenotattributes
becausetheydonotrepresentpropertiesofobjects.
— Asendactionoftheformsendobject.signal.Asignalisacommunicationbetweenobjects
andcanhavedataassociatedwithit(e.g.,thesignalcheckoutinFigure4hasdatacopyid,
borrid,andcurrdateassociatedwithit).Forexample,inFigure4,enteringtheactionstate
withtheactionsendmembers.borrowCheck(copyid,borrid),resultsinthesendingofthe
borrowCheck(copyid,borrid)signaltothemembersobject.
— A procedure call of the form procedureA(arguments), or a call to a constructor of
the form create :: classname(constructor arguments). Procedures and constructors are
Copyright(cid:2)c 2003JohnWiley&Sons,Ltd. Softw.Test.Verif.Reliab.2003;13:95(cid:150)127
102 A.ANDREWSETAL.
Active
borrowCheck(copyid,borrid) ...
member:=findMember(borrid)
member=null
send libsys.nomember
member<>null
send copies.validateCopy(copyid)
Wait
reference nocopy notAvailable isvalid(loancopy)
send libsys.reference send libsys.nocopy send libsys.notAvailable send libsys.isvalid(member,loancopy)
Figure5.Partialactivitydiagramforthemembermanager.
Copyright(cid:2)c 2003JohnWiley&Sons,Ltd. Softw.Test.Verif.Reliab.2003;13:95(cid:150)127
TESTADEQUACYCRITERIAFORUMLDESIGNMODELS 103
expressedinsomeprogramminglanguage.Javaisusedinthiswork.Anactionstatewith
a procedure or constructor call results in the procedure or constructor being executed.
Execution of a procedure or constructor cannot be interrupted, that is, a transition to
another state can only be made after the procedure or constructor returns. The action
member:=(cid:222)ndMember(borrid)inFigure5resultsinacallto(cid:222)ndMember(),andstoring
ofthereturnvalueinthelocalvariablemember.
(cid:128) Inputsignaltransitions:thesetransitionstakeplacewhentheindicatedsignalsareconsumedby
thestatemachine.Forexample,Figure4showsa transitionfromthestate Activetoanaction
stateasresultofreceivingtheinputsignalcheckout(copyid,borrid,currdate).
Asimplemodelofexecutionforactivitydiagramsisused.Theactioninanactionstateisexecuted
on entry to the state. Each activity diagram has a signal queue for incoming signals. The queue is
checkedwheneverthestatemachinemovesintoanewnon-actionstateoraftertheactioninanaction
stateisperformed.Iftherearesignalsinthequeue,thesignalatthetopofthequeueisconsumed(i.e.
removedfromthequeue)unlessexplicitlydeferred(eachstatecande(cid:30)neasetofsignalstobedeferred;
thosesignalsarenotconsumediftheydonotcauseatransitiontoanotherstate).Iftheactivitydiagram
indicates that the signal causes a transition to another state, then the transition is made; if not, the
machine remains in the current state. A deferred signal moves back to the top of the queue after a
signalhasbeenconsumed.
One can derive the interactions between objects from a set of activity diagrams by tracking the
send actions speci(cid:30)ed in the activity diagrams. This view of a system(cid:146)s behaviour is conveniently
capturedbyinteractiondiagrams.Acollaborationdiagramisaninteractiondiagramthatcharacterizes
howobjectsinteracttoachieveabehaviouralgoal.Sequencediagramsareanotherformofinteraction
diagramsthatcancontainthesameinteractioninformation,butinadifferentformat(e.g.,collaboration
diagramsspecifytheobjectstructureonwhichthebehaviouriscarriedout;suchinformationisimplicit
insequencediagrams).Inthispaper,collaborationdiagramsareusedbecausetheydepictstructureas
wellasinteractions,allowingthedevelopmentofcriteriaintermsofstructuresonwhichbehaviours
areperformed.
Acollaborationdiagramconsistsoftwoparts:acollaborationandaninteraction.Acollaboration
speci(cid:30)estheobjectstructureneededtosupportaparticularbehaviour.Itspeci(cid:30)esthepropertiesthat
objects must have if they are to participatein the behaviour.The speci(cid:30)cations can be expressed in
termsofcollaborationroles,wherearolespeci(cid:30)estheattributesandoperationsofaclassneededfora
particularbehaviour,orintermsofprototypicalobjects.Acollaborationdiagramthatconsistsofroles
iscalledaspeci(cid:222)cation-levelcollaborationdiagram,whileadiagramconsistingofprototypicalobjects
iscalledaninstance-levelcollaborationdiagram.Onecanuseeitherdiagramtospecifycollaborations.
Instance-levelcollaborationdiagramsareusedinthispaper.
An interaction speci(cid:30)es the communications that take place between objects when performinga
speci(cid:30)edbehaviour.Aninteractionis alwaysde(cid:30)nedwithinacollaboration.Communicationstimuli
betweenobjectsarespeci(cid:30)edbymessages.Intheinteractiondiagramsusedinthiswork,amessage
speci(cid:30)esasignalcommunication.AnexampleofacollaborationdiagramisgiveninFigure6.
Intheexample(cid:145)return(cid:146)messagesaredifferentiatedusing(cid:145)halfarrowheads(cid:146).Thisisonlyasyntactic
distinction;allsignalsspeci(cid:30)edbymessagesareasynchronouscommunicationsthatareplacedinthe
signalqueuesofreceivingobjects.Atextualdescriptionofthesignalsequenceforthelibrarycheckout
behaviourisgiveninFigure7.
Copyright(cid:2)c 2003JohnWiley&Sons,Ltd. Softw.Test.Verif.Reliab.2003;13:95(cid:150)127
104 A.ANDREWSETAL.
checkout(copyid:String, borrid:String, currdate:Date)
libsys : Top Package::System Controller
2: member:=findMember(borrid:String) 1: borrow3Cbh[ecmke(9cma/obpe15ry0bBi/=ad92:An:: b i/u1Snls:tl1 ]orv:it0n anlboAni:gc v,odr (aoleibmplfooeyaearrbrnmilecdben:oecrSpteyr,inmge)mbe1r2:) borrowUpdate(borrinfo:Borrowsb)orrinfo : Top Pac10a/11 :crekated(ueDaetD:aate, currdaetD:gate)e::Borrows 1:3 copyUpdateb(orirnfo:Borrow
members : Top Package::Member Manager s)
3a[m
e
m
b
8a/9a: isvalid(8blo/a9nbc: orpe7ybf)e/rBe1n: c5nebo[ltoAanvacileaoprb<y>le=nnuullll]]:: v naolicdoapteyCopy(copyid:String) member : ToMpe Pmabcekrage::Li5bar7[albor[asy7tna7=/ca"8o/cb8ph[ayeb[<tcb=>kt"=ner"uedglfloee]u:r nte"ve]an:r lcainled"o"]at]:t: Ai ersvCevafioaellipradyebl(n)ece loanc5oap/y6 :: Tsto:=pg PeaotokTSypce)(ktaatgues:(:)Copy
B
et
g
copies : Top Package::Copy Manager ble"]: b:t=
vaila
3a/4: loancopy:=findCopy(copyid:String) a[st="a
7
bk : Top Package::Book
Figure6.Anexampleofaninstance-levelcollaborationdiagram.
Copyright(cid:2)c 2003JohnWiley&Sons,Ltd. Softw.Test.Verif.Reliab.2003;13:95(cid:150)127