Lecture Notes in Computer Science 3472

19 Model Checking 599
have created a learning algorithm for systems without reset that are strongly
connected.
Moreover Berman and Roos [BR87] present a learning algorithm for a subclass
of context-free languages accepted by counter machines and Freund et
al. [FKR + 93] give algorithms for learning finite automata on the basis of a single
long walk in an average-case setting. Maler and Pnueli [MP95] study the
problem of learning sets of infinite strings. In [DH03a, DH03b], learning of regular
tree languages is studied. Learning of timed systems is addressed in [GJL04].
Looking at Angluin’s algorithm, it becomes obvious that there is a trade-off
between membership and equivalence queries. Instead of performing an equivalence
query for a closed and consistent table, one could compare the row labels
of equal rows on further suffixes by membership queries. This might reveal an
inconsistency, yielding a separation of the previously equal rows, and thus more
states. For every such case, an equivalence query could be saved. This idea is
worked out in [BDGW94] and [BGHM96].
19.5 Adaptive Model Checking
In the first section of this chapter, we have studied automatic means for verifying
SUTs based on model checking. However, model checking requires a model. If the
system under test is a black box, one can use the learning techniques explained
in the previous section to learn a model of the box. Then model checking can be
applied.
In [GPY02] a method that integrates learning a model of the black box and
verifying it is presented. It is termed Adaptive Model Checking (AMC). It
is similar to the method previously studied in [PVY99] under the term black
box checking.
Adaptive model checking is a method that deals with the problem of having
an inaccurate model of a SUT. Given a property that the system must satisfy,
model checking is performed on a preliminary model and if a counterexample is
found it is compared with the system under test. The result of the comparison
is either that the SUT does not satisfy the property or an automatic refinement
of the model.
First, we present an overview of the algorithm in Figure 19.15. The algorithm
used for learning is Angluin’s algorithm [Ang87] and the algorithm for performing
the equivalence check between the model and the SUT is the Vasilevskii-Chow
(VC) algorithm [Vas73, Cho78]. Note that there are two sorts of counterexamples
in this setting, videlicet counterexamples produced by the model checker, called
mc-counterexamples, and counterexamples produced by the VC algorithm, called
vc-counterexamples.
In the black box checking scenario no initial model is assumed to exist and
Angluin’s algorithm starts from scratch. The AMC algorithm starts with the
model learned so far. This model might be inaccurate. The AMC algorithm
applies model checking to this model. There are two possible outcomes of this
check: