Specification guidelines to avoid the state space explosion problem

Abstract

SUMMARYDuring the last two decades, we modelled the behaviour of a large number of systems. We noted that different styles of modelling had quite an effect on the size of the state spaces of the modelled systems. The differences were so substantial that some specification styles led to far too many states to verify the correctness of the model, whereas with other styles, the number of states was so small that verification was a straightforward activity. In this article, we summarize our experience by providing seven specification guidelines to keep state spaces small. For each guideline, we provide an application, generally from the realm of traffic light controllers, for which we provide a 'bad' model with a large state space, and a 'good' model with a small state space. The good and bad models are both suitable for their purpose but are not behaviourally equivalent. For all guidelines, we discuss circumstances under which it is reasonable to apply the guidelines. Copyright

Verifying System-Wide Properties of Industrial Component-Based Software

“…The reason for this appears to lie in the run-to-completion semantics employed in ASD, together with the strict use of interfaces. These coincide with design rules for systems to avoid the state space explosion [10]. There were a number of minor issues that had to be overcome, such as speeding up writing intermediate results to disk.…”

A Formally Verified Fail-Operational Safety Concept for Automated Driving

“…We made the following model assumptions to clarify the scope of our study and keep the model small enough [ 27 ] DSM concept. However, power management is in general out of our scope.…”

Nets-within-nets for modeling emergent patterns in ontogenetic processes

“…At the moment, NWN models have been mainly used through simulation since the formal analysis of such complex graphs is not trivial due to the state-space explosion problem [30] . In particular, model checking is a promising method to verify systems that are modeled as state transition graphs [14] .…”