Systematic Evaluation of Black-Box Checking for Fast Bug Detection
Bram Pellen, María Belén Rodríguez, Frits Vaandrager, Petra van den Bos
TL;DR
The paper systematically evaluates black-box checking (BBC), which fuses active automata learning, model-based testing, and model checking, on 77 real benchmark models to assess its speed and effectiveness in bug detection. It confirms that applying model checking to all hypotheses dramatically speeds up bug discovery (BBC uses a small fraction of the queries required by learning-only approaches) and remains effective even when the full model cannot be learned, achieving 94% detection on challenging RERS benchmarks. The study further shows BBC outperforms standalone MBT in finding deep bugs, and that runtime monitoring provides a modest additional speedup. Overall, the work validates BBC as a powerful, practical approach for fast bug detection in black-box systems with available safety specifications, while outlining directions for enhancement and broader evaluation.
Abstract
Combinations of active automata learning, model-based testing and model checking have been successfully used in numerous applications, e.g., for spotting bugs in implementations of major network protocols and to support refactoring of embedded controllers. However, in the large majority of these applications, model checking is only used at the very end, when no counterexample can be found anymore for the latest hypothesis model. This contrasts with the original proposal of black-box checking (BBC) by Peled, Vardi & Yannakakis, which applies model checking for all hypotheses, also the intermediate ones. In this article, we present the first systematic evaluation of the ability of BBC to find bugs quickly, based on 77 benchmarks models from real protocol implementations and controllers for which specifications of safety properties are available. Our main finding are: (a) In cases where the full model can be learned, BBC detects violations of the specifications with just 3.4% of the queries needed by an approach in which model checking is only used for the full model. (b) Even when the full model cannot be learned, BBC is still able to detect many violations of the specification. In particular, BBC manages to detect 94% of the safety properties violations in the challenging RERS 2019 industrial LTL benchmarks. (c) Our results also confirm that BBC is way more effective than existing MBT algorithms in finding deep bugs in implementations.