The changing role of finite-state model checking

The post discusses the changing role of finite-state model checking in light of advancements in automated theorem proving. For years, users of TLA+ and other formal specification languages faced a classic trade-off between extensive effort for formal proof and reduced effort with finite-state model checking, achieving around 80% confidence. However, recent improvements in automated theorem proving might alter this economic calculation.

Finite-state model checking, which involves exploring every possible system state, has been considered obsolete since the mid-1990s due to the emergence of symbolic model checking. Symbolic model checking can handle larger model sizes and overcomes combinatorial state explosion issues. It is widely used in industrial model checker users, especially in processor design.

Finite-state model checking, however, remains relevant due to its simplicity and comprehensibility. Any software engineer can understand and even write their own finite-state model checker, making it accessible to a broader audience.

Finite-state model checking finds applications in test case generation and trace validation. In test case generation, the model acts as a test-case generator that pushes the system under test around the state space, ensuring the system upholds various properties. In trace validation, logs and traces collected from the system are compared with the model to verify valid execution.

Despite its usefulness, finite-state model checking faces challenges when applied to software testing. Implementing model-based testing (MBT) and trace validation requires significant effort, as most existing systems were not designed with testing in mind. While deterministic simulation testing shows potential, other test methodologies struggle due to the complexity of execution trace post-processing and the need for a large investment in trace collection.

In conclusion, finite-state model checking's relevance appears limited to niche applications like test case generation and trace validation. Its simplicity and comprehensibility set it apart from more opaque and complex tools, making it valuable for those who prioritize understanding and control over advanced capabilities.