An automatic verification technique that exhaustively explores the state space of a formal model of a system (usually a finite‑state transition system) to determine whether the model satisfies a specification expressed in a temporal or modal logic, producing counterexample traces when the property is violated.

Principle

Translate the system into a finite or symbolic state model, express the desired property in a specification logic (e.g., LTL, CTL), and perform an exhaustive (explicit, symbolic, bounded or partial‑order reduced) search of reachable states to check the property; counterexamples are concrete execution traces violating the property.

Demonstration

Verify an LTL safety property on a finite-state concurrent system using symbolic model checking with BDDs or SAT‑based bounded model checking: if the property fails, the tool returns a finite trace showing the sequence of transitions leading to the violation, which can be inspected for debugging.

Misapplication

Applying model checking naively to infinite-state systems without abstraction, assuming that bounded model checking proves unbounded properties, or misinterpreting counterexamples produced under abstractions (spurious counterexamples) as real bugs.

Consequence

Model checking gives fully automatic counterexample‑guided bug finding and, where feasible, guarantees about correctness for the explored model; it forces precise formalisation of system behaviour and requirements but faces the state‑space explosion problem that limits scalability.

Reversal

Instead of exhaustive state exploration, one may use deductive verification or theorem proving that reasons about classes of behaviours symbolically; the reversal trades automation and concrete counterexamples for generality and proof obligations.

Boundary

Best suited to finite‑state or finitely representable systems, or to systems amenable to sound abstraction; different logics and model types (timed, probabilistic, hybrid) require extended algorithms. Model checking addresses model correctness w.r.t. a specification, not implementation-level or environment assumptions unless encoded in the model.

Semantic Tension

Tension exists between explicit‑state model checking, symbolic methods (BDD, SAT/SMT) and abstraction/refinement approaches: choices affect scalability, counterexample interpretability and whether results are exhaustive or bounded. There is also a tradeoff between fully automatic search and interactive proof techniques.

Synthesis

Model checking is an automated, exhaustive analysis of a formal model against temporal or logical specifications that provides concrete counterexamples for debugging and, when applicable, full correctness guarantees; its power depends on representation, abstraction, and search techniques that address state‑space explosion.