validator的Symbol Coverage没有100%

        在help文档中有说明。之所以覆盖率无法到达100%，是因为validator用来测试的默认变量值很简陋。系统的有些分支并没有被遍历到。只需要在validator界面走遍控制栏里面设置变量值就可以了。同一个信号、变量的值可以有多个。

看Validating a SDL System这一章

Handling Low Symbol Coverage

If the symbol coverage after an exploration is 100%, all parts of the system have been executed at least once. If the symbol coverage is less than 100%, the possible reasons why parts of the state space have not been reached are listed below.

• The exploration was manually stopped before all symbols were reached.

  In this simple case, you should continue the exploration until it finishes by itself.

• The test values were inappropriate.

  Test values are used to define the set of possible signals from the environment. The automatically generated test values may not suit all SDL systems. This may for example cause the execution to never execute one branch of a decision statement. To overcome this problem, redefine the test values for the appropriate signal parameter. For more information on test values, see "Defining Signals from the Environment" .

• The exploration was pruned after a report.

  In most cases the Validator will prune the exploration of a particular path as soon as a report has been found, i.e., the exploration will not continue beneath the state in question. If you have examined such a report and has decided not to do anything about it, the Validator will still prune the search when it finds the report the next time. To overcome this problem, change the report action for this particular report type from prune to continue. See "Configuring the Validator" for more information.

• Some parts of the system are, in fact, unreachable.

  If some parts of the SDL system are not reachable at all, it may be an indication that there is a design error in the system.

• There are problems with timer expirations.

  The validator is by default configured in a way that tries to reduce the size of the state space. It will always try to execute internal actions (e.g. tasks, decisions, internal input and outputs) before any timers are allowed to expire. The assumption is that the system will always execute fast enough to ensure that no timers will expire (the timers may of course expire when waiting for input from the environment). To make a more complete test of this type of situation, see "Using Advanced Validation" .

• The search depth was too small.

  The default search depth is 100. This may not be enough for some systems, e.g. a system with a very long initialization phase. In some cases, it is possible to overcome this problem simply by increasing the search depth (see "Configuring the Validator" ). However, the techniques discussed in "Validating Large Systems" are often more suitable.

• The state space is too big.

  Many SDL systems of reasonable complexity quite simply have state spaces that are too big; it is not possible to explore the entire state space in one exploration. Characteristic for this situation is a low symbol coverage, truncated paths, and either manually stopped exploration or a high (>10%) collision risk. This situation is discussed in "Validating Large Systems" .

To find out which parts of the system that have not been reached, a tool called the Coverage Viewer is used. To start the Coverage Viewer, select Show Coverage Viewer from the Commands menu, or enter the command Show-Coverage-Viewer. If the symbol coverage was less than 100%, the Coverage Viewer will display a tree structure representing the parts of the system that have not been executed.