On testing output faults in the McCluskey Fault Model

ULRIKEBRANDT

Technische Universität Darmstadt e-mail:brandt@informatik.tu-darmstadt.de

and

HERMANNK.-G. WALTER

Technische Universität Darmstadt e-mail:walter@informatik.tu-darmstadt.de

ABSTRACT

McCluskey et al. introduced a very general fault model for finite automata. In this paper we will show that all testable output faults can be tested by a single input word in this model. Furthermore, in the case of irreducible automata we will show that this is true for all output faults. Our main tool to prove the results is a careful analysis of the structure of automata especially considering subautomata and edge-(state)traverses of the transition graph induced by input words.

Keywords:finite automata, faults, testability, subautomata, irreducible automata, traverses

0. Introduction

In [1], [4] and following papers McCluskey et al. developed a very general fault model for finite automata. A fault of an automatonAis any different automaton with the same inputs, outputs and states. They considered various classes of faults and gave algorithms for calcu- lating test sets, i.e. sets of input words so that the resulting outputs indicate whether a fault is present or not. Testing a fault can be done assuming that the automaton always starts with the same state (testability) or in (possibly) different states (strong testability). The latter one is closely related to the structure of the given automaton. This is also true for output faults – faults which affect only the output-unit. An output fault has the same transitions as the given automaton. We can show that for a given automaton the class of all its strongly testable output faults can be tested by a single word. Fault diagnosis is connected to experiments on automata first studied by Moore [3]. Though faults are not mentioned one can find a few remarks in [2] touching on this connection. Moreover, McCluskey et al. put some emphasis on reset mechanisms, though they are not part of the automaton and operate faultfree. In con- nection with traverses of edges respectively states we will make heavy use of resets. But we do not assume that they are an additional faultfree part of the automaton under consideration.

1. Basic Notations and Definitions

Analphabet Xis a finite set ofletters. The set ofwords(overX) is the free monoidX^∗over Xwith theemptywordas identity. Ifw=x1. . .xn(x_i∈X for 1≤i≤n)thelengthofwis

|w|=n. ForL_1,2⊆X^∗thecomplex productis defined byL₁L₂={w₁w₂|w₁∈L₁and w₂∈ L₂}. We use the usual convention for singletons in identifyingwwith {w}, if no confusion is possible.X^∗can be partially ordered by theprefixrelation defined by

w≤v(pref)⇐⇒v∈wX^∗.

Definition 1.1 A(Mealy-)automatonis a quadruple A= (I,S,O,δ,λ)where

• I and O are alphabets(inputsrespectivelyoutputs)

• S is a finite set(states)

• δ:I×S→S andλ:I×S→O are thetransitionandoutputfunctions respectively.

We extendδ andλ to words by the formulas below, wherew,v∈I^∗,s∈S δ(,s) =s,δ(wv,s) =δ(v,δ(w,s)) (transitionformula) and λ(,s) =,λ(wv,s) =λ(w,s)λ(v,δ(w,s)) (responseformula).

For letters these extensions are the givenδ andλ. Fixings∈Sas a starting state we define the(realized)functionλ^s(w) =λ(w,s)forw∈I^∗. Note that|λ^s(w)|=|w|always holds. An automatonAisminimalif and only if

∀s,s⁰∈S:λ^s=λ^s

0⇒s=s⁰.

For two automataAandA⁰withI=I⁰andO=O⁰a mappingφ:S→S⁰is ahomomorphism if and only if

∀x∈I,s∈S:δ⁰(x,φ(s)) =φ(δ(x,s))andλ⁰(x,φ(s)) =λ(x,s).

If a homomorphismφis given, it is easy to prove thatλ^s=λ^0φ(s)for alls∈S. A bijectiveφ is anisomorphismand we writeA=eA⁰orA=e_φA⁰. Note thatφ⁻¹is also an isomorphism.

Another model for a device with finite memory is theMoore-automaton; it is a Mealy- automaton where the output function is given by

λ(x,s) =µ(δ(x,s)) (x∈I,s∈S)

with a functionµ:S→O(marking). Our constructions will considerably simplify, if we use Moore-automata. This will be discussed at the proper places.

In the following we will fixIandOand denote the collection of all automata with state setS byAutom(S). A fault for A∈Autom(S)is anyA_f ∈Autom(S) withA_f 6=A. By symmetryAis then a fault ofA_f. We use the subscript “_f” to denote the fault automaton.

We shall discuss two forms of testability. In the weaker one the test is started with the same initial state for both automata. In the stronger form they may start in different states.

Definition 1.2 Let A,Af ∈Autom(S)and s∈S.

• A_f is s-testable (for A) ifλ^s6=λ^s_f.

• A_f is strongly s-testable (for A) ifλ^s6=λ^s

0

f for all s⁰∈S.

We extend this definition to subsetsS⁰⊆Sby callingA_f (strongly)S⁰-testable(forA) ifA_f is (strongly) s-testable for everys∈S⁰.A_f is (strongly)testableforAif it is (strongly)S-testable forA.

Note that in the case #(O) =1 noA_f is testable on nonemptyS⁰. We assume for the following

#(O)>1. Strong testability respects isomorphisms in the sense thatA_f is not strongly testable on any nonempty subset ofSifA_f =e A. This is not true for testability. Fig. 1.1 shows such a pair of isomorphic automata which are both testable for each other. In this situation testability depends on the isomorphism.

Figure 1.1 Isomorphisms and faults

Observation 1.3 Let A,A_f ∈Autom(S)with A=eA_f and A minimal. A_f is testable for A if and only if there exists an isomorphismφwith A_f =e_φA andφ(s)6=s for all s∈S, i.e.φmust be free of fixpoints.

Proof. If s∈S exists with φ(s) =s then λ^s=λ^s_f and A_f is nots-testable. Conversely, suppose there existss∈Swithλ^s_f =λ^s. We knowλ^φ(s)=λ^s_f, henceλ^s=λ^φ(s). SinceAis minimals=φ(s)and we find a fixpoint – a contradiction. 2 The second extension of our definitions deals with fault classes. For a givenA∈Autom(S) afault classF(forA) is a subset ofAutom(S)withA∈/F. Such fault classes are mainly derived from a common schema of automata – both for Mealy- and Moore-type presented in fig. 1.2. Typical faults can affect the logical units Transition and Output, the Memory and the connections between these components.

Figure 1.2 Basic structure of automata, Mealy: dotted line, Moore: hollow line

We get for example Fout(A) =

A_f ∈Autom(S)|δ =δf andλ6=λf as the class of output faults. For a Moore-automaton A we can single out Fmout = {A_f ∈

Fout|A_f is a Moore-automaton}. Note that an output faultA_f of a Moore-automaton does not need to be a Moore-automaton.

ForS⁰⊆Ssuch a fault classFis (strongly)S⁰-testable(forA) if everyA_f∈Fis (strongly) S⁰-testable. IfFis (strongly)S-testable thenFis (strongly)testableforA.

We turn our interest to fault-testing. ConsiderA∈Autom(S),S⁰⊆Sand a fault classFof A. A setT⊆I^∗is aS⁰-testforAandF if and only if

∀A_f ∈F,s ∈S⁰,λ^s6=λ^s_f ∃w∈T :λ^s(w)6=λ^s_f(w)

SinceAutom(S),IandOare all finite sets a finiteS⁰-testT always exists for a givenAand F. Note, thatF need not beS⁰-testable.T is astrong S⁰-testforAandFif and only if

∀A_f ∈F,s∈S,s⁰∈S⁰∃w∈T:λ^s

0(w)6=λ^s_f(w).

In this case, a strong (finite)S⁰-test exists if and only ifF is stronglyS⁰-testable forA. A strongS⁰-test is always aS⁰-test. As before,T is a (strong)test(forAandF) if and only if Tis a (strong)S-test. In connection with tests the following fact is fundamental.

Observation 1.4 If A, A_f ∈Autom(S)and s, s⁰∈ S then for all v, w∈I^∗ λ^s(vw) =λ^s

0

f (vw)⇔(λ^s(v) =λ^s

0

f(v)andλ^δ(v,s)(w) =λ^δf(v,s

0) f (w)).

Proof. By the response formula we know λ(vw,s) =λ^s(v)λ^δ(v,s)(w)andλ^s

0

f (vw) =λ^s

0

f (v)λ^δf(v,s

0)

f (w).

Ifλ^s(vw) =λ^s_f⁰(vw)thenλ^s(v) =λ^s_f⁰(v),since|λ^s(v)|=|λ_f^s0(v)|.But then by cancellation λ^δ(v,s)(w) =λ^δf(v,s

0)

f (w) 2

For example, we directly obtain from this fact, that(T\w)∪ ww⁰is a (strong)S⁰-test for any (strong)S⁰-testT,w⁰∈ I^∗andw∈ T .

Example 1.5 (reset automata) Consider an alphabet X andB={0,1}. The (letter-)reset automaton Res_X= (X,X,B,δ,λ)is given by

δ(x,y) =xandλ(x,y) =δδδx,y (δδδ: Kronecker symbol) (x,y∈X).

The fault class is given in the following way. Consider a mappingσ:X →X. Then define Res_σ,X = (X,X,B,δσ,λ)withδσ(x,y) =σ(x)(x,y∈X) leavingλ unchanged. The fault class is under consideration the collection of all these automata whereσ is not the identity onX. This fault class includes quite typical faults considering fig. 1.2. For example some of the register cells may be stuck at a certain value. Note that cuts in the connections may also cause such faults.

Now for a given faultA_f =Res_σ,X we use input words of the formw=xx(x∈X). We get for ally∈X:λ(xx,y) =δδδx,y1 andλf(xx,y) =δδδx,yδδδ_x,σ(x). Sinceσis not the identity on Xax∈X exists withσ(x)6=x. But nowxxtests this fault. This shows that{xx|x∈X}is a test for Res_X and this fault class. Moreover, it is a strong test. In the next section we shall

prove that this fact is true in a more general setting, where the automaton Res_Xserves as an

example.

Our second example deals with a more refined look at faults.

Example 1.6 (switching circuits) We consider realizations of automata by switching circuits.

If we follow the standard schema for automata, the transition and output unit are usually realized by switching circuits without feedbacks. To do this we need a binary encoding of all three sets – inputs, outputs and states. Then transition and output become boolean functions which can be realized by switching circuits without feedbacks. We make free use of a basic system of gates containing the boolean functionsx·y(AND),x+y(OR),x⊕y(EXOR) and their complementationsx·^cy(NAND),x+^cy(NOR) andx⊕^cy(NEXOR). Now consider a four letter alphabetX={a,b,c,d}and Res_X. Encoding of the letters is given by

a b c d

00 01 10 11.

If we use the encodingsx₁x₂ for the letter xands₁s₂for the state swe see the output z= (x₁⊕s₁) +^c(x₂⊕s₂). The reader should bear in mind that EXOR tests for inequality of bits. The corresponding switching circuit is shown in fig. 1.3 together with three faults – a cut, a contact and their combination.

Figure 1.3 Fault testing

We assume that the hardware implementation of this circuit results for the cut in a stuck- at-0-fault and for the contact in an additional OR-gate. The resulting output functions in the presence of these faults are

z_Cut=x₂⊕^cs₂,z_Contact= (x₁⊕(x₂+s₁)) +^c(s₂⊕(x₂+s₁)),z_Comb= (x₂+s₁)⊕^cs₂. Decoding yields for example

λ_Cut(x,s) = (δδδx,a+δδδx,c)·(δδδa,s+δδδc,s) + δδδ_x,b+δδδ_x,d

· δδδ_b,s+δδδ_d,s .

The following table summarizes the values for all possible inputs.

Output patternz z_cut z_contactz_comb

a b c d

a 1111 0000 0101 0000 b 0000 1101 0000 0111 c 0100 0000 1100 0000 d 0001 0101 0011 1111

Inspection of this table yields possible tests for these faults together with the corresponding tests for the faulty automation, as shown in the next table.

Fault tests

Cut Contact Comb

00 10ca 01 01bb 00 11da 01 11db 10 10cc 01 11db 10 00ac 10 11dc 10 00ac 11 01bd 11 01bd 10 10cc 10 11dc 11 01bd

The test 1101 is the only test for all three faults. It corresponds to the inputbd, i.e. first the inputbsends Res_xto the state b and then use the inputdfor fault detection.

2. Subautomata and Testability

In dealing with testability it is quite reasonable to study for an automatonA∈Autom(S)and a faultA_f the setnontest(A,A_f) ={s∈S| ∃s⁰∈S:λ^s=λ_f^s0}.

Observation 2.1 For any two automata A,A_f ∈Autom(S):

∀x∈I:s∈nontest(A,A_f)⇒δ(x,s)∈nontest(A,A_f).

Proof. Lets,s⁰∈Swithλ^s=λ^s

0

f. Applying fact 1.6 forx∈ Iandw∈ I^∗we find λ^δ(x,s)=λ^δf(x,s

0)

f , i.e.δ(x,s)∈nontest(A,A_f). 2

Definition 2.2 Let S⁰ ⊆S,A∈Autom(S) and A⁰∈Autom(S⁰). A⁰ is a subautomaton of A(A⁰∈sub(A))if and only ifδ⁰(x,s) =δ(x,s)andλ⁰(x,s) =λ(x,s)for all x∈I and s∈S⁰. IfA⁰∈sub(A)then for anyx∈I ands∈S⁰:δ(x,s)∈S⁰. Conversely, ifS⁰⊆S satisfies this condition then a subautomaton with state setS⁰ is defined by the restriction ofδ and λ toI×S⁰. Therefore we do not distinguish subautomata and subsets ofS satisfying this condition. In this way we get∅,S∈sub(A). By obs. 2.1nontest(A,A_f)∈sub(A)for all

A,A_f ∈Autom(S). There are some canonical subautomata ofA∈Autom(S). To anys∈S we can consider

reach(s,A) ={δ(w,s)|w∈I^∗}.

By the transition formula for anyx∈Iands⁰=δ(w,s):δ(x,s⁰) =δ(x,δ(w,s)) =δ(wx,s).

This provesreach(s,A)∈sub(A). reach is a consistent monotonic operation, that means s∈reach(s,A)andreach(δ(w,s),A)⊆reach(s,A)for alls∈S andw∈I^∗. We want to apply obs. 2.1 to automata which have no nontrivial subautomata.

Definition 2.3 A∈Autom(S)isirreducibleif and only ifreach(s,A) =A for all s∈S.

Equivalently, an automatonA∈Autom(S) is irreducible if and only if a function reset: S×S→I^∗exists with:δ(reset(s,s⁰),s) =s⁰for alls,s⁰∈S.

IfSis a singleton or empty thenAis always irreducible. The automata Res_Xare irreducible with the functionreset(y,y⁰) =y⁰(y,y⁰∈X).

Another way to define irreducibility is given by the following

Observation 2.4 A∈Autom(S)is irreducible if and only if for all S⁰∈sub(A):S⁰6=/0⇒ S⁰=S.

Lemma 2.5 If A∈Autom(S)is minimal and irreducible then A_f ∈Autom(S)is strongly testable for A if and only if A6=eA_f.

Proof. SupposeA6=e A_f andA_f is not strongly testable forA. But thennontest(A,A_f)6=∅ and therefore by Observation 2.4: nontest(A,A_f) =S. By symmetrynontest(A_f,A)6=∅, too. Defineψ:nontest(A_f,A)→S byψ(s⁰) =swith λ^s_f⁰ =λ^s. SinceA is minimal ψ is well-defined. SinceS=nontest(A,A_f),ψ is surjective, and therefore ψ is a bijection.

By thisnontest(A_f,A) =S. Moreover,ψ is obviously a homomorphism. In totalψ is an isomorphism and we get a contradiction. The reverse direction is trivial. 2 For an automatonAthe irreducible subautomata play an important role. We introduce

bottom(A) ={s∈S| ∀s⁰∈reach(A,s):s∈reach(A,s⁰)}.

IfSis not empty,bottom(A)is also not empty. This can be seen easily by looking at the set system{reach(A,s)|s∈S}. This system is partially ordered by inclusion. SinceSis finite we findbottom(A)as the union of the minimal elements. Clearly,bottom(A)∈sub(A). If A⁰∈sub(A)with state sets, then for alls∈S⁰reach(A,s) =reach(A⁰,s), hencebottom(A⁰)∈ sub(bottom(A)). Moreover, for anys∈bottom(A)reach(A,s)is by definition irreducible.

Conversely, ifA⁰∈sub(A)is irreducible thenA⁰∈sub(bottom(A)).

Observation 2.6 If A∈Autom(S)then there exists a functiondown:S→I^∗with

∀s∈S:δ(down(s),s)∈bottom(A).

Proof. We use induction on #(S). If #(S) =1, A=bottom(A)and the empty word will do.

Let #(S)>1. Ifbottom(A) =Awe can use again the empty word. Supposebottom(A)6=

A. Fix s6∈bottom(A). Thens⁰∈reach(A,s)exists with s6∈reach(A,s⁰). Consider the setS⁰={s⁰∈S|s⁰∈reach(A,s)ands6∈reach(A,s⁰)}then #(S⁰)<#(S), S⁰ is not empty andS⁰ defines a subautomaton A⁰ of A. By induction hypothesis we find for any s⁰∈S⁰ down_A⁰(s⁰)withδ(down_A0(s⁰),s⁰)∈bottom(A⁰)∈sub(bottom(A)). Moreover, for such as⁰ exists a wordw∈I^∗withδ(w,s) =s⁰ and we can definedown_A(s) =wdown_A0(s⁰). Using the transition formula we get

δ(wdown_A0(s⁰),s) =δ(down_A0(s⁰),δ(w,s)) =δ(down_A0(s⁰),s⁰)∈bottom(A). 2 Ifd:S→I^∗satisfies fors∈Sδ(d(s),s)∈bottom(A), then for anyw∈I^∗δ((d(s)w),s)∈ bottom(A).Hence, there are infinitely many choices fordown_A.

Lemma 2.7 Let A,A_f ∈Autom(S), then A_f is strongly testable for A if and only if A_f is stronglybottom(A)-testable for A.

Proof. Considers,s⁰∈S.

IfA_f is stronglybottom(A)-testable forAthere existsw₀∈I^∗with λ^{δ(downA(s,),s)}(w₀)6=λ^{δf(downA(s,),s}

0)

f (w₀).

But then by fact 1.6λ^s(down_A(s)w₀)6=λ^s_f(down_A(s)w₀). 2 We can strengthen obs 2.6 in such a way that the wordsdown_A(s)can be combined to a single word sending all states tobottom(A).

Theorem 2.8 To any A∈Autom(S)there existsdown(A)∈I^∗such that

∀s∈S:δ(down(A),s)∈bottom(A).

Proof. We use adown(s)as in obs. 2.6. Numbering the states ofSfrom 1, . . . ,mwe use the following programming piece to constructdown(A):

down(A):

w:=

fori:=1;i≤m;i=i+1do w:=wdownδ(w,s_i) end for

return w

If 1≤i≤mwe can decomposedown(A) =udownδ(u,s_i)vwith suitableu,v∈I^∗. But then δ(down(A),s_i) =δ(v,δ(down(δ(u,s_i)),δ(u,s_i))).We know

δ(down(δ(u,s_i)),δ(u,s_i))∈bottom(A)

andδ(v,s)∈bottom(A)for alls∈bottom(A). By thisδ(down(A),s_i)∈bottom(A). 2

Example 2.9 Construction ofdown(A). For k > 0 consider the Moore-automataA_kwithI= {a,b},O=B,S_k= [0 .. 2k + 1] andδk,µkdefined by

δk(a,0) =δk(b,0) =δk(b,1) =δk(a,2) =0,

δ_k(a,2i+1) =2(i+1) +1(0≤i<k),δ_k(a,2i) =2(i−1)(1<i≤k),δ_k(a,2k+1) =2k, δ_k(b,2i+1) =2(i−1) +1(0<i≤k),δ_k(b,2i) =2(i+1)(1≤i<k),δ_k(b,2k) =2k+1,

µk(j) =jmod2(j∈S_k).

Clearly,bottom(A_k)has only one state, namely 0. A possibledown_Ais given by down_A(0) =2,down_A(2i+1) =bⁱ⁺¹(0≤i≤k),down_A(2i) =aⁱ⁺¹(1≤i≤k).

Consider the construction in the proof of th. 2.7 starting with state 0. The outcome depends on the choices made during this construction. Choosing the odd numbers first in ascending order and then the even ones in descending order yieldsdown(A)=b^2k+1. Proceeding the other way round - first even, then odd ones - yieldsdown(A)= a^2k+1. We get the following with respect to tests. IfT ⊆I^∗is a strongbottom(A)-test forAand A_f thendown(A)T is a strong test forAandA_f. So the size of the test remains unchanged.

We mentioned above thatbottom(A)is the union of the irreducible subautomata ofA.

With respect to fault testing we refine this observation by introducing thedirect sumof au- tomata.

LetA_1,2∈sub(A)with state setsS_1,2. IfS₁∩S₂=∅andS₁∪S₂=S,Ais thedirect sumof A₁andA₂(A=A₁⊕A₂). The direct sum is associative and commutative and we extend it to finitely manyA_i(1≤i≤k)obtainingA=A₁⊕ · · · ⊕A_kin the usual way.

Lemma 2.10 For any A∈Autom(S)bottom(A) =A₁⊕ · · · ⊕A_kwhere all A_iare irreducible.

Moreover, this decomposition is unique up to permutations of the components.

Proof. We know that any irreducibleA⁰∈sub(A)is of the formA⁰=reach(A,s)for some s∈S. Lets⁰∈S. If there exists s⁰⁰∈reach(A,s)∩reach(A,s⁰), then s∈reach(A,s⁰⁰)⊆ reach(A,s⁰), and therefore by irreducibilityreach(A,s)=reach(A,s⁰)

But then consider a systems₁, . . . ,s_kof states with

• reach(A,s_i)irreducible,reach(A,s_i)∩reach(A,s_j) =∅ (1≤i6= j≤k)and

• ∀s∈S,reach(A,s)irreducible∃1≤i≤k:s∈reach(A,s_i).

Now thereach(A,s_i)constitute the desired decomposition withA_i=reach(A,s_i). 2 3. Edge- and state-traverses

Traversing the transitions is an important tool to study testability and design tests. Such traverses are quite familiar in graph-theory. In our case an additional feature is present. The traverse must be triggered by inputs.

Therefore we define the following two functionsevisit_A: I^∗×S→2^I×Sandsvisit_A:I^∗→ 2^Sby

evisit_A(w,s) ={(x,s⁰)∈I×S

∃u∈I^∗:ux≤w(pre f)andδ(u,s) =s⁰}.

and

svisit_A(w,s) ={s⁰∈S

∃u∈I^∗:u6=,u≤w(pre f)andδ(u,s) =s⁰}(w∈I^∗,s∈S).

Definition 3.1 Let A∈Autom(S), s∈S and w∈I^∗. w is anedge-traversefor s, if evisit_A(w, s) = I×S, and astate-traversefor s, ifsvisit_A(w,s)= S.

We callw∈I^∗anedge-(state-)traverseofAifwis an edge-(state-)traverse for alls∈S.

Clearly, an edge-traverse forsis always a state-traverse fors. If a state-traverse exists,Amust be irreducible.

Example 3.2 We study again the automataA_kfrom ex. 2.8. We calculate δ_k(bⁱ,2i+1) =δ_k(b^k+i,2(k−i+1)) =1(0≤i≤k).

Thenaba^2k+1is a state-traverse for 1,bⁱa^2k+1is a state-traverse for 2i + 1 (i >0) andb^k+i a^2k+1 a state-traverse for 2(k - i + 1)(1≤i ≤k). For 0 no state-traverse exists. Suppose s∈S_kexists such that an edge-traversewfor scan be found. But then both (b, 1) and (a, 2) are elements ofevisit_Ak(w,s). Sinceδ_k(a,0)=δ_k(b,0)= 0 this is impossible. Hence, for no states∈S_k an edge-traverse can be found. Look for example at state 1. Thenevisit_Ak

(a^2kb^2k+1ab,1)= {a,b}×S_k\(a,2).

Lemma 3.3 Let A∈Autom(S), s∈S and w∈I^∗. Then w is an edge-traverse for s if and only ifλ^s(w)6=λ^s_f(w)for all A_f ∈Fout(A).

Proof. Consider Af ∈Fout(A). Then there exists (x,s⁰)∈I×S withλ(x,s⁰)6=λf(x,s⁰).

Sincewis an edge-traverse fors,w=uxvwithδ(u,s) =s⁰. By fact 1.6 we getλ^s(ux)6=λ^s_f(ux) and thenλ^s(w) =λ^s(uxv)6=λ^s_f(uxv) =λ^s_f(w). Hencewis as-test.

Conversly, assumewis not an edge-traverse for s. Then (x,s⁰)∈I×Sexists with (x, s’)

∈/evisit_A(w,s). Consider the faultA_f ∈Fout(A)given byλ_f(x,s⁰⁰) =λ(x,s⁰⁰)ifs⁰⁰6=s⁰and λ_f(x,s⁰)6=λ(x,s⁰)(x∈I,s⁰⁰∈S) (#(O)>1!). Thenλ^s(w) =λ^s_f(w)- a contradiction. Hence

wmust be an edge-traverse fors. 2

We get a lower bound for the length of thosew∈I^∗which are edge-traverses forsonA, because we have to meet every pair(x,s⁰). Ifn=#(X)and #(S) =mthen|w| ≥nm.

With little changes the same result is true for Moore-automataAandFmout(A)and state- traverses.

Lemma 3.4 Let A∈Autom(S)a Moore-automaton, and w∈I^∗. Then w is a state-traverse for s if and only ifλ^s(w)6=λ^s_f for all A_f ∈Fmout(A)

Proof. Consider A_f ∈Fmout(A). Then there exists s⁰ ∈S with µ(s⁰)6=µ_f(s⁰). Since w is a state-traverse for s,w=uxv with δ(ux,s) =s⁰. Note λ(ux,s) =λ(u,s)µ(s⁰)6=

λf(u,s)µ_f(s⁰) =λf(ux,s). Again by fact 1.6λ^s(w)6=λ^s_f(w).

Conversly, assumewis not a state-traverse fors. Thens⁰∈Sexists withs⁰∈/svisit_A(w,s).

Consider the faultA_f ∈Fmout(A)given byµf(s⁰⁰) =µ(s⁰⁰)ifs⁰⁰6=s⁰andµf(s⁰)6=µ(s⁰)(x∈ I,s⁰⁰∈S). Thenλ^s(w) =λ^s_f(w)- a contradiction. Hencewmust be a state-traverse fors. 2

For a state-traversewwe clearly have the lower bound|w| ≥m. Note at this point that turning a Mealy-automaton into an equivalent Moore-automaton changes the character of the fault.

An output fault becomes a transition fault.

Applying the transition formula we get straight forward that for an edge-(state-)traversew ofsand for anyv∈I^∗wvis an edge-(state-)traverse fors, too. Moreover, ifwis an edge- (state-)traverse forAthen for anyu,v∈I^∗uwvis also an edge-(state-)traverse ofA.

The existence of such traverses for irreducible automata is asserted by the following two results where the proofs additionally exhibit algorithms to find these traverses. We start with the easier task determining state-traverses.

Lemma 3.5 For any irreducible A∈Autom(S)a state-traverse for A exists.

Proof. We use a function reset with reset(s,s)6=2 for s∈S associated to (the irre- ducible) A and number the set of states S={s₁, . . . ,s_m}. Consider the word start= reset(s₁,s₂). . .reset(sm−1,s_m). Ifs∈Sandu∈I^∗then the wordureset(δ(u,s),s₁)startis always a state-traverse fors. We obtain a state-traverse ofAby the following programming piece which uses the functionstrav(w) ={s∈S|wis a state-traverse fors}(w∈I^∗)

strav(A):

w :=

trav :=∅

whiletrav⊂Sdo choose(s∈S\trav)

w :=wreset(δ(w,s),s1)start trav :=trav(w)

end while

return w 2

We get the following worst-case estimate for|strav(A)|. Clearly, we can choosereset(s,s⁰) such that|reset(s,s⁰)| ≤m−1. Then|start| ≤(m−1)². Suppose we can eliminate only one state in each turn of the loop then there aremsuch turns. In total|strav(A)| ≤m(m−1)². It is not surprising that this upper bound is independent of the numbers of inputs.

We refine this construction to get an edge-traverse visiting all outgoing edges of a statesif we meetsduring a state-traverse.

Theorem 3.6 For any irreducible A∈Autom(S)there exists an edge-traverse.

Proof. Consider again a functionreset(s,s⁰)forA. Again letS={S₁,_,S_m}furthermore let I={x1, . . . ,x_n}. Define a functionedge:S→I^∗by

edge(s) =x1reset(δ(x₁,s),s). . .reset(δ(x_n−1,s)x_n.

edge(s) traverses all outgoing edges of s if we perform δ(edge(s),s), i.e. for all x∈ I there exists u ∈I^∗ with ux≤ edge(s)(pref). This time consider the word start = edge(s₁)reset(s₁,s₂)edge(s₂)...reset(s_m−1,s_m−2)edge(s_m).

We use the functionetrav(w)= {s∈S |wis an edge-traverse for s} for the following programming piece:

etrav(A):

w:=

etrav=∅

whileetrav⊂Sdo choose(s∈S\etrav) w:=wreset(δ(w,s),s1)start etrav :=etrav(w)

end while return w

2 A worst case estimate can be derived as follows. As before|reset(s,s⁰)| ≤m−1. Then

|edge(s)| ≤(n−1)(m−1) +1, and then

|start| ≤m((n−1)(m−1) +1) + (m−1)m=nm(m−1) +m

In the worst case only one state is eliminated at each turn of the loop. At each turn

|reset(δ(w,s),s₁)start|is added to|w|. Since there aremsuch turns we obtain|strav(A)| ≤ m²(n(m−1) +1).

Example 3.7 (edge- and state-traverses)Consider for n > 0X={x₁, . . . ,x_n}and Res_X. We use the function reset(y,x) =x(x,y∈X). Then the construction given for state-traverses yieldsstart=x2. . .x_nand starting with statex1after the first run of the loopw=x1. . .x_n. Nowtrav(w) =S. Hence, no further loop follows and we obtainstrav(Res_X) =x1. . .x_n. Turning to edge-traverses the construction of th.3.6 gives fors∈S edge(s) =x1sx2. . .sxn. There are n runs of the loop. We obtainetrav(Res_X) =x₁edge(x₁)x₂edge(x₂). . .x_nedge(x_n).

Note that|etrav(Res_X)|=2n².

4. Output faults

We are now in the position to deal with testing output faults. In other words we design tests forA∈Autom(S)andFout(A), respectivelyFmout(A)in caseAis a Moore-automaton.

Theorem 4.1 If A∈Autom(S)is irreducible thenFout(A)is strongly testable for A and any edge-traverse is a test forFout(A)and A. If A is a Moore-automaton, then any state-traverse is a test forFmout(A)and A.

Proof. By th.3.6 an edge-traversewforAexists. By le.3.2Fout(A)is testable andwis a test

forFout(A). 2

Next we consider direct sums of irreducible automata.

Lemma 4.2 If A∈Autom(S)with A=bottom(A)then a w∈I^∗exists such that w is a test for A andFout(A).

Proof. We knowA=A₁⊕· · ·⊕A_kwhereA_i∈Autom(S_i)is irreducible for 1≤i≤k. Choose an edge-traversew_i for any A_i. Letw=w₁. . .w_k. Then w is an edge-traverse forA and allA_i. IfA_f ∈Fout(A)thenbottom(A_f) =A_f. Since δ =δf we get the corresponding decompositionA_f =A_f1⊕ · · · ⊕A_{f k}whereA_i=A_{f i}orA_{f i}∈Fout(A_i) (1≤i≤k). Consider s∈Swithλ^s6=λ_f^sthen for some 1≤i≤k:s∈S_i. In this caseA_{f i}∈Fout(A_i)andwis a test forAi. But thenλ^s(w) =λ_i^s(w)6=λ_{f i}^s(w) =λ_f^s(w). 2 Theorem 4.3 If A∈Autom(S)and A_f ∈Fout(A), then A_f is testable if and only if A_f is bottom(A)-testable. Moreover, a w ∈I^∗ exists, such that w is a test for all testable A_f ∈ Fout(A).

Proof. IfA_f is testable, we know a fortiori thatA_f isbottom(A)-testable.

Conversely, supposeA_f isbottom(A)-testable. Sinceδ =δ_f bottom(A_f)is a testable fault for bottom(A). By le. 4.2 there exists aw_o∈I^∗ (independent of A_f) such that w_o is a test forbottom(A)andbottom(A_f). Butw_ois also a test forbottom(A)andA_f. Letw= down(A)w_o. Usingδ =δ_f, fact 1.6 and the same argument as in the proof of le.3.2 we can show, thatA_f ist testable andwis a test forAandA_f. 2 Example 4.4 (testing output faults)Consider the automataA_kfrom ex. 2.6 whereI= {a, b}.

LetA_f ∈Fmout(A)withµf(0) =1. ThenA_f isbottom(A_k)-testable and anyw∈I^∗\2is abottom(A_k)-test. By th.4.3A_f is testable and in connection with ex. 3.1a^2k+1wis a test forA_f, buta^2k+1alone ist a test forA_f. Ifµ(0) =0,A_f is not testable. Ifw∈I^∗is a test, thenw=xw⁰for x∈Iandw⁰∈I^∗. If x = a, then the fault given byµ_f(2)= 1 cannot be tested, and if x = b the fault given byµ(1) =0 is not testable. Hence, any test forA_f needs at least two testwords. ForA_k ands∈S_k\0 we findevisit_Ak(a^2kb^2kab,1) = (I×S_k)\(a,2).

But thenevisit_Ak (bⁱa^2kb^2kab,2i+1)=evisit_Ak(b^k+ia^2kb^2kab,2(k−i+1))=(I×S_k)\(a,2) (0≤i≤k). Now,T0= {bⁱa^2kb^2kab|0≤i≤k} ∪ {b^k+ia^2kb^2kab|0≤i≤k}is a test for every A_f ∈Fout(A_k)withλ_f(a,2)= 0. ForA_f ∈Fout(A_k)withλ_f(a,2)= 1a^2k+1is a test. In total

T=To∪a^2k+1is a test forA_kandFout(A_k).

References

[1] R. BOUTEand E.J. MCCLUSKEY, “Fault Equivalence in Sequential Machines”, Tech- nical Report No. 5, Computer Systems Laboratory, Stanford University (June 1971) [2] W. BRAUER, “Automatentheorie”, B.G. Teubner, 1984

[3] E. F. MOORE, Gedanken-Experiments on sequential machines, in: C.E. SHANNON, J. MCCARTHY, Automata Studies, Ann. Math. Studies 34, Princeton University Press, Princeton 1956

[4] J.F. POAGEand E.J. MCCLUSKEY, “Derivation of Optimum Test Sequences for Se- quential Machines”, Proc. 5th Ann. Sympos. on Switching Theory and Logical Design, pp. 121-132 (1964).