The results on this page were obtained with Mcta's abstract distance function hL which is based on the monotonicity abstraction. All results were computed on an Intel Xeon with 2.66 Ghz with Mcta-0.1. All benchmark files can be obtained in the download section. Dashes in the tables indicate out of memory (more than 4 GB). The results were obtained with the following command line options:

A* Search

f(s) = h(s) + depth(s), returns shortest error traces for admissible h

mcta -o3 -h5 -c2
Greedy Search

f(s) = h(s)

mcta -o2 -h5 -c2
Useless Transitions (UT)

f(s) = h(s) + depth(s) if s is reached via a useless transition, h(s) otherwise

mcta -o2 -h6 -c2

States with lower f values are preferred. If you are interested in more information about directed model checking, go here.

Single-tracked Line Segment

The Single-tracked Line Segment study stems from an industrial project partner of the UniForM-project [2] and the problem is to design a distributed real-time controller for a segment of tracks where trams share a piece of track. A distributed controller was modeled in terms of PLC-Automata [2, 3], an automata-like notation for real-time programs. The PLC-Automata were translated into timed automata with the tool Moby/RT [4]. For the evaluation of our approach we choose the property that never both directions are given permission to enter the shared segment simultaneously. This property is ensured by 3 PLC-Automata of the whole controller and we injected an error by manipulating a delay such that the asynchronous communication between these automata is faulty. In Moby/RT abstractions are offered for the translation into the timed automata. The given set of PLC-Automata had eight input variables and we constructed six models with decreasing size by abstracting more and more of these inputs.

explored statesruntime in speak memory in MBtrace length
C8.q-11.91e+6816-144.30.3-1.4 G59-564495
C9.q-27.74e+613423-326.83.2-3.0 G73-580390

Mutual Exclusion

Mutual Exclusion is a case study that models a real-time protocol to ensure mutual exclusion of a state in a distributed system via asynchronous communication. The protocol is described in full detail in [3]. By increasing an upper time bound in the model we got a flawed specification that we transformed into its timed automata semantics by applying various abstractions techniques. The resulting models do not have many automata but a non-trivial amount of clocks and variables.

explored statesruntime in speak memory in MBtrace length


We use two variants of the Fischer protocol for mutual exclusion, which is well-known and scalable. The test examples are denoted FXi in the tables, where X is A, B and i is the number of parallel automata. The error condition is that at least two of the i automata are in a certain location simultaneously. We made the error possible by weakening one of the temporal conditions in the automata (from "<" to "≤"). The variants differ in the way they encode the error condition (note that we have no disjunction in our language).

Variant A adds additional automata with synchronisation.

explored statesruntime in speak memory in MBtrace length

Variant B selects and specifies two of the automata for the error condition.

explored statesruntime in speak memory in MBtrace length

Arbiter Tree

This case study models a mutual exclusion protocol based on a tree of binary arbiter processes. Client processes are situated at the leaves of the tree. In order to gain access to the shared resource, they may send a request to their respective parent, which in turn passes the request on to its parent, etc. When the root process of the tree receives a request, it generates a grant which is then propagated back down. When the client is done with the resource, it sends a release signal.

In order to avoid blocking client processes, arbiters need to be ready to receive requests from one of their children even when they are already processing one for the other child. In this case it makes sense to send a grant to the second child as soon as a release is received from the first, instead of first forwarding the release upwards and sending a new request. This can be applied asymmetrically (giving a grant to the left child first, and always forwarding releases from the right child to the parent) in order to not monopolize the resource.

explored statesruntime in speak memory in MBtrace length
A4.q4.44e+67681195135. G11659224222

Valid XHTML 1.0! Valid CSS!