Preliminaries
necessarily imply that the stated property is indeed satisfied in all cases.
Hence the need for testing. Despite the positive verdict by the model
checker, testing is necessary to ascertain at least for a given set of situa-
tions that the application indeed satisfies the property.
While both model-checking and model-based testing use models,
model checking uses finite-state models augmented with local proper-
ties that must hold at individual states. The local properties are known
as atomic propositions and the augmented models as Kripke structures.
In summary, model-checking is to be viewed as a powerful and com-
plementary technique to model-based testing. Neither can guarantee
whether an application satisfies a property under all input ...