Lecture Notes in Computer Science 3472

19 Model Checking 581
We conduct an equivalence query for A 0 in order to see if the conjecture is
correct. As answer we get a counterexample t = ab, weseethatab �∈ L(Mex )
but ab ∈ L(A 0 ). The counterexample can be divided into prefix and suffix,
u0 = ε and v0 = ab in order to find the breakpoint where Mex and A 0 behave
differently. A state in a hypothesis is called si, for this counterexample 0 ≤ i ≤ 2.
We see that a breakpoint can be found for i =0sinces0ab �∈ L(Mex ) but s1b ∈
L(Mex ) (Recall that s1 = δ(s0, a)). Thus b is the experiment that distinguishes
s0a = γ(ε)a = a from s1 = γ(εa) =ε.
Step 0 Step 1
C0 ,E0 C1 ,E1 C2 ,E2 C3 ,E3 C0 = {(ε, +)}, E0 = {ε}
Step 2
C0 = {(ε, +), (b, +)}, E0 = {ε, b}
C1 = {(a, +), (ab, −)}, E1 = {ε, b}
Step 3
C0 ,E0 C1 ,E1 C2 ,E2 C3 ,E3 − −
C
−
1 = {(a, +), (ab, −), (aa, −)},
E1 = {ε, b, a}
C2 = {(aa, −)}, E2 = {ε} −
C3 = {(b, +), (ba, +), (bb, −)},
E3 = {ε, a, b}
Table 19.1. The observation pack
It is now enough to add (b, +) to the component Cε, soC0 = {(ε, +), (b, +)}
and E0 = {ε, b}. Nowγ(a) is no longer s0 since a escapes and therefore we
expand the pack with a new component C1, whereC1 = {(a, +), (ab, −)} and
E1 = {ε, b}, see Step 1. The mapping of b to an access string is now changed to
γ(b) =a.
The next step is to make the pack closed, the missing words are aa and
ab. Using membership queries we try to discover an existing access string aa
behaves like, but we cannot find one, so it escapes. From the observation (aa, −)
we create a new component, C2 = {(aa, −)}, whose corresponding suffix set is
E2 = {ε}, see Step 2. (The suffix ε differentiates s2 from all other access strings,
so no further suffixes need to be added to C2.) The next word to map into an
access string is ab and we see that γ(ab) =aa.
Since we now created a new component C2 we must make sure that the pack
is closed, hence we have to check to what access strings the strings aaa and
aab are be mapped. Checking these yields γ(aaa) =aa and γ(aab) =aa. The
observation pack is now closed and it is possible to form a hypothesis, A 1 ,about
the machine, see Figure 19.9.
Now we conduct an equivalence query for the hypothesis A 1 .TheOracle
returns a counterexample t = ba. Again we perform the search for a breakpoint
in t, we initialize the prefix and suffix of t to be u0 = ε and v0 = ba, respectively.
The breakpoint is found for i =0wheres0ba ∈L(Mex ) but s1a �∈ L(Mex).
In order to adjust A 1 ,weadd(aa, −) tocomponent(Cs1 = Ca =)C1, transforming
it into C1 = {(a, +), (ab, −), (aa, −)}. Nowγ(b) is not anymore a (it
does not behave as a on suffix a) but is instead undefined. This implies that we