Experience applying the SPIN model checker to an industrial telecommunications system

Model checking has for years been advertised as a way of ensuring the correctness of complex software systems. However, there exist surprisingly few critical studies of the application of model checking to industrial-scale software systems by people other than the model checker's own authors. In this paper we report our experience in applying the Spin model checker to the validation of the failover protocols of a commercial telecommunications system. While we conclude that model checking is not yet ready for such applications, we find that current research in the model checking community is working to address the difficulties we encountered.