The B method is a model-based approach covering all the software development process, from the specification to the code. External verification of B models aims to determine whether they correctly capture the informal requirements. It is argued that verification techniques like B model animation or code testing should accompany the formal development process and give a feedback of the system that is actually being specified. A uniform testing framework, irrespective of whether the input cases are executed on the final code or on the formal models, is presented. A B development process is considered as a series of stages where concrete models are built gradually based on the more abstract ones, the final code being just a compiled version of the most concrete model. A definition of test correctness, related to the one of refinement, is introduced. The consequences in terms of required animation facilities are discussed.

Abstract. Test criteria are defined in order to guide the selection of subsets of the input domain to be covered during testing. A unification of two categories of test criteria, program based and specification based, i s presented. Such a unification is possible for B models because the specification, refinement concepts and implementation are captured in one notation. The notion of control flow graph is extended to handle the abstract constructs of the generalized substitution language, and a link between the coverage of the graph and the coverage of the before-after predicate i s established. A set of criteria for the coverage of the control flow graph i s proposed. These criteria are partially ordered according to their stringency, so that the coverage strategy may be tuned according to the complexity of the operation under test. IntroductionTesting is a partial verification technique that consists in exercising a target piece of software by supplying it with a sample of input values. Since exhaustive testing is generally not tractable, the tester is faced with the problem of selecting a proper subset of the input domain. The selection is guided by test criteria that specify a set of elements to be covered during testing. This paper focuses on the definition of test criteria for B models. It extends previous work establishing a validation framework for the B development process [13]. The aim is to track down specification faults originating from a misunderstanding of the functional requirements, or from the failure to adequately express an understood requirement. The B formal development process can be seen as a series of stages where more and more concrete models of the application are built, the final code being just a compiled version of the most concrete one. In order to validate these models, we have defined a uniform testing framework, irrespective of the development stage and of whether the test inputs are supplied to the final code or to the formal models [13]. Within the uniform framework, we wish to be equipped with coverage criteria that can be applied not only to the most abstract model (i.e. before refinement), but also to any intermediate model obtained during development. This must be so because, in typical B projects, the smallest meaningful model with respect to the functional requirements is likely to involve a few steps of refinement (see e.g. the modeling approach adopted