Generating Multiple Diverse Counterexamples for an EFSM

Model checking is a powerful technique for debugging a system description because it generates a counterexample showing a path of the system that fails a property. Instead of the traditional cycle of find bug – fix bug – re-run model checker, often we would like to study multiple bugs before fixing the model to help isolate the cause of the error and to improve the user’s experience by avoiding iterations of this cycle. However, the set of all counterexamples is often too large to generate or comprehend, and several counterexamples may be caused by the same error. We present a novel method of using a model checker to generate a set of diverse counterexamples to an invariant of an extended finite state machine (EFSM) model. The goal is that each diverse counterexample reveals distinct information about a bug in the model. We use the modelling abstractions of control states and transitions of an EFSM to define whether two counterexamples are equivalent or not. Our method reduces the set of counterexamples on-the-fly and can be used with any LTL model checker.