On improving efficiency of model checking through systematically ...

==0
b==1
modify
modify
b:=1
modify!
s0 s s1
b>1
end
modify!
b:=0
Figure 5.3: A finite system
Uppaal could prove the simple system in Figure 5.3 very quickly. Hence, the
existence of input variables in the model is not the major reason for state
space explosion.
The warning we got when verifying the tiny example suggested us to
switch our concentration to the way values of variables changed along the
simulation. It turned out that values of variables in abstract models of the
Fischer’s protocol and Subway system increased forever, and thus the state
space is infinite. Figure 5.4 shows a modified version of the above simple
model that illustrates this phenomenon in verification performed by Uppaal.
b==0
x := x + 1
b==1
y := y - 1
modify
modify
b:=1
modify!
s0 s s1
y > x
end
modify!
b:=0
Figure 5.4: An infinite system
The system starts with x and y are both zero. Although we can easily
see that there is no way for the system to go to location “end”, UPPAAL
could not prove it. In our observation, verification done by Uppaal in this
case is very much similar to a simulation on all posibilities of variable values
rather than a linear relation analysis on variables in a model. We believe
that this is the main reason for the state space explosion in model checking
52